OS / Linux

pthread_create() (POSIX) spawns a new thread inside the current process: it shares the address space, file descriptors, and heap. fork() creates a whole new process with its own copied memory. CreateThread is the Windows equivalent, not POSIX.

An FD is a small non-negative integer indexing the process's open-file table. Standard: 0=stdin, 1=stdout, 2=stderr. Kernel entry stores offset, flags (O_RDONLY, O_NONBLOCK), inode ref. open() returns an FD; close() releases; FDs survive fork(). dup2(old, new) redirects. Limit: ulimit -n.

Both are OS-scheduled units. A process has its own address space, FDs, and heap (isolated); a thread shares memory and open files with siblings inside its process. Threads are cheaper but less isolated.

PID is a unique kernel-assigned integer; init/systemd has PID 1. Kernel tracks processes in a table (task_struct): PID, PPID, state (running/sleeping/zombie/stopped), VM map, FDs, signal handlers, regs, priority. fork() creates a CoW child; exec() replaces the image; wait() reaps zombies. ps, top, /proc/[pid]/ show state.

fork() creates an exact copy of the process — same memory (via copy-on-write), same fds. exec*() replaces the current image with a new program (fd table preserved by default). To run a new program: fork, then call exec in the child; parent stays and waits. The fork-then-exec split is more flexible (and harder) than Windows' CreateProcess.

A syscall switches CPU from user to kernel mode for things the process can't do directly (open files, alloc memory). Mechanism: special instruction (syscall on x86_64, svc on ARM), args in registers, kernel handles it. Hundreds of cycles vs tens for a function call — hence batched I/O (writev, io_uring). strace traces them.

UID/GID identify the owner of a process/file. Each process has real, effective (for checks), and saved UID (for seteuid restore). Permissions: three rwx groups — owner, group, others (9 bits, e.g., rwxr-xr-- = 754). Special bits: setuid, setgid, sticky (on dir: only owner deletes). UID 0 = root: bypasses most checks.

Components: kernel (CFS scheduler, MMU/paging, I/O drivers); processes (fork/exec/wait, signals, namespaces); memory (virtual memory, mmap, OOM killer); FS (VFS over ext4/XFS/btrfs); network (TCP/IP, sockets, netfilter); IPC (pipes, shared memory, futex); syscalls — user/kernel boundary via syscall.

A context switch is when the CPU stops running one thread and starts another. The kernel saves the outgoing thread's register file, stack pointer, instruction pointer, and (for process-to-process switches) page tables; restores the incoming thread's. Cost: ~1-10μs plus indirect TLB/cache pollution.

No. fork() gives the child its own private address space; pages start shared as copy-on-write, but the first write by either side triggers a private copy. Parent and child see only their own writes — sharing needs explicit mmap(MAP_SHARED) or other IPC.

Yes. fork() duplicates the parent's file descriptor table, so the child gets its own fd numbers pointing to the same open file descriptions. The child can read the file, and parent and child share one file offset — a read in either advances it for both.

poll() — it is POSIX, so it works the same on Linux, the BSDs, and macOS, and unlike select() it has no FD_SETSIZE cap on descriptor numbers. epoll (Linux) and kqueue (BSD/macOS) scale better for huge descriptor sets but are non-portable, so poll() is the portable choice.

Pipes (parent/child), named pipes/FIFOs, sockets (cross-machine), shared memory (fastest but needs sync), message queues, signals (very limited data), and files.

Call fcntl(fd, F_SETFL, fcntl(fd, F_GETFL) | O_NONBLOCK). Then a read() or write() that would otherwise block — e.g. writing to a pipe no reader is draining — returns -1 with errno set to EAGAIN/EWOULDBLOCK instead of stalling. This lets one thread service many descriptors via poll() without ever getting stuck.

Linux default is CFS: each runnable task accumulates vruntime; scheduler picks the lowest vruntime, weighted by nice. RT policies (SCHED_FIFO, SCHED_RR) preempt CFS by priority. EEVDF (newer kernels) replaces CFS. CPU pinning (taskset, sched_setaffinity) limits a thread to a CPU set for cache locality.

The signal's default disposition runs — every signal has one. The default may be Term (terminate, e.g. SIGUSR1, SIGTERM), Core (terminate + dump core, e.g. SIGSEGV), Ignore (e.g. SIGCHLD), or Stop (e.g. SIGSTOP).

Signals are async notifications: SIGINT, SIGTERM, SIGKILL (uncatchable), SIGSEGV, SIGCHLD. Install handlers via sigaction. Inside a handler only async-signal-safe functions are allowed (POSIX list: write, _exit, kill); printf, malloc, STL are unsafe. Standard pattern: set volatile sig_atomic_t flag, handle in main loop.

Each process gets its own virtual address space; the OS and MMU translate virtual pages (4KB) to physical frames via page tables. Pages may be unmapped, shared, copy-on-write, swapped, or mmap'd to files.

A pipe is a unidirectional in-kernel byte stream between related processes. pipe(fds) creates fds[0] (read), fds[1] (write); shell | uses pipes. FIFO (mkfifo) has a filesystem path so unrelated processes open by name. Blocks on full (writer) or empty (reader) buffer. Alternatives: Unix sockets, shared memory, message queues.

select() takes a struct timeval timeout with microsecond precision, so it can pause for fractions of a second. More importantly, it waits on file-descriptor readiness at the same time, ending the pause early if a descriptor is ready. Plain sleep() accepts only whole seconds and wakes for nothing else.

stat() follows the symlink: it reports the target file — its real size, and a type like S_IFREG. lstat() does not follow it: it reports the link itself, with type S_IFLNK and a size equal to the length of the path string the link stores.

A process has its own address space, FD table, PID — creation duplicates page tables (CoW), allocates PCB, FD table. A thread shares parent's address space and FDs — kernel allocates only TCB, kernel stack, TLS. Linux represents both as task_struct; threads share more state. Thread create is ~10× faster than fork.

Open it with open(path, O_CREAT|O_EXCL, mode). The kernel checks for the file's absence and creates it as one atomic operation; if the file exists the call fails with EEXIST. A separate stat()/access() check then open() is a TOCTOU race.

Functions like readdir and strtok keep per-process static state, so concurrent calls from two threads corrupt each other. The _r variants take a caller-supplied buffer, making them reentrant. Note: modern glibc readdir is thread-safe per DIR*, so readdir_r is now deprecated.

Multiple processes map the same physical pages — zero-copy IPC. Needs explicit sync inside the region; pointers are process-local (use offsets); structs need fixed layout (no virtual); cleanup via shm_unlink.

VSZ: total virtual address space mapped — includes unused/lazy/file-mapped regions. RSS: physical pages in RAM for this process; counts shared pages fully toward each user. PSS: like RSS but shared pages are divided among sharing processes — the only metric that adds up across processes to total RAM.

cgroups limit and account resource usage of a process group: CPU, memory, I/O, PIDs, network. They form the resource side of containers (Docker, k8s, systemd). cgroups v2 unifies the hierarchy (one tree, multiple controllers). Used for: bounding runaway processes, fair sharing across services, per-group OOM scoring, accurate metrics.

Kernel threads (1:1) are OS-scheduled — true multi-core parallelism, but switching costs microseconds. User threads (M:N) are runtime-scheduled — cheap and fast, but a blocking syscall stalls the underlying OS thread.

On exec of a dynamic ELF, kernel loads the loader (ld-linux.so); loader maps program, then DT_NEEDED libs (search: LD_LIBRARY_PATH, /etc/ld.so.cache, RPATH, RUNPATH, default), resolves symbols, runs _init/ctors. LD_PRELOAD=/path/lib.so forces a library first so its symbols intercept later ones — for debug, sandbox, replacing malloc.

mmap maps a file into the address space; reads become pointer dereferences with on-demand paging. Wins for random access in large files and zero-copy IPC. Loses to read on small files, short scans, networked filesystems (SIGBUS on errors).

Namespaces isolate a process's view of system resources. Types: PID (own process tree), NET (own stack), MNT (own mounts), UTS (hostname), IPC (System V/POSIX IPC), USER (uid/gid mapping), CGROUP, TIME. A container = process with a set of namespaces (isolation) + cgroups (limits) + rootfs. Created via unshare syscall or clone flags.

Use OS primitives outside any process: named semaphores (sem_open), file locks (flock/fcntl), pthread_mutex with PTHREAD_PROCESS_SHARED in shared memory, futexes, or message queues.

POSIX SHM (shm_open + mmap) creates a named object in /dev/shm (tmpfs); processes open by name and mmap it. System V (shmget/shmat) uses integer keys via ftok, lives in kernel structures, persists until removed. POSIX is FS-friendly (ls /dev/shm), survives until last shm_unlink, integrates with FDs. System V is legacy.

Process A keeps reading normally. unlink only removes the directory entry (the name); the inode and its data blocks survive while any open fd references them. The file just can't be opened by name anymore. Disk space is reclaimed when the last fd closes.