How Does Process Creation and the Process Hierarchy Work?
Learn how process creation works — fork, exec, zombies, and orphan reparenting — with a clear OS interview question answered.
Expected Interview Answer
A process is created when an existing parent process calls a system call like fork (Unix) or CreateProcess (Windows), producing a child process with its own PID that the OS tracks in a tree-shaped hierarchy rooted at an init process, and this parent-child relationship governs resource inheritance, signal delivery, and cleanup.
On Unix-like systems, fork() duplicates the calling process’s address space (via copy-on-write for efficiency) to create a near-identical child, which then typically calls exec() to replace its memory image with a new program, forming the classic fork-exec pattern; Windows instead uses a single CreateProcess call that combines both steps. Every process except the very first (init, or PID 1) has a parent, and the OS records these links so the process tree can be inspected — a process’s children inherit certain properties like environment variables and open file descriptors, but not its own PID or execution state. When a child terminates, it becomes a zombie until the parent calls wait() (or waitpid()) to collect its exit status and let the OS reclaim its PCB; if the parent exits first, the child is reparented to init (or a subreaper), which is responsible for reaping it so it does not become an orphaned zombie forever. This hierarchy matters for signal propagation (a signal sent to a process group can reach all descendants), resource limits inherited from the parent, and orderly cleanup when a parent process — like a shell — exits.
- Explains the fork-exec pattern underlying most Unix process creation
- Clarifies what a zombie process is and why wait() matters
- Shows how orphaned processes are reparented to avoid leaks
- Connects process hierarchy to signal delivery and resource inheritance
AI Mentor Explanation
Process creation is like a franchise setting up a new academy team: the parent club (fork) duplicates its playing philosophy and staff structure into the new team, which then often adopts a completely different coaching program (exec) suited to its own level. Every academy team traces back to the original head office, and if a mid-level academy shuts down, its junior squads are handed over to the head office rather than being left unmanaged, just as orphaned processes are reparented to init.
Step-by-Step Explanation
Step 1
fork()
The parent process calls fork(), and the OS creates a near-identical child with a new PID, using copy-on-write for efficiency.
Step 2
exec()
The child typically calls exec() to replace its memory image with a new program, completing the fork-exec pattern.
Step 3
Parent-child link
The OS records the relationship in the process tree, enabling signal propagation and resource inheritance down the hierarchy.
Step 4
Termination and reaping
On exit, the child becomes a zombie until the parent calls wait(); if the parent exits first, the child is reparented to init for reaping.
What Interviewer Expects
- Correctly describing the fork-exec pattern (or CreateProcess on Windows)
- Explaining what a zombie process is and why wait() is needed
- Knowing that orphaned processes are reparented to init
- Awareness of the process tree and its role in signals/inheritance
Common Mistakes
- Confusing fork() with exec() or thinking they always occur together automatically
- Not knowing what a zombie process is or how it is cleaned up
- Believing an orphaned process is left completely unmanaged
- Thinking a child process shares the exact same PID as its parent
Best Answer (HR Friendly)
“When one program starts another, the operating system creates a new child process that is linked back to the parent that launched it, forming a family tree of processes. If a child finishes before its parent has acknowledged it, it briefly becomes a leftover entry until the parent checks on it, and if the parent itself disappears first, the operating system automatically adopts the orphaned child so it is never left unmanaged.”
Code Example
#include <unistd.h>
#include <sys/wait.h>
int main(void) {
pid_t pid = fork(); /* duplicate the current process */
if (pid == 0) {
/* child process: replace image with a new program */
execlp("ls", "ls", "-l", NULL);
_exit(1); /* only reached if exec fails */
} else {
int status;
waitpid(pid, &status, 0); /* reap the child, avoid a zombie */
}
return 0;
}Follow-up Questions
- What is copy-on-write and how does it make fork() efficient?
- What is a zombie process and how is it different from an orphan?
- What happens if a parent never calls wait() on its children?
- How does Windows CreateProcess differ from the Unix fork-exec model?
MCQ Practice
1. What does fork() do in a Unix-like OS?
fork() creates a child process that starts as a copy of the parent, typically followed by exec() to load a new program.
2. A terminated child process that has not yet been reaped by wait() is called?
A zombie process has exited but still holds a PCB entry until the parent collects its exit status via wait().
3. If a parent process exits before its children, what happens to those children?
Orphaned children are adopted by init (PID 1) or a designated subreaper, which is responsible for eventually reaping them.
Flash Cards
What is the classic Unix process creation pattern? — fork() to duplicate the process, then exec() to load a new program.
What is a zombie process? — An exited child whose exit status has not yet been collected by wait().
What happens to an orphaned process? — It is reparented to init (or a subreaper) so it can still be reaped.
What structure tracks parent-child relationships? — The OS-maintained process tree, rooted at init (PID 1).