Processes: what is actually running

A process is a program that is running. Each has a PID and a parent; kill the parent and its children go too, unless a supervisor restarts them.

A process is a program that woke up. Each one has an ID number, its PID, and a parent, so together they form a family tree from PID 1 down to your app. Click any process to inspect it, then start killing things and watch who dies with whom, and who comes back.

process tree · demo-vps
    Inspector
    Click a process above.
    What just happened
    • Waiting for your first move.
    Connection to demo-vps closed by remote host.
    You killed sshd, the process that carries every SSH session. Including yours. On a real box you'd be locked out until you used your provider's rescue console.

    What you just learned

    Kill the parent and the children go with it. That is why your app dies when you close the window you started it in: your SSH session (the connection from your laptop to the server) owns the shell, the shell owns your app, and closing the window takes the whole branch with it.

    Some parents resurrect their children. You killed an nginx worker and the master replaced it in a second. When "it keeps coming back," a supervisor is doing its job. But when you killed the master itself, nothing brought it back, and your hand-started app stays dead too. Coming back after a crash is a setting you turn on, one restart rule in a service manager. That is block 08.

    A process is an employee. PID 1 is the founder, everyone else got hired by someone, and some managers instantly re-hire for any seat that goes empty.
    You can name it now: say this to your AI
    Something is already using port 3000 on my server. Find the process holding it, tell me what started it, and whether it is safe to kill.
    "It's broken" gets you a guess. "Find the process holding port 3000" gets you the fix.

    Seen on a real server

    Error: listen EADDRINUSE: address already in use :::3000
    Another process already holds port 3000. Find it with ss -tulpn (block 06) and kill it only if it is yours, usually a copy of your own app.