// fork: duplicate the calling process
pid_t pid = fork();
if (pid == 0) {
    // child: execve replaces the process image
    execve("/bin/ls", args, envp);
} else {
    // parent: wait for child to avoid zombie
    waitpid(pid, &status, 0);
}

// clone: low-level syscall behind fork() and pthread_create()
// Flags control which resources are shared:
// CLONE_VM (share memory), CLONE_FS (share cwd/root),
// CLONE_FILES, CLONE_SIGHAND, CLONE_THREAD (same TGID)

# Find zombie processes
ps aux | awk '$8 == "Z"'
ps -eo pid,ppid,stat,comm | grep ' Z'

# Find the parent of a zombie and investigate
ps -o pid,ppid,stat,comm -p <zombie-pid>
# If parent is stuck, killing/restarting it lets init reap zombies

# Orphan process — parent died; reparented to PID 1 (init/systemd)
cat /proc/<pid>/status | grep PPid

# Show full process tree with IDs
ps -eo pid,ppid,pgid,sid,uid,comm --forest

# Show IDs of current shell
echo "PID=$$  PPID=$PPID  PGID=$(ps -o pgid= $$)  SID=$(ps -o sid= $$)"

# Show all threads of a process
ps -eLf | grep <pid>
ls /proc/<pid>/task/       # one dir per thread

# Command line of a process
tr '\0' ' ' < /proc/<pid>/cmdline; echo

# Memory usage breakdown
grep -E 'VmRSS|VmSize|VmSwap|Threads' /proc/<pid>/status

# Open files
ls -la /proc/<pid>/fd

# Find deleted files held open (common cause of disk-full)
ls -la /proc/*/fd 2>/dev/null | grep deleted

# Memory maps
cat /proc/<pid>/maps

# Stack trace (if kernel supports it)
cat /proc/<pid>/stack

# Send SIGTERM (graceful shutdown) — default
kill <pid>
kill -15 <pid>
kill -TERM <pid>

# Force kill — use only if SIGTERM fails after a timeout
kill -9 <pid>
kill -KILL <pid>

# Reload config
kill -HUP <pid>

# Send to whole process group (negative PID)
kill -TERM -<pgid>

# By name
pkill nginx                        # SIGTERM to all matching
pkill -9 -x nginx                  # exact name match, SIGKILL
pkill -HUP -u www-data nginx       # match user + name

# killall — by exact name
killall -TERM gunicorn

# Show all signal names
kill -l

cleanup() { echo "cleaning up..."; rm -f /tmp/my-lockfile; }
trap cleanup EXIT          # always run on exit
trap cleanup INT TERM      # also on Ctrl+C and kill
trap '' HUP                # ignore SIGHUP

# Run in background
my-command &
jobs                     # list background jobs
fg %1                    # bring job 1 to foreground
bg %1                    # resume stopped job in background

# Ctrl+Z suspends foreground process (sends SIGTSTP)

# disown — detach job from shell (won't get SIGHUP when shell exits)
my-command &
disown %1

# nohup — immune to SIGHUP; redirects stdout/stderr
nohup my-command > /var/log/my.log 2>&1 &

# setsid — create new session (fully detach from terminal)
setsid my-command &

# Run in new process group
set -m   # enable monitor mode (job control) in scripts

# Show current limits
ulimit -a

# Raise open file limit for current shell session
ulimit -n 65536

# Check limits of a running process
cat /proc/<pid>/limits

# Persistent limits in /etc/security/limits.conf
*    soft nofile 65536
*    hard nofile 131072
www-data soft nproc  2048

# Set limits when launching a process (prlimit)
prlimit --nofile=65536:131072 -- my-server

# Set limits in a systemd service
# [Service]
# LimitNOFILE=65536
# LimitNPROC=4096

# Inspect cgroup hierarchy
systemd-cgls
cat /proc/<pid>/cgroup

# Show resource usage for a service
systemctl status my-service     # shows CPU/memory at bottom
systemd-cgtop                   # live per-cgroup resource usage

# Set memory limit on a service (systemd)
systemctl set-property my-service MemoryMax=512M

# Or in the unit file [Service] section:
# MemoryMax=512M
# CPUQuota=50%
# TasksMax=100

# Create a cgroup manually (v2)
mkdir /sys/fs/cgroup/my-group
echo "512M" > /sys/fs/cgroup/my-group/memory.max
echo <pid> > /sys/fs/cgroup/my-group/cgroup.procs