What is the difference between a zombie process and an orphan process?
A zombie has finished running but still has an entry in the process table because its parent has not collected its exit status. An orphan is still running but its parent has died; init adopts it.
Explain it simply
Imagine a cricket player who is out but whose entry has not yet been recorded by the scorer: he is gone, but his line is still on the sheet. That is a zombie. An orphan is a child whose parent left the stadium; someone else (the init process) takes charge of the child.
Zombie: the process has terminated and its memory is freed, but a small process table entry stays so the parent can read the exit code with wait(). Once the parent calls wait(), the entry vanishes. Zombies use no CPU, but too many can fill the process table.
Orphan: the parent exits first. The kernel re-parents the child to PID 1 (init or systemd), which calls wait() on it when it ends, so orphans never become permanent zombies.
Example
pid_t p = fork();
if (p == 0) {
exit(0); // child ends immediately
} else {
sleep(60); // parent does not call wait() for 60 seconds
} // during this minute the child is a zombieRunning ps aux in that minute shows the child with state Z (marked <defunct>). You cannot remove a zombie with kill, because it is already dead. You fix it by making the parent call wait(), or by killing the parent so init cleans up.
What to say in the interview
"A zombie is a terminated process whose exit status has not been read by its parent. An orphan is a running process whose parent has exited, and init adopts it. Zombies waste a process table slot; orphans are harmless."
Common mistakes
- Saying a zombie consumes memory and CPU. It only holds a process table entry.
- Trying to kill a zombie. It is already dead, so deal with the parent.