What Actually Happens When You Run a Program

Source: Dev.to

From Keystroke to Execution

When you type a command and press Enter, a program starts in milliseconds. The operating system orchestrates a chain of steps involving the shell, the kernel, the CPU scheduler, and memory management.

Shell → Kernel Interaction

1. Shell parses the command – the shell runs as a normal user process.
2. Shell requests the kernel to start a new program.

The kernel then:

• Allocates a process structure in memory
• Assigns a unique PID (process identifier)
• Loads the executable file from disk
• Maps code and data into virtual memory
• Places the process in a ready queue

The executable contains machine instructions and metadata. After the loader maps these sections, the process exists but must wait for CPU time.

Privilege Modes

• User mode – runs application code; hardware access is restricted.
• Kernel mode – holds full privileges, controlling hardware, memory, and devices.

When a program needs system resources, it issues a system call, which triggers a controlled switch to kernel mode. The kernel validates the request, performs the operation, and returns control to user mode, protecting the system from faulty programs.

Unix‑Style Program Launch (fork‑exec)

1. fork – creates a child process that receives a copy of the parent’s memory space and file descriptors. Both parent and child continue execution from the same point.
2. exec – the child replaces its memory with a new program image. The PID stays the same; only the code and data change.

The shell follows this pattern:

• The shell calls fork
• The child process calls exec with your command
• The parent shell waits or continues based on job rules

This model keeps process management simple and predictable.

Process Lifecycle

Scheduling

The scheduler selects which ready process runs next using algorithms such as FCFS, SJF, SRTF, Round‑Robin, etc. Most schedulers employ priorities and time slices—limits on how long a process runs before a context switch.

During a context switch the kernel:

• Saves CPU registers of the current process
• Loads registers of the next process
• Updates scheduling data

Rapid switching creates the illusion of parallel execution.

Process Control Block (PCB)

The kernel tracks each process with a PCB, which stores:

• Scheduling information
• Memory mappings
• Open file tables
• Accounting data

Virtual Memory

Virtual memory gives each process an isolated address space. Page tables map virtual addresses to physical memory, and the kernel enforces protection rules through these mappings.

File Descriptors

File descriptors link processes to resources. Each descriptor points to a kernel table entry that refers to files, devices, or pipes. The kernel manages permissions and reference counts.

Observing Processes

You can see these concepts in action with common commands.

ps aux

Shows a snapshot of active processes, each line representing a kernel‑tracked process with CPU and memory usage.

top

Provides a real‑time, continuously updating view. You can watch processes change states as the scheduler rotates tasks.

Try it:

1. Start a long‑running program in one terminal.
2. Observe it with ps or top in another terminal.
3. Stop the program and watch its entry disappear.

Every program you run triggers process creation, scheduling, and resource tracking in a tight loop. These steps happen constantly in the background and shape how your system behaves.

The next time you press Enter in a terminal, remember you’re initiating a full process lifecycle under your control.