Skip to content

🧟 Zombie Process Guide (BlackCairn)

A practical guide to identifying, understanding, and cleaning up zombie processes on your Linux systems and Docker containers.

🧠 What is a Zombie Process?

A zombie process is a process that has:

  • Finished execution
  • But still exists in the process table
  • Because its parent has not collected its exit status

Think of it as a process that has died… but its paperwork hasn’t been filed.

🔍 How to Identify Zombie Processes

Basic check

ps aux | grep Z

Cleaner output

ps -eo pid,ppid,state,cmd | awk '$3 ~ /Z/'

Example output

8763  2445  Z  [wget] <defunct>

🧾 Understanding the Output

Column Meaning
PID Zombie process ID
PPID Parent process ID
Z Zombie state
CMD Original command

⚠️ The parent (PPID) is the key. Zombies cannot be killed directly.

🕵️ Investigate the Parent Process

ps -fp <PPID>

Example:

ps -fp 2445

🐳 If Using Docker (BlackCairn Reality)

Find the container:

docker inspect --format '{{.Name}}' <container-id>

Then inspect it:

docker exec -it <container-name> ps -ef

🧹 How to Clean Up Zombies

✅ Best Option: Restart the Parent

Docker

docker restart <container-name>

System service

sudo systemctl restart <service>

⚠️ Alternative: Signal the Parent

kill -SIGCHLD <PPID>

May or may not work.

🚫 Do NOT do this

kill -9 <zombie-pid>

Zombies are already dead. This does nothing.

🧮 Count Zombie Processes

ps -eo state | grep -c Z

⚠️ When to Worry

Scenario Meaning
1–2 zombies Normal, harmless
Growing count Parent process issue
Hundreds Broken service or container

🛠️ Preventing Zombies (Docker Best Practice)

Add an init process to containers:

services:
  your-service:
    image: your-image
    init: true

This ensures child processes are properly reaped.

🧪 Common Causes

  • Healthchecks using wget or curl
  • Poorly written shell scripts
  • Node/Next.js apps spawning child processes
  • Containers without an init process

🔎 BlackCairn Example (Real Case)

  • Zombie: [wget] <defunct>
  • Parent: next-server
  • Container: blackcairn-portal
  • Cause: Docker healthcheck using wget
  • Fix: Added init: true to Compose

🧭 Quick Troubleshooting Flow

  1. Find zombie
  2. Identify PPID
  3. Check parent process
  4. Determine if Docker or system service
  5. Restart parent
  6. Add init: true if container-based
  7. Recheck

🧹 Maintenance Tip

Run occasionally:

ps -eo pid,ppid,state,cmd | awk '$3 ~ /Z/'

If empty → all clear

📌 Final Thoughts

Zombie processes are not dangerous on their own.

They are symptoms, not problems.

Fix the parent, and the undead disappear.

⚔️ Motto

"You don’t kill the zombie… you fix what refused to bury it."