How Linux Process Creation Powers Containers: From fork to Namespaces

Process Hierarchy on Linux and macOS

Running ps -ef shows that PID 1 is the init process: systemd on Linux and launchd on macOS. All other processes are descendants of PID 1, whose parent is the invisible PID 0.

Creating Processes in Linux

Linux provides four primary ways to create a new execution context: fork – creates a copy of the calling process. vfork – similar to fork but suspends the parent until the child calls exec or _exit. clone – a flexible system call that can share selected resources with the parent.

glibc wrapper pthread_create – creates a thread by invoking clone with thread‑specific flags.

All of these eventually invoke the kernel function do_fork, which implements the low‑level creation logic.

Key Parameter: clone_flags

The clone_flags argument determines which resources are shared between the parent and the new task. For example, pthread_create passes flags that cause the new task to share the same PID, memory space, and file descriptors, turning it into a thread rather than an independent process.

Minimal fork Example

#include <unistd.h>
#include <sys/wait.h>
int main() {
    pid_t pid = fork();
    if (pid == 0) {
        // Child process – replace image with a shell
        execlp("/bin/sh", "sh", (char *)NULL);
    } else if (pid > 0) {
        // Parent process – wait for child termination
        wait(NULL);
    } else {
        // fork failed
        return 1;
    }
    return 0;
}

After fork, the child receives pid == 0. Combining fork with exec replaces the child’s program image, effectively launching a new shell.

Namespace Validation in do_fork

Inspecting the kernel source of do_fork reveals a validation step that rejects incompatible flag combinations: CLONE_NEWUSER or CLONE_NEWPID cannot be used together with CLONE_THREAD or CLONE_PARENT. CLONE_NEWPID creates a new PID namespace, isolating the child’s process IDs from the host. CLONE_THREAD forces the new task to share the same PID as its creator, which contradicts the isolation intent of a new PID namespace. The kernel therefore returns an error when both flags are set.

Implications for Container Technology

Containers rely on Linux namespaces to achieve isolation. When a container is started, the runtime typically invokes clone with CLONE_NEWPID (and other namespace flags such as CLONE_NEWUTS, CLONE_NEWNET, etc.) to place the container’s processes in separate namespaces. Threads inside a container are created with pthread_create, which uses CLONE_THREAD to share the PID within the container’s PID namespace, but never mixes CLONE_THREAD with CLONE_NEWPID at the same time. Understanding the relationship between fork / clone , clone_flags , and namespace checks provides a solid foundation for grasping how containers are instantiated and why certain flag combinations are prohibited.