Why Linux Daemons End with 'd': From Maxwell's Demon to Unix

Why Linux Daemons End with 'd'

When you list processes on Linux, you see names like sshd, httpd, mysqld, dockerd, crond, and systemd — all ending with the letter d. This d stands for daemon, a term for background processes that run without direct user interaction.

Origin at MIT's Project MAC (1963)

The term originated at MIT's Project MAC in 1963, where Fernando Corbató (later a Turing Award winner) led development of the CTSS time-sharing system on an IBM 7094. Before CTSS, computers ran batch jobs: users submitted punch cards and left. CTSS allowed dozens of researchers to share the mainframe via teletypes. Disk space was tiny, so modified files had to be backed up to magnetic tape regularly. Manual backups were forgettable, so Corbató's team wrote programs that ran unattended in the background, copying files to tape during idle time.

We fancifully began to use the word daemon to describe background processes that worked tirelessly to perform system chores.

— Fernando Corbató

The team borrowed the word from physics: James Clerk Maxwell's 1867 thought experiment "Maxwell's Demon", an invisible being that sorts fast and slow molecules between two chambers. The background programs resembled this tireless sorter.

Greek Etymology and Chinese Translation

The spelling daemon (with an a) is the ancient Greek form. In Greek mythology, a daemon is a spirit between gods and humans, unseen, helping people — not the evil "demon" of later Western lore. Early Chinese Unix translators chose "守护进程" (guardian process) to reflect this helpful connotation.

Adoption in Unix at Bell Labs

Ken Thompson and Dennis Ritchie, both veterans of the MIT-led Multics project, brought the term to Bell Labs when they created Unix in 1969. Early teletypes and character terminals had narrow displays; the ps command showed only a few letters per process name. To distinguish background daemons from user commands, Unix adopted a convention: append a trailing d to the executable name. Thus the remote login client is ssh, its server sshd; the cron scheduler becomes crond; the internet superserver inetd; and later dockerd and systemd.

BSD Mascot and the fork() Pun

In 1984, John Lasseter (later co-founder of Pixar) drew the BSD daemon mascot: a red horned creature wearing sneakers and holding a trident. The trident is a fork — a pun on the Unix fork() system call. Creating a daemon traditionally starts with fork() to duplicate the process, then the parent exits, and the child calls setsid() to detach from the terminal and run in the background.

Orphan Processes and Adoption by init

Because the parent exits immediately, the daemon becomes an orphan process. It is then adopted by the process with PID 1 — historically init, now usually systemd — and runs until shutdown.

The Backronym and a Final Note

In the 1980s, some non-technical buyers saw daemon in documentation and suspected occult references. Unix System Administration Handbook author Evi Nemeth clarified it was a misunderstanding. Later, a backronym was invented: Disk And Execution MONitor — but this was a retroactive fabrication. The trailing d on sshd and dockerd traces back not to a monitoring manual, but to an 1867 physics textbook.