The Lifecycle Part 2: Transformation (`exec`)

The Brain Transplant

If fork() only creates clones, how do we ever run different programs? We don't want thousands of copies of the shell.

This is where the exec() family of system calls comes in. Immediately after forking, the child process typically calls exec() to replace itself with an entirely different program.

When a process calls exec():

1. The kernel discards the process's current code, stack, heap, and data segments.
2. It loads the new program's binary from disk into the process's address space.
3. Execution begins at the new program's entry point (its main() function).

The process's PID does not change. The container (the process identity, open file descriptors, environment variables) persists — only the contents are replaced.

The fork-exec pattern is the universal mechanism behind every command you run in a shell:

1. You type ls -la in bash.
2. Bash calls fork() — a child bash process is created.
3. The child calls exec("/bin/ls", ["ls", "-la"]) — the child transforms into ls.
4. ls runs, prints output, and exits.
5. Bash (the parent) calls wait() to collect the exit status and prints the next prompt.

The Analogy:

• fork() is like building a brand-new, identical factory next to the original.
• exec() is like gutting that new factory — removing all the old machinery and workers — and installing completely new equipment to manufacture a different product, all within the same building shell (same PID, same file descriptors).