Crisp answer: /proc is a virtual filesystem — nothing on disk, all
generated by the kernel on read. It exposes the kernel's internal state as
files: process information, memory maps, hardware statistics, kernel settings.
It's not real files:
ls -la /proc/1/status
# -r--r--r-- 1 root root 0 ...
# Size is 0 — the kernel generates content on demand when you read the file
cat /proc/1/status
# Actual content appears
Per-process directories — /proc/<pid>/:
Each running process has a directory at /proc/<PID>/ containing:
| File | Contains |
|---|---|
status |
Human-readable process state: name, PID, PPID, UID, GID, VM sizes, thread count, capabilities |
cmdline |
The command line (null-byte delimited) |
environ |
Environment variables (null-byte delimited) |
maps |
Virtual memory map: address ranges, permissions, mapped files |
smaps |
Detailed memory breakdown per mapping (RSS, PSS, swap) |
smaps_rollup |
Summarised memory stats (quicker than smaps) |
fd/ |
Directory of symlinks to every open file descriptor |
fdinfo/ |
Flags and seek position of each FD |
wchan |
Kernel function the process is currently waiting on |
stat |
Process stats in single line (used by ps/top) |
statm |
Memory stats in pages |
net/tcp |
Process's TCP connections |
cgroup |
Which cgroups this process belongs to |
oom_score |
OOM killer score — higher = more likely to be killed |
oom_adj |
Adjust OOM score (-17 = never kill, 15 = kill first) |
task/ |
Directory with one entry per thread |
exe |
Symlink to the executable binary |
root |
Symlink to the process's root filesystem (chroot) |
ns/ |
Namespace handles for this process |
Useful /proc troubleshooting recipes:
# What command is PID 1234 running?
cat /proc/1234/cmdline | tr '\0' ' '
# Or:
strings /proc/1234/cmdline
# What environment variables does it have?
cat /proc/1234/environ | tr '\0' '\n'
# What files does it have open?
ls -la /proc/1234/fd
# lrwx 1 ... 0 -> /dev/pts/0 (stdin: terminal)
# lrwx 1 ... 1 -> /dev/pts/0 (stdout: terminal)
# lrwx 1 ... 2 -> /dev/pts/0 (stderr: terminal)
# lr-x 1 ... 3 -> /var/log/app.log
# lrwx 1 ... 4 -> socket:[12345] (a network socket)
# Is it leaking file descriptors?
ls /proc/1234/fd | wc -l
# What kernel function is it blocked on?
cat /proc/1234/wchan
# futex ← waiting on a lock
# poll_schedule_timeout ← waiting for I/O (normal for event loop)
# do_sys_openat2 ← stuck trying to open a file
# Memory breakdown:
cat /proc/1234/smaps_rollup
# Rss: 256 kB ← resident set (in physical RAM right now)
# Pss: 128 kB ← proportional share (shared libs counted fractionally)
# Swap: 0 kB
# OOM kill risk:
cat /proc/1234/oom_score # 0-1000, higher = more likely to die in OOM
System-wide /proc files:
| Path | Contains |
|---|---|
/proc/meminfo |
Total, free, available, cached, swap memory |
/proc/cpuinfo |
CPU model, cores, features |
/proc/loadavg |
Load averages and running/total processes |
/proc/uptime |
System uptime in seconds |
/proc/version |
Kernel version string |
/proc/mounts |
Currently mounted filesystems |
/proc/net/tcp |
All TCP connections system-wide |
/proc/net/tcp6 |
IPv6 TCP connections |
/proc/sys/ |
Kernel tunable parameters (via sysctl) |
/proc/sys/net/ipv4/ip_forward |
Is IP forwarding enabled? (1 = yes, for routing/containers) |
/proc/sys/vm/swappiness |
How aggressively to swap (0-100, default 60) |
/proc/sys/fs/file-max |
System-wide FD limit |
sysctl — reading and writing /proc/sys:
sysctl -a # All kernel parameters
sysctl net.ipv4.ip_forward # Read one
sysctl -w net.ipv4.ip_forward=1 # Set temporarily
echo 1 > /proc/sys/net/ipv4/ip_forward # Same thing, raw write
# To persist across reboots:
echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf
sysctl -p # Apply from config
IP forwarding must be enabled for containers and Kubernetes to work — the host must forward packets between pod networks and external networks.
What to say in the interview:
"/proc is a virtual filesystem — nothing on disk, all generated live by the kernel. It's my first stop for debugging a process: the fd/ directory shows every open file and socket, cmdline shows what command it's actually running, wchan shows what kernel function it's blocked on, smaps_rollup gives memory stats. For system-wide issues, /proc/meminfo and /proc/net/tcp. The /proc/sys subtree is where kernel parameters live — sysctl reads and writes there. IP forwarding being off in /proc/sys/net/ipv4/ip_forward is a classic reason containers can't route traffic."