Vol. I · No. 46The command line sectionSat, 10 Oct 2026
Windows into the kernel

/proc

processes and kernel state, as files

/proc is a view of the running system, not a place on a disk. The kernel creates its contents at the moment you read them. Every running process appears as a directory named by its number, and tools such as ps and top work by reading those files.

Nothing here is stored. It is the kernel, answering.

Holds
Live kernel data
Processes, memory, CPU, mounts
On disk
No
Generated in memory when read
Who writes
The kernel
A few files accept settings from root
Size
Zero
Files report 0 bytes yet have contents

Why it exists

Every directory at the top of the tree is there for a reason. This is the problem /proc solves.

Everything is a file

Rather than a special tool for each question, the kernel answers through files. Anything that can read a file can ask how much memory is free.

One directory per process

Each process gets /proc/ followed by its process id. Inside are its command line, its open files, its memory map and its environment.

Settings that take effect at once

Files under /proc/sys are kernel settings. Writing to one changes the running kernel immediately — it is how IP forwarding is switched on.

What you find inside

Not everything, but the entries worth recognising. Each is marked as a directory, a file, a link or a device.

/proc
  • cpuinfofileThe processor: model, cores, features.
  • meminfofileMemory in use and free.
  • 1directoryThe first process started — systemd, on most systems.
  • selflinkA link to the directory of whichever process is reading it.
  • netdirectoryNetwork state, including the ARP table and interface counters.
  • sysdirectoryKernel settings that can be read and changed.

At the terminal

Four commands that show what this directory is doing on a real machine.

cat /proc/cpuinfo

Show the processor’s details.

cat /proc/meminfo | head -3

Show total, free and available memory.

cat /proc/sys/net/ipv4/ip_forward

Check whether this host forwards packets: 1 is yes, 0 is no.

ls -l /proc/$$/fd

List the files your own shell has open. $$ is the shell’s process id.

Handle with care

What goes wrong here, and what someone securing or attacking the machine looks at.

Changes here are lost at reboot

A value written under /proc/sys lasts only until the machine restarts. To keep it, put it in /etc/sysctl.conf or a file in /etc/sysctl.d.

A process reveals a lot

A process’s command line is readable by every user, so a password given as an argument is visible to all. Its environment is readable by its owner and root.

Read alongside

/sysHardware and drivers as the kernel sees them, presented as files./devDevices presented as files: disks, terminals, and the null device./runState since the last boot: process ids, sockets and lock files.