Why SIGKILL Cannot Kill Zombie Processes and What That Means for Containers

When a Linux process exits, the kernel retains a minimal record — including the PID and exit status — until the parent process calls wait(); this remnant is known as a zombie process. Because there is nothing left to kill, SIGKILL has no effect on zombies and the kill() call simply returns success. If a parent process dies before its children, those orphaned processes are adopted by a designated subreaper or by PID 1 of the same PID namespace, with adoption stopping at namespace boundaries so container processes are never reparented to the host. In containerised environments, the application itself typically runs as PID 1, meaning it becomes responsible for reaping all child processes; apps that do not call wait() on indirectly spawned processes allow zombies to accumulate until the PID cgroup limit is reached and no new processes can be forked. Common fixes include using a dedicated init process such as tini, enabling Docker's --init flag, or configuring Kubernetes' shareProcessNamespace so the pause container handles reaping.