Read Task Children from /proc/tid/children

/proc/tid/children lists a task's immediate child IDs, but read it at the wrong moment and a live child can silently drop out of the count. It was built mainly for checkpoint and restore tools such as CRIU, not as a general process-tree API, and the manual is upfront about the race. Allow about ten minutes. You need a shell and a mounted procfs; the examples are read-only and normally need no elevated privileges.

1. Check the kernel interface before relying on it

The installed system here runs Linux 6.8.0-139-generic, with CONFIG_PROC_CHILDREN=y. The local manpages package is version 6.7-2, and its proc_tid_children(5) page describes the interface as available since Linux 3.5. Kernel support and the installed manual are separate facts, so check both when documenting a deployment.

$ uname -r
6.8.0-139-generic
$ test -r /proc/self/status && echo procfs-readable
procfs-readable
$ test -r /boot/config-$(uname -r) && grep '^CONFIG_PROC_CHILDREN=' /boot/config-$(uname -r)
CONFIG_PROC_CHILDREN=y

The configuration file may not be installed, and a container may expose a procfs view that differs from the host. A missing /boot/config-$(uname -r) is not proof that the feature is absent. The decisive test is whether the target path exists and can be read.

2. Understand which task you are inspecting

Checkpoint: choose a numeric PID or TID that belongs to a process you are allowed to inspect. Do not obtain a number from an untrusted string and paste it into a privileged script without validating it.

3. Create a harmless child and read the list

This example starts sleep in the background, reads the current shell's child list while it is still alive, then waits for it. It changes no persistent configuration and needs no sudo:

$ sleep 30 &
[1] 462712
$ child=$!
$ printf 'shell PID: %s\n' "$$"
shell PID: 462710
$ cat "/proc/$$/task/$$/children"
462712
$ wait "$child"
[1]+  Done                    sleep 30

The PIDs in this output are examples and will differ on your machine. The useful result is the number printed by /proc/$$/task/$$/children, which matches the background job's PID. The file is normally newline-terminated, but parse whitespace rather than depending on a particular line ending.

If the list is empty, the task has no children at the instant of the read. If the path is missing, confirm the path and that procfs is mounted before treating it as a kernel configuration failure:

$ test -r "/proc/$$/task/$$/children" && echo readable || echo unavailable
readable
$ findmnt /proc
TARGET SOURCE FSTYPE OPTIONS
/proc  proc   proc   rw,nosuid,nodev,noexec,relatime

4. Verify each returned task before using it

A child can exit between the read and your next command. Treat every returned TID as a short-lived observation, not a handle that remains valid. Check that it still exists and identify its command before doing anything else:

children=$(cat "/proc/$PID/task/$TID/children") || exit 1
for child_tid in $children; do
    if test -r "/proc/$child_tid/status"; then
        printf 'TID %s: ' "$child_tid"
        sed -n '1p' "/proc/$child_tid/status"
    else
        printf 'TID %s exited before verification\n' "$child_tid" >&2
    fi
done

Replace PID and TID with numeric values from your own inspection. Reading /proc/TID/status is another read-only operation. Do not turn this check into an automatic kill, attach or restart action without separately handling permissions, PID reuse and the possibility that the task has already changed state.

5. Account for the race that the manual warns about

The file is not a synchronised snapshot of a live process tree. If children exit while the kernel is producing the result, an exiting child can cause another, still-running child to be omitted. That makes the interface less reliable than many ordinary PID-based approaches when the inspected task and its children are active.

For an inventory or monitoring display, read the file as an advisory snapshot and expect it to change immediately. For checkpoint or restore work, stop or freeze the inspected task and all relevant children first, using the checkpoint system's own lifecycle controls.

Warning: freezing is a security- and service-sensitive operation. Do not improvise it with signals on a production workload, because it can pause application work and affect availability. Resume the workload using the same tool that performed the freeze.

Recovery: there is no undo step for the reads in this guide. The background sleep is reaped by wait; if you interrupt the test instead, use kill "$child" only for that test process and then check that it has exited.

6. Keep version and configuration boundaries clear

The file was introduced in Linux 3.5. Up to Linux 4.2, its presence was controlled by CONFIG_CHECKPOINT_RESTORE. Since Linux 4.2, the relevant option is CONFIG_PROC_CHILDREN. A current kernel can therefore omit the interface when that option is disabled, even though procfs itself is mounted.

Do not infer that a successful read gives you a complete process tree, stable identifiers or permission to inspect every task. Access is also affected by procfs visibility and the credentials or PID namespace of the reader. If your program needs a durable relationship between a parent and child, use an interface designed for that contract and treat this file as a specialised, best-effort observation.

Done means