incident / labOBSERVE CLOSELY. REASON CLEARLY.
INVESTIGATIONS/CASE 06LOCAL LINUX VM
06

Namespace identity

Why Is PID 1 Not PID 1?

Container and host process identifiers appear to contradict each other.

sys_enter_execve + /proc enrichmentUnderstand the evidence boundary ↗

Saved on this device · Assistance is recorded · Reviews stay separate from completion.

Readiness · one concrete prerequisite

A process is PID 1 inside its namespace and PID 842 on the host. Which observer --pid value targets it?

Select the supported statement
Optional tutor critique

The tutor sends the previewed material to Groq’s Qwen 3.8 27B model through this application. It is fallible and does not assign mastery. Groq may retain or process data under its applicable policies. Authored hints remain available if it is unconfigured. Your claim, mechanism, unknown, next experiment and hint count are sent only after consent and clicking Request.

Exact learner request preview (the server also includes this lab’s authored curriculum and rubric):

{
  "consent": true,
  "labId": "06",
  "claim": "",
  "reasoning": "",
  "unknown": "",
  "nextStep": "",
  "evidence": [],
  "hintsUsed": 0
}
Attempt and revision history (0)