{
  "generated": "2026-10-20",
  "count": 8,
  "processes": [
    {
      "slug": "claude",
      "name": "claude",
      "kind": "ai-agent",
      "binary": "claude — a native binary since 2.x (npm puts it at node_modules/@anthropic-ai/claude-code/bin/claude.exe, an ELF file despite the name); older releases ran as a node process",
      "safe_to_kill": "yes",
      "summary": "Claude Code command-line agent: reads, edits and runs commands in a project directory with the permissions of the user who started it, filtered by the session's permission mode.",
      "listens": [],
      "url": "/process/claude/"
    },
    {
      "slug": "codex",
      "name": "codex",
      "kind": "ai-agent",
      "binary": "codex — bin/codex.js is a small Node launcher that execs the native, statically linked binary at node_modules/@openai/codex-linux-x64/vendor/x86_64-unknown-linux-musl/bin/codex, so the running process is codex, not node",
      "safe_to_kill": "yes",
      "summary": "OpenAI's Codex CLI agent: a native binary that edits files and runs commands in your repository under two settings, the sandbox mode that the operating system enforces and the approval policy that decides when it asks you.",
      "listens": [],
      "url": "/process/codex/"
    },
    {
      "slug": "gemini",
      "name": "gemini",
      "kind": "ai-agent",
      "binary": "node — the gemini command is a Node.js script (node_modules/@google/gemini-cli/bundle/gemini.js), so ps shows a node process",
      "safe_to_kill": "yes",
      "summary": "Google's Gemini CLI agent: a Node.js process that reads, edits and runs commands in the current project with your user's permissions, approving tools by its approval mode.",
      "listens": [],
      "url": "/process/gemini/"
    },
    {
      "slug": "kswapd0",
      "name": "kswapd0",
      "kind": "kernel-thread",
      "binary": "kernel thread (PPID 2, no executable)",
      "safe_to_kill": "no",
      "summary": "Kernel thread that reclaims memory in the background when a zone's free pages fall below the low watermark; one per NUMA node, kswapd0 is node 0.",
      "listens": [],
      "url": "/process/kswapd0/"
    },
    {
      "slug": "ollama",
      "name": "ollama",
      "kind": "ai-agent",
      "binary": "ollama — one static binary; ollama serve is the server, every other subcommand is a client talking to it over HTTP",
      "safe_to_kill": "restart-instead",
      "summary": "Local LLM server: ollama serve loads models on demand and answers an unauthenticated HTTP API on 127.0.0.1:11434 by default; whoever can reach that port can run models, and read or feed them anything.",
      "listens": [
        "11434/tcp"
      ],
      "url": "/process/ollama/"
    },
    {
      "slug": "openclaw-gateway",
      "name": "openclaw-gateway",
      "kind": "ai-agent",
      "binary": "node — the gateway sets its process title to openclaw-gateway (ps shows the comm field truncated to openclaw-gatewa); its helper workers show as node MainThread running dist/process/spawn-broker/worker.js and dist/infra/sqlite-readonly-location.worker.js",
      "safe_to_kill": "restart-instead",
      "summary": "The OpenClaw Gateway: a Node.js daemon that serves the Control UI, the WebSocket and HTTP API (/v1/*, /tools/invoke, /api/channels/*) on one port, 18789 by default, and runs the agent's tools, terminal and browser control behind it.",
      "listens": [
        "18789/tcp"
      ],
      "url": "/process/openclaw-gateway/"
    },
    {
      "slug": "systemd-journald",
      "name": "systemd-journald",
      "kind": "system-daemon",
      "binary": "/lib/systemd/systemd-journald (Ubuntu 22.04; /usr/lib/systemd/systemd-journald on merged-/usr systems), started by PID 1",
      "safe_to_kill": "restart-instead",
      "summary": "The systemd journal daemon: collects kernel, service and syslog messages into binary journal files under /run/log/journal (volatile) or /var/log/journal (persistent), rate-limits chatty services and enforces disk caps.",
      "listens": [],
      "url": "/process/systemd-journald/"
    },
    {
      "slug": "unattended-upgrades",
      "name": "unattended-upgrades",
      "kind": "system-daemon",
      "binary": "/usr/bin/unattended-upgrade, a Python 3 script run daily by apt-daily-upgrade.service through /usr/lib/apt/apt.systemd.daily; ps truncates the name to unattended-upgr. A second, long-lived python3 process, unattended-upgrade-shutdown --wait-for-signal, is the unattended-upgrades.service that waits to finish a run cleanly at shutdown",
      "safe_to_kill": "no",
      "summary": "Ubuntu's automatic security updates: a daily systemd timer refreshes the package lists and runs unattended-upgrade, which installs packages from the allowed origins (the security pockets by default) and can reboot the machine if you let it.",
      "listens": [],
      "url": "/process/unattended-upgrades/"
    }
  ]
}