The problem was not one worker. It was the absence of one process-ownership model.

Several independent execution mechanisms were active in the same environment. Some workers had their own work cycle, cron launched other jobs, a watchdog reacted to service state, a supervisor kept processes alive and an orchestrator started additional system components.

Each mechanism was reasonable on its own. Looking at the whole environment showed that the same function could be started more than once. If an earlier instance had not finished before the next trigger, another instance appeared; child processes accelerated PID growth further.

CRONA new process on schedulethe scheduler did not know whether the previous instance was still working
WATCHDOGRestart from a signala missing signal could be mistaken for a missing process
WORKEROwn cycle and child processeslong-running work could create additional helper processes

A PID alone is not enough

A process number confirms an entry in the process table, but it does not describe the role, health or lifecycle ownership. Before restarting anything, supervision should verify process identity, health, the child-process tree and the mechanism authorised to manage that role.

Architecture decision: 1 role = 1 process owner = 1 start mechanism

Before adding a worker, check whether the function already exists. If it does, update the current mechanism or replace it. Do not start a new version next to an old one merely because the previous instance is assumed to have stopped.

Core lessonThe most dangerous worker is not necessarily a badly written one. It can be a correct worker whose lifecycle is simultaneously controlled by several mechanisms that do not know about each other.

Use a queue or explicit parallelism

If two tasks should not run at the same time, put them behind one queue. If parallel execution is required, make it part of the architecture: each domain gets an explicit worker, responsibility and process budget.

01ORCHESTRATORcontrol point and ownership
02MLP / SEMANTICseparate compute domains
03BEHAVIORALits own work queue
04HEALTHsupervision without multiplication

For frequent cycles, prefer a worker to repeated cron starts

For frequently repeated work, one long-running worker can be a better model: run → wait → run → healthcheck. Cron remains appropriate for genuinely periodic jobs such as backups, housekeeping, daily reports or audits.

A watchdog should diagnose before restarting

A missing signal does not necessarily mean that the process is gone. Before a restart, check the main process, child processes, health state, service owner and whether another mechanism is supervising the same role.

01EXISTS?is the process really absent
02CHILDREN?did child processes remain
03HEALTH?is the process stalled
04OWNER → RESTARTrestart only after excluding duplication

Result: fewer processes were a consequence; predictability was the goal

After reorganising workers, start mechanisms and supervision, the active process count fell from about 100 to 48. More importantly, the conditions that had allowed the environment to escalate into hundreds of PIDs were constrained. The reduction is not a universal benchmark; it describes this specific environment and incident.

Shared-hosting blast radius

When several projects share one resource budget, process or memory growth in one application can affect other services. Monitoring therefore needs to cover the account as a whole: user PIDs, RAM, process trees, active schedules and supervision mechanisms.

Six design rules

  1. Check whether the role already exists before adding another implementation.
  2. One worker should have one lifecycle owner.
  3. Design parallel execution explicitly.
  4. Cron is not a supervisor.
  5. A watchdog diagnoses before restarting.
  6. Monitor the environment, not only one service.

FAQ

Is a PID file enough to prevent worker duplication?

No. A PID only confirms that a process number exists. Supervision should also verify the process role, lifecycle owner, health state and whether another instance of the same role is already active.

Is cron a good way to keep a long-running worker alive?

Usually not. A long-running worker should have one start and supervision mechanism. Cron is better reserved for genuinely periodic jobs.

Why can a watchdog increase the process count?

If it treats a missing signal as a missing process without checking the process tree, it can start another instance while the previous process or its children are still alive.

Must every system use only one worker instance?

No. Parallel execution is valid when it is explicit: the instance count, responsibilities, queues and resource budget are controlled by design.