Every program you have ever used depends on software you almost never think about. The operating system is the invisible manager underneath every app, every file, every click, and every connection. When you open a browser, play a game, or save a document, the operating system is doing the quiet, essential work of making it all possible — managing the CPU, controlling memory, organizing storage, handling input, and enforcing the rules that keep everything running safely.

This chapter explains what an operating system is, why it exists, and what it does. Students will learn how operating systems manage programs and processes, control memory, organize file systems, enforce permissions, communicate with hardware devices through drivers, and provide interfaces for both users and programs. By the end of this chapter, students should understand the operating system not as a brand name or a logo, but as a fundamental software layer that mediates between hardware and everything that runs on top of it.

This understanding connects to everything else in computing. Programmers write code that depends on the OS. Networks are managed by OS services. Databases run as OS processes. Security policies are enforced by OS permissions. The web servers that deliver web pages run on operating systems. Understanding the OS means understanding the foundation on which all modern computing is built.

When you press the power button on a computer, something has to start first. Before any app opens, before any file loads, before the screen shows anything useful, a large and complex piece of software has to wake up, check the hardware, prepare the environment, and take control. That software is the operating system.

An operating system, often called an OS, is the software that manages a computer's hardware and provides a foundation for all other software to run on. It sits between the physical machine and everything a user or program wants to do.

Think of the operating system as a building manager. The building is the hardware: the CPU, the memory, the storage, the keyboard, the screen, the network card. The tenants are the programs: your browser, your word processor, your game, your music player. The building manager does not live in any one apartment. Instead, the manager controls access to shared resources — the elevator, the parking, the electrical system, the security doors — so that every tenant can work without crashing into every other tenant.

Without an operating system, each program would have to control the hardware directly. Every programmer would have to write code to talk to every possible keyboard, screen, hard drive, and network adapter ever made. Programs would conflict with each other over who controls the CPU. One program crashing would bring down the entire machine. The operating system exists to prevent all of this.

Students encounter operating systems every day. Windows runs on most personal computers in offices and homes. macOS runs on Apple Mac computers. Linux runs on servers, supercomputers, scientific instruments, routers, Android phones, and many embedded systems. Android and iOS are mobile operating systems built on Linux and Unix foundations respectively. Despite their different appearances and names, all of these share the same fundamental responsibilities. A financial server running Linux and a smartphone running Android and a laptop running Windows are all doing the same categories of work under the surface.

When you double-click an icon to open an app, what actually happens? The operating system reads the program's instructions from storage, copies them into memory, creates a structure called a process, and begins executing the program's instructions on the CPU. A process is a running instance of a program. It is not the program file itself — it is the active, living execution of that program.

A program is a set of stored instructions — a file on disk. A process is what happens when those instructions are loaded into memory and executed. You can have one program file and many processes. If you open three browser windows, you may have three separate browser processes — or one process with many threads, depending on how the browser is built. Each process has its own memory space, its own state, and its own position in the execution stream.

Every process carries several pieces of information that the operating system tracks: the instructions being executed (copied from the program file); the current position in those instructions, called the program counter; the values of all variables currently in use; open files, network connections, and other resources the process is using; a unique process ID (PID); the process's owner (which user started it); and the process's current status.

Every process goes through this lifecycle. It is created when the program launches. It becomes ready when it is prepared to run but waiting for the CPU. It is running when actively executing on the CPU. It enters waiting when paused for something external — a file to load, a network response, a user click. While waiting, it does not use the CPU at all. Finally, it is terminated when finished, and the OS releases all memory and resources it held.

Most processes spend a surprising amount of time in the waiting state, not the running state. This is why multitasking is possible — the CPU is rarely fully occupied with a single task.

Modern computers appear to run many programs at the same time. Your browser, music player, email client, and file manager all seem to work simultaneously. But most consumer computers have only a handful of CPU cores. A four-core CPU cannot literally run fifty programs in parallel. The answer is multitasking: the OS rapidly switches between processes, giving each one a tiny slice of CPU time called a time slice or quantum. Each slice is so short — often just a few milliseconds — that humans cannot perceive the switching. The result feels like simultaneous execution.

The part of the OS responsible for deciding which process runs next is called the scheduler. A simple scheduler might rotate through all ready processes in order — called round-robin scheduling. More sophisticated schedulers assign priority levels. High-priority processes (such as the audio system) get CPU time before low-priority ones (such as a background software update).

Memory — specifically RAM (Random Access Memory) — is one of the most important and most limited resources a computer has. Programs need memory to store instructions, variables, data structures, and state while they run. The operating system's job is to allocate memory fairly, protect programs from each other, and make the most of what is physically available.

Without memory management, any program could read or write any location in memory. A buggy program could corrupt another program's data. A malicious program could steal passwords or private data from another program's memory. Memory management prevents all of this.

Each process receives its own address space — a range of memory addresses that the process can use. From the process's perspective, it appears to have the entire computer's memory to itself. In reality, the OS maps these apparent addresses to actual physical locations in RAM and keeps each process's space completely isolated. This isolation is called memory protection. If a process tries to access memory outside its own address space, the OS immediately stops it — producing errors like "segmentation fault" on Linux or "access violation" on Windows. The crashing program is stopped, but the rest of the system remains safe.

What happens when programs together need more memory than physically exists? The OS uses virtual memory — it treats part of the storage drive as an extension of RAM. When RAM fills up, the OS moves data that has not been used recently from RAM to the drive. This is called swapping or paging. When that data is needed again, the OS swaps it back into RAM, moving something else out if necessary. Virtual memory allows programs to run even when they collectively need more memory than is physically installed. The tradeoff is speed: storage is vastly slower than RAM. When a computer swaps constantly — called thrashing — performance degrades sharply. Adding more RAM is one of the most effective upgrades for a system that swaps heavily.

Data that needs to survive beyond a single session must be stored permanently. The file system is the part of the operating system that organizes data on storage devices — hard drives, solid-state drives, USB drives — into a structure that both humans and programs can navigate.

A file is a named collection of data stored on a device. Files hold programs, documents, images, audio, video, configuration settings, logs, databases, and every other kind of persistent information. A folder (also called a directory) is a container that holds files and other folders. Folders organize files into groups, making it possible to find things in a large storage system.

Every major operating system organizes its file system as a tree. At the top is the root. On Windows, each drive has its own root (C:\, D:\). On Linux and macOS, the entire system has a single root written as /. A location in the tree is described by a path — a sequence of folder names leading to a file or folder. Paths starting from the root are absolute paths; paths starting from the current location are relative paths.

Every file has metadata — information about the file rather than its content. Metadata includes the file's name, size, type (often indicated by extension like .txt, .jpg, .py), created date, modified date, owner, and permissions. File extensions are conventions, not technically enforced — renaming a file from photo.jpg to photo.txt does not change the actual data inside, only the label. Different operating systems use different file system formats to organize this data on storage devices.

Not everyone who uses a computer should have access to everything on it. A student should be able to use a school computer but not delete the operating system. An employee should be able to open their own files but not a colleague's private documents. Operating systems handle these restrictions through user accounts and permissions.

Every person who uses a computer has a user account — a collection of settings, files, and access rights associated with a specific username. Most operating systems distinguish between standard user accounts, which have limited permissions and cannot install system-wide software or change system files, and administrator accounts (called root on Linux and macOS), which have full access to the entire system.

Running as an administrator all the time is a security risk. If a malicious or buggy program runs under an administrator account, it can damage or take over the entire system. Best practice is to use a standard account for daily work and escalate privileges only when needed. On Linux, users escalate temporarily using the sudo command ("superuser do"), which prompts for the administrator password and runs just that one command with elevated permissions.

Every file and folder has a set of permissions that determine who can do what with it. Permissions are divided into three types — read (r), write (w), and execute (x) — and three groups: the owner, a group, and others. Linux and macOS display permissions as a compact string of characters.

A computer system connects to an enormous variety of hardware — dozens of keyboard models, hundreds of printers, thousands of USB devices, multiple generations of graphics cards, various network adapters, and countless specialized components. How can an operating system possibly talk to all of them?

The answer is the device driver. A device driver is a piece of software that allows the operating system to communicate with a specific hardware device. The driver translates between the generic instructions the OS sends and the specific commands that a particular device understands. Think of a driver as a translator: the operating system speaks a standard language ("send data to the printer"), and the driver translates that into the exact commands this particular printer requires.

Device drivers are among the most common causes of system instability and security vulnerabilities. Because drivers run at a very privileged level inside the OS, a buggy or malicious driver can crash the entire system — producing the "blue screen of death" on Windows or a kernel panic on Linux and macOS. When a hardware device stops working after a software update, the cause is often driver incompatibility. When a peripheral stops responding, reinstalling or updating the driver is a common fix. Modern operating systems increasingly manage driver updates automatically, downloading and installing them without requiring user intervention.

Users interact with operating systems through interfaces — systems that translate human actions into instructions the OS can act on. Two major types exist: graphical user interfaces and command-line interfaces.

A graphical user interface, or GUI (pronounced "gooey"), presents the OS as a visual environment of windows, icons, menus, buttons, and pointers. GUIs made computing accessible to people without technical training. The introduction of commercial GUIs in the 1980s — popularized by the Apple Macintosh and later by Windows — transformed computing into a mass technology. Every GUI has characteristic elements: windows (resizable rectangular areas for each program), icons (visual symbols for files, folders, and programs), menus (hierarchical lists of commands), taskbars and docks (bars of icons showing running programs), dialog boxes (pop-ups that ask for input or confirmation), and file managers (tools like Windows Explorer or macOS Finder for browsing the file system visually).

GUIs are intuitive and easy to learn for basic tasks. But they have limits. Complex, repetitive tasks are often much faster to automate with typed commands. Remote administration of servers over slow network connections works better without a GUI. Scripting — writing sequences of commands to automate workflows — requires text. This is where the command-line interface excels.

A command-line interface, or CLI, accepts typed text commands and produces text output. The user types a command, presses Enter, and the OS executes it. The CLI goes by several names: terminal or terminal emulator (the window that hosts it), shell (the program that interprets commands — bash, zsh, PowerShell), and command prompt (the Windows name).

Multitasking is the ability to run multiple programs at the same time — or more precisely, to manage many processes so they appear to run simultaneously even when sharing limited CPU resources.

Cooperative multitasking (historical) required each program to voluntarily give up the CPU when done with its turn. If a program refused to yield, or if it froze, the entire system froze. Early versions of Mac OS and Windows used cooperative multitasking. It was fragile. Preemptive multitasking allows the OS to forcibly remove a program from the CPU when its time slice expires, regardless of whether the program is ready. This means one frozen program does not freeze the entire system. All modern operating systems use preemptive multitasking.

A thread is a smaller unit of execution within a process. A single process can have multiple threads, all sharing the same memory space but executing different parts of the program concurrently. A web browser, for example, might use separate threads for downloading a page, rendering it, running JavaScript, playing video, and responding to input. Each thread can progress independently. If the download thread stalls, the rendering thread can still update the screen. Threads are efficient but require careful design — if two threads modify the same data simultaneously without coordination, they can corrupt it. Managing threads correctly is one of the more complex areas of systems programming.

Operating systems distinguish between foreground processes (which the user is actively interacting with) and background processes (which run silently without direct user interaction). Background processes — called daemons on Linux or services on Windows — handle essential tasks: checking email automatically, keeping the clock synchronized, managing printers, monitoring battery levels, updating software, and logging system events. They start when the system boots and run continuously until shutdown.

An operating system is not a static product. It is maintained continuously, with updates released regularly to fix bugs, patch security vulnerabilities, add features, and improve performance.

Security is the most urgent reason to keep an OS updated. When researchers or attackers discover a vulnerability — a weakness in the OS code that could be exploited — the OS developer releases a patch (a targeted fix) to close it. Every day between a vulnerability's discovery and the installation of its patch is a window of risk. Attackers who learn of a vulnerability will attempt to exploit it quickly. Unpatched systems are one of the primary ways malware spreads and attackers gain access to networks.

For personal computers, the inconvenience of an update — downloading data, restarting — is minor compared to the security risk of not updating. For servers that must never be interrupted — hospital monitoring systems, airline flight management, stock exchanges — applying updates requires careful planning during scheduled maintenance windows.

Beyond updates, operating systems require other regular maintenance: checking storage for errors, removing unnecessary files, reviewing logs of system events, managing backups, and keeping installed software current. On Linux servers, much of this is automated through cron jobs — scheduled commands that run automatically at set times — and through package managers that handle software installation, updates, and removal automatically.

Everything covered in this chapter points toward one central insight: the operating system is a layer.

Computer science is full of layers. Hardware is the lowest. On top of hardware sits the operating system. On top of the OS sit programs, tools, languages, databases, and frameworks. On top of those sit the applications users see. Each layer hides complexity from the layers above it and exposes a simplified interface. The operating system hides the differences between hardware devices. Programs do not need to know whether a file is stored on a magnetic hard drive or a solid-state drive or a USB stick. They ask the OS to open the file, and the OS handles the details.

This abstraction is enormously valuable. It means a Python program written on one computer behaves the same way on any other computer running the same OS, regardless of underlying hardware differences. It means developers can write software for "Windows" or "Linux" without writing different code for every motherboard, CPU model, and storage device ever made.

The OS layer is also the primary enforcement point for security. Because all programs must go through the OS to access hardware, files, memory, and the network, the OS can intercept and evaluate every request. If a program tries to delete a system file, the OS can refuse. If a program tries to access memory it does not own, the OS can stop it. This is why malware often tries to gain kernel-level access — code that runs at the OS level can bypass many protections. It is also why OS vulnerabilities are so serious: a hole in the OS layer potentially exposes everything above it.

The habit of thinking in layers — asking "what does this layer expose?" and "what does this layer hide?" — is one of the most valuable intellectual tools in all of computing. Students will encounter this pattern in networking (the TCP/IP stack), in databases, in web development (frontend vs. backend vs. database), and in every other area of the field.