
`syscall.Exec` (or `golang.org/x/sys/unix.Exec` on Unix) replaces the running process with a new executable. Unlike `exec.Command`, there is no child process - the current process image is overwritten. On success it never returns.

<ExamplePair>
<ExampleProse>

`exec.LookPath` resolves a binary name to a full path using `$PATH`, which `syscall.Exec` requires. Pass the full argument list as the second argument - by convention `args[0]` is the binary name.

</ExampleProse>
<ExampleCode>

```go
package main

import (
    "fmt"
    "os"
    "os/exec"
    "syscall"
)

func main() {
    binary, err := exec.LookPath("ls")
    if err != nil {
        fmt.Println("could not find ls:", err)
        os.Exit(1)
    }

    args := []string{"ls", "-la", "/tmp"}
    env := os.Environ()

    // This call does not return on success.
    if err := syscall.Exec(binary, args, env); err != nil {
        fmt.Println("exec failed:", err)
        os.Exit(1)
    }
}
```

</ExampleCode>
</ExamplePair>

<ExamplePair>
<ExampleProse>

A common use case: a launcher or supervisor that re-execs itself after downloading an updated binary. Run any cleanup before calling `Exec` - deferred functions will not run.

</ExampleProse>
<ExampleCode>

```go
package main

import (
    "fmt"
    "os"
    "os/exec"
    "syscall"
)

func reexec(newBinary string) error {
    path, err := exec.LookPath(newBinary)
    if err != nil {
        return fmt.Errorf("look path: %w", err)
    }
    return syscall.Exec(path, os.Args, os.Environ())
}

func main() {
    // Perform any cleanup before re-exec; defer won't run after Exec.
    fmt.Println("handing off to updated binary")
    if err := reexec("/usr/local/bin/myapp-new"); err != nil {
        fmt.Println("re-exec failed:", err)
        os.Exit(1)
    }
}
```

</ExampleCode>
</ExamplePair>

<InProduction>
`syscall.Exec` is for process-replacing wrappers - supervisors that re-exec on config reload, entrypoints that hand off to a different binary after initial setup, or shims that wrap another program. It does not return on success: any deferred functions, goroutines, and open file descriptors (other than those explicitly inherited) are lost. Do not use it as a substitute for `exec.Command` when you just want to run a subprocess and wait for it. On Linux the process keeps its PID, which is useful for PID-file-based process managers. Always flush logs and close non-inherited resources before calling `Exec` - there is no cleanup window after it succeeds. On non-Unix systems (Windows), `syscall.Exec` is not available; use `exec.Command` + `os.Exit` as an approximation, accepting that the process image is not replaced in place.
</InProduction>


syscall.Exec (or unix.Exec) replaces the current process image entirely - deferred functions never run, so use it only when you intentionally want to hand off to another binary.

Exec'ing Processes


`signal.Notify` registers a channel to receive OS signals. `signal.NotifyContext` (Go 1.16) is the idiomatic way to tie a `context.Context` to signal receipt - when the signal arrives, the context is cancelled and the cancellation propagates through the entire call stack.

<ExamplePair>
<ExampleProse>

`signal.Notify` delivers matching signals to the channel. Always create a buffered channel (capacity 1) so the signal is not dropped if the goroutine is not ready to receive.

</ExampleProse>
<ExampleCode>

```go
package main

import (
    "fmt"
    "os"
    "os/signal"
    "syscall"
)

func main() {
    sigs := make(chan os.Signal, 1)
    signal.Notify(sigs, syscall.SIGINT, syscall.SIGTERM)

    fmt.Println("running, press Ctrl+C to stop")
    sig := <-sigs
    fmt.Println("\nreceived signal:", sig)
}
```

</ExampleCode>
</ExamplePair>

<ExamplePair>
<ExampleProse>

`signal.NotifyContext` returns a context that is cancelled when the signal arrives. Pass this context to your server or worker - they stop cleanly when cancelled.

</ExampleProse>
<ExampleCode>

```go
package main

import (
    "context"
    "fmt"
    "os/signal"
    "syscall"
    "time"
)

func runWorker(ctx context.Context) {
    for {
        select {
        case <-ctx.Done():
            fmt.Println("worker shutting down:", ctx.Err())
            return
        case <-time.After(500 * time.Millisecond):
            fmt.Println("worker tick")
        }
    }
}

func main() {
    ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
    defer stop()

    go runWorker(ctx)

    <-ctx.Done()
    fmt.Println("signal received, waiting for worker")
    time.Sleep(200 * time.Millisecond)
    fmt.Println("shutdown complete")
}
```

</ExampleCode>
</ExamplePair>

<InProduction>
Handle SIGTERM for graceful shutdown in containerised services -- Kubernetes sends SIGTERM before SIGKILL and waits `terminationGracePeriodSeconds` (default 30 s) for the process to exit cleanly. If your server ignores SIGTERM and Kubernetes sends SIGKILL, in-flight requests are abruptly dropped. Use `signal.NotifyContext` to tie a context to SIGTERM receipt, then pass that context to `http.Server.Shutdown` so it waits for in-flight requests to complete before closing. Always call `stop()` (the function returned by `signal.NotifyContext`) when you are done -- it releases the signal notification resources and re-enables the default signal behaviour so a second Ctrl+C terminates the process immediately rather than hanging. For multi-signal flows (first signal = drain, second signal = force exit), use `signal.Notify` with a buffered channel and handle the two signals separately in a select. Never call `signal.Notify` with an unbuffered channel in production -- if the goroutine is not ready to receive when the signal arrives, the delivery is skipped entirely.
</InProduction>


signal.NotifyContext ties a context to SIGINT/SIGTERM - cancel it to propagate graceful shutdown to every goroutine that respects context cancellation.

Signals


`exec.Command` creates a `*exec.Cmd` that represents an external process. The arguments are passed directly to `execve` - no shell is involved, so shell metacharacters are inert. Run the command with `Output` (captures stdout), `Run` (waits for completion), or `Start` + `Wait` (async).

<ExamplePair>
<ExampleProse>

`Cmd.Output` runs the command, waits for it to finish, and returns stdout as a byte slice. `Cmd.CombinedOutput` captures both stdout and stderr together.

</ExampleProse>
<ExampleCode>

```go
package main

import (
    "fmt"
    "os/exec"
)

func main() {
    out, err := exec.Command("ls", "-la", "/tmp").Output()
    if err != nil {
        fmt.Println("error:", err)
        return
    }
    fmt.Print(string(out))
}
```

</ExampleCode>
</ExamplePair>

<ExamplePair>
<ExampleProse>

`Cmd.Start` launches the process asynchronously. `Cmd.Wait` blocks until it exits and collects the exit code. Use this pattern when you want to do other work while the subprocess runs, or when you need to stream output.

</ExampleProse>
<ExampleCode>

```go
package main

import (
    "fmt"
    "os/exec"
)

func main() {
    cmd := exec.Command("sleep", "1")
    if err := cmd.Start(); err != nil {
        fmt.Println("start error:", err)
        return
    }
    fmt.Println("process started, pid:", cmd.Process.Pid)

    if err := cmd.Wait(); err != nil {
        fmt.Println("wait error:", err)
        return
    }
    fmt.Println("process finished")
}
```

</ExampleCode>
</ExamplePair>

<ExamplePair>
<ExampleProse>

Pipe stdout and stderr for streaming output. Attach `os.Stdin` to allow the subprocess to receive user input.

</ExampleProse>
<ExampleCode>

```go
package main

import (
    "fmt"
    "os"
    "os/exec"
)

func main() {
    cmd := exec.Command("go", "version")
    cmd.Stdout = os.Stdout
    cmd.Stderr = os.Stderr

    if err := cmd.Run(); err != nil {
        fmt.Println("error:", err)
        return
    }
}
```

</ExampleCode>
</ExamplePair>

<InProduction>
Never interpolate user input into `exec.Command` as a shell string - pass arguments as separate strings (`exec.Command("ls", "-la", userPath)`) which are exec'd directly without a shell interpreter. Shell injection (`exec.Command("sh", "-c", "ls "+userInput)`) is the most common security vulnerability in process-spawning code and allows arbitrary command execution when `userInput` contains shell metacharacters. For the rare case where you genuinely need a shell (pipelines, glob expansion), validate and sanitize input aggressively or use a subprocess allowlist. Always set a timeout via `context.WithTimeout` and pass the context to `exec.CommandContext` - a subprocess that hangs indefinitely holds the goroutine and its resources. Check the error from `cmd.Wait`: it is non-nil for non-zero exit codes, which are often meaningful (grep returns 1 when no match is found). To capture the exit code specifically, use `var exitErr *exec.ExitError; errors.As(err, &exitErr)` and inspect `exitErr.ExitCode()`.
</InProduction>


exec.Command runs a subprocess - use separate string arguments, not shell interpolation, to prevent command injection from user-supplied input.