What the dev processes in Activity Monitor are

By Kadirhan Yılmaz, who makes Ramback · Updated October 23, 2026

Activity Monitor names a process after its executable, not after what it is. On a Mac used for development, that means an Android emulator shows up as qemu-system-aarch64, the Docker VM as com.apple.Virtualization.VirtualMachine and a Gradle daemon as java. Here's what each common one is, how to confirm it, and the right way to stop it.

Ask any process what it is

Double-click a row in Activity Monitor to see its PID and parent process. The full command line almost always says what it is:

ps -o pid,ppid,args -p 48213

Replace 48213 with the PID. View › All Processes, Hierarchically shows what started what, which is how you tell a dev server you ran from one an agent ran.

qemu-system-aarch64

An Android emulator, when its command line has -avd followed by the device name. This prints the name:

ps -o args= -p 48213 | grep -o -- '-avd [^ ]*'

Stop it with adb emu kill, which asks the emulator to shut down instead of killing it from outside. On an Intel Mac the same process is qemu-system-x86_64. Without -avd, it's a Linux VM that Colima or Lima runs with QEMU. More in Android emulator slow on a 16 GB Mac.

com.apple.Virtualization.VirtualMachine

A virtual machine run by Apple's Virtualization framework. On a dev Mac, that's almost always the Linux VM that Docker Desktop, OrbStack or Colima runs your containers in. macOS starts it as its own service, so its parent process is launchd, not the app.

It holds memory up to the VM's limit even when no container is running, and rarely gives it back. Stopping containers doesn't shrink it; stopping the runtime does:

docker desktop stop   # Docker Desktop
orb stop              # OrbStack
colima stop           # Colima

More, including how to lower the limit, in Docker using too much memory on a Mac.

java

On a Mac with Android Studio or a JVM project, usually a Gradle daemon or a Kotlin compile daemon. Each one keeps 1–2 GB after the build ends and waits up to 3 hours for the next one. List them:

pgrep -lf GradleDaemon
pgrep -lf KotlinCompileDaemon

Stop them with ./gradlew --stop from a project, which only stops daemons of that project's Gradle version, or all of them with pkill -f GradleDaemon. Any other java is a Java app you started, and its command line says which. More in Gradle daemon memory on a Mac.

launchd_sim, SimulatorTrampoline and CoreSimulatorService

Each booted iOS simulator runs its own launchd_sim and close to 100 processes under it, like SpringBoard and backboardd. The memory is spread across all of them, so a simulator never tops the Memory column even when the device holds about 1.5 GB. Xcode Previews boot devices of their own, with no window. List both kinds:

xcrun simctl list devices booted
xcrun simctl --set previews list devices booted

Shut them down with xcrun simctl shutdown all (add --set previews for the Previews devices). SimulatorTrampoline and CoreSimulatorService are shared helpers that stay running afterwards and hold almost nothing. More in iOS Simulator using too much memory.

SWBBuildService, XCBBuildService and SourceKitService

SWBBuildService is Xcode's build service (Swift Build); older Xcode versions use XCBBuildService. It often holds more than 1 GB after a build and stays up as long as Xcode does. SourceKitService powers code completion and indexing for Swift.

Quit Xcode to end them. Don't kill them while Xcode is open: Xcode starts them again, and the next build or completion has to rebuild what they had in memory.

node

A dev server (Next.js, Vite, Storybook and the rest), a bundler like Metro or Expo, or an AI agent that runs as a Node script, like Gemini CLI or Cursor Agent. See which ones listen on a port:

lsof -nP -iTCP -sTCP:LISTEN | grep node

Stop the command that started the server, such as npm run dev, rather than the inner node, or a watcher may start it again. More in Kill the process on port 3000 and Find dev servers your AI coding agent left running.

A process named after a version number, like 2.1.309

That's Claude Code. Its native installer runs a binary named after its version, so Activity Monitor shows 2.1.309 while ps says claude. Codex shows as codex, or codex-aarch64-apple-darwin when installed with Homebrew. Each session holds about 0.4–0.5 GB, plus whatever servers it started. End sessions you've finished with in their terminal; the servers they started often keep running after that.

postgres, mongod, redis-server and mysqld

Local databases. Postgres shows as several processes, one for each background worker. Stop a database with the tool that started it, such as brew services stop postgresql@17 (brew services list shows the name) or docker stop for a container. Never kill -9 one: it can lose writes that weren't on disk yet.