Say I am running a software, and then I run package manager to upgrade the software, I notice that Linux does not bring down the running process for package upgrade - it is still running fine. How does Linux do this?
The reason is Unix does not lock an executable file while it is executed or even if it does like Linux, this lock applies to the inode, not the file name. That means a process keeping it open is accessing the same (old) data even after the file has been deleted (unlinked actually) and replaced by a new one with the same name which is essentially what a package update does.
That is one of the main differences between Unix and Windows. The latter cannot update a file being locked as it is missing a layer between file names and inodes making a major hassle to update or even install some packages as it usually requires a full reboot.
Executables are generally opened once, attached to a file descriptor, and do not have a file descriptor to their binary reopened during a single period of execution. For example, if you execute
This often means that for simple binaries that do not attempt to re-read themselves during execution (by using the path by which they were invoked), the content that is cached stays valid as a dangling inode. This means that there is essentially a replica of the previous version of the executable.
In more complex cases, this can cause problems. For example, a config file may be upgraded and subsequently re-read, or the program may re-exec itself via the path it was executed from. There can also be problems if programs are interconnected, and one is executed before the upgrade, and one after (possibly by the first program). This is also true for some libraries.
For simple use cases, though, it is safe to upgrade without restarting the process.