Skip to content
elephantoo

The filesystem hierarchy

Lesson 3 of 31 12 min read

Why everything starts at /, what lives in /etc, /var, /usr, /home and /proc, and "everything is a file".


Windows has drive letters (C:\, D:\). Linux has one tree that starts at the root directory, /. Every file, disk, USB stick and network share appears somewhere under it. The layout follows the Filesystem Hierarchy Standard (FHS), so once you learn it, you'll find your way around any distribution.

The top level#

Terminal
ls /
Output
bin   dev  home  lib64  mnt  proc  run   srv  tmp  var
boot  etc  lib   media  opt  root  sbin  sys  usr

(Your list may include a few extras, such as lost+found or snap.)

DirectoryWhat lives thereExamples
/the root of everything
/homeusers' personal directories/home/ada
/rootthe root (admin) user's home
/etcsystem-wide configuration (text files)/etc/hosts, /etc/ssh/sshd_config, /etc/fstab
/usrinstalled software and read-only data/usr/bin/python3, /usr/share/doc
/bin, /sbin, /libessential programs and libraries. On modern distros these are links into /usr/bin/ls → /usr/bin/ls
/usr/localsoftware you install by hand, outside the package manager/usr/local/bin/mytool
/optself-contained third-party applications/opt/google/chrome
/varvariable data that changes and grows/var/log, /var/lib/mysql, /var/cache/apt, /var/www
/tmptemporary files, often cleared at boot
/bootthe kernel and bootloader filesvmlinuz-6.8.0-45-generic
/devdevice files/dev/sda (disk), /dev/null, /dev/tty
/procvirtual files about processes and the kernel/proc/cpuinfo, /proc/1234/
/sysvirtual files about hardware and drivers/sys/class/net
/runruntime data since the last boot: PID files, sockets/run/sshd.pid
/mnt, /mediamount points for temporary and removable filesystems/media/ada/USBSTICK
/srvdata served by this system (some admins use it)/srv/www

Where do programs live?#

When you type python3, the shell searches the directories listed in the PATH variable, in order:

Terminal
echo "$PATH"
which ls python3
Output
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
/usr/bin/ls
/usr/bin/python3
  • /usr/bin holds programs installed by the package manager.
  • /usr/sbin holds admin programs (useradd, sshd).
  • /usr/local/bin comes first, so a tool you install there overrides the distro's version.

You'll learn to change PATH in Environment variables & shell configuration.

/etc: configuration as text#

Almost all system configuration is plain text in /etc, which is a big part of what makes Linux scriptable:

Terminal
cat /etc/hostname         # the machine's name
head -3 /etc/passwd       # user accounts (no passwords in here, despite the name)
ls /etc/ssh/              # SSH client and server configuration

Edit these files with care (and usually with sudo). Make a backup copy first: sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak.

/var: things that grow#

/var is where running systems write data:

PathContents
/var/loglog files (syslog, auth.log, nginx/)
/var/libapplication state: /var/lib/mysql, /var/lib/docker, /var/lib/apt
/var/cachecaches that can be rebuilt, such as downloaded packages
/var/spoolqueues: print jobs, mail, cron
/var/wwwa traditional home for web content

When a disk fills up unexpectedly, /var (logs, Docker images, databases) is usually the first place to look. See Disks & storage.

"Everything is a file"#

Linux exposes many things through the file interface:

Terminal
ls -l /dev/null /dev/zero /dev/urandom
head -c 16 /dev/urandom | od -An -tx1    # 16 random bytes, in hex
echo "this disappears" > /dev/null       # the "black hole": discards anything written

/proc and /sys aren't on disk at all. The kernel generates their contents on demand:

Terminal
grep -m1 "model name" /proc/cpuinfo   # your CPU
grep MemTotal /proc/meminfo           # total RAM
cat /proc/loadavg                     # load averages
ls /proc/$$                           # info about this shell process ($$ is its PID)

Tools like ps, top and free simply read these files and format them nicely.

Your home directory#

/home/<you> (written ~) is yours: documents, code, downloads and your personal configuration in hidden "dotfiles":

Terminal
ls -a ~
Output
.  ..  .bash_history  .bash_logout  .bashrc  .cache  .config  .local  .profile  .ssh  projects
  • Names starting with . are hidden from plain ls. Use ls -a to see them.
  • ~/.bashrc configures your shell, ~/.ssh/ holds your SSH keys, and ~/.config/ holds most apps' settings.
  • . means "this directory" and .. means "the parent directory".

Mount points: disks join the tree#

Extra disks, partitions and USB sticks don't get letters. They're mounted onto a directory, and their contents appear there:

Terminal
findmnt -D / ; df -h /home

A server might mount a big data disk at /var/lib/mysql or /data. You'll learn how in Disks & storage.

Case, extensions and names#

  • Names are case-sensitive: Report.txt and report.txt can sit side by side.
  • Extensions (.txt, .sh) are just part of the name. Linux decides how to treat a file by its permissions and content, not its extension (file name shows what a file really is).
  • Avoid spaces and special characters in names you'll use on the command line. Use my-notes.txt or my_notes.txt.
  • / can't appear in a file name, and neither can the NUL byte. Almost anything else can.

Common mistakes#

  • Looking for drive letters. There's a single tree starting at /, and other disks are mounted into it (e.g. /mnt/usb).
  • Mixing up / and ~. / is the root of the whole system, while ~ is your home directory, /home/<you>.
  • Storing your own files in system directories like /usr or /etc. Keep them in your home directory, and put server data under /srv or /var/lib.
  • Forgetting that names are case-sensitive. Report.txt and report.txt are different files.

What's next#

With the map in mind, let's move around it: pwd, ls, cd and paths.

Check your understanding

Quick quiz

0/3 answered
  1. 1.Where do system-wide configuration files live?

  2. 2.Your server's disk is filling up with log files. Which directory is the most likely culprit?

  3. 3.What is special about /proc and /sys?

Finished reading?

Mark this lesson complete to track your progress.