Linux Filesystem

Understanding the Linux Filesystem

One of the biggest mindset shifts for beginners is that Linux does not organize storage around drive letters like C: or D:. Instead, everything starts from a single top-level directory called the root directory, written as /.

Files, folders, devices, and even process information appear somewhere under that root. This design makes Linux systems predictable once you learn the layout.

What Is the Filesystem Hierarchy Standard?

The Filesystem Hierarchy Standard (FHS) is a convention that describes where different types of files should live on Unix-like systems. Not every distribution follows it perfectly, but most of them follow the general structure.

The goal is consistency. If configuration files are usually in /etc and logs are usually in /var/log, administrators do not have to guess where important data is stored.

Tip: Memorizing a few key directories saves time when troubleshooting a server over SSH.

The Root Directory /

The root directory is the top of the filesystem tree. Every path begins from here.

For example:

/etc/ssh/sshd_config
/var/log/syslog
/home/devops/.bashrc

Do not confuse / with the root user. The slash is the top directory. The root user is the superuser account with administrative power.

Important Linux Directories

/etc

/etc stores system-wide configuration files. You will often edit files here when managing services, users, networking, or security.

Examples:

/etc/hosts
/etc/passwd
/etc/ssh/sshd_config

In DevOps, /etc matters because many service settings are plain text and easy to automate.

/var

/var holds variable data that changes over time. This includes logs, caches, spool files, and application state.

Common examples:

/var/log/
/var/lib/
/var/cache/

When a service fails, logs in /var/log are usually one of the first places to check.

/tmp

/tmp is used for temporary files. Applications often write short-lived data here. On many systems, its contents may be cleaned automatically.

You should never store important long-term files in /tmp.

Note: In operations work, a missing file in /tmp is often expected because cleanup jobs may remove old temporary data.

/home

/home stores personal directories for regular users.

Example:

/home/alex
/home/devops

A user’s shell profile, SSH keys, and personal scripts are often stored here.

/usr

/usr contains many user-space programs, libraries, and documentation. Despite its name, it is not only for user home data.

Common subdirectories include:

• /usr/bin for commands
• /usr/sbin for admin commands
• /usr/lib for libraries
• /usr/share for shared data and docs

/proc

/proc is a virtual filesystem that exposes kernel and process information. Files here are generated dynamically by the system rather than stored like normal files.

Useful examples:

cat /proc/cpuinfo
cat /proc/meminfo
cat /proc/1/status

This directory is valuable when diagnosing performance or understanding system state.

Absolute vs Relative Paths

A path tells Linux where a file or directory is located.

Absolute Paths

An absolute path starts with / and gives the full location from the root directory.

Example:

/home/devops/projects/app/config.yaml

No matter where you currently are in the shell, that path points to the same file.

Relative Paths

A relative path starts from your current working directory.

If you are in /home/devops/projects, then:

cd app
cat config.yaml

Here, app and config.yaml are relative paths.

Special Path Shortcuts

Linux also uses a few path shortcuts:

• . means the current directory
• .. means the parent directory
• ~ usually means your home directory

Example:

cd ~/projects
ls ../

Reading the Filesystem Like a DevOps Engineer

Suppose an Nginx service fails. A practical workflow might look like this:

cd /etc/nginx
ls
cat nginx.conf
cd /var/log/nginx
tail -n 20 error.log

This simple flow uses two key areas of the filesystem: configuration in /etc and logs in /var/log.

Another example is user troubleshooting:

cat /etc/passwd
ls /home

These commands help you see registered users and their home directories.

Why Filesystem Knowledge Matters

Filesystem knowledge is not trivia. It directly improves troubleshooting speed.

When you know where things usually live, you can:

• find config files faster
• inspect logs without guessing
• understand application layouts
• write better automation scripts
• avoid dangerous mistakes like deleting the wrong path

Beginners often struggle because Linux feels unfamiliar. The fix is repetition: navigate, inspect, and connect each directory to a real use case.

Test Your Understanding

Exercise 1: Finding configuration files

Scenario: Nginx fails to start, and you want its configuration file first.

Question: Which directory from the lesson is the most likely place to check?

Exercise 2: Reading /proc correctly

Question: What makes /proc different from a regular disk-backed directory?

Exercise 3: Spotting a relative path

Scenario: You are currently in /home/devops/projects.

Question: Which path to config.yaml is relative rather than absolute?

---

Key takeaways

• Everything hangs off /. There are no drive letters; additional disks are mounted into the tree.
• /etc is configuration, /var is changing data, /usr is installed software. That split explains most of the layout.
• /tmp may be cleared on reboot and is often a tmpfs in RAM; /var/tmp persists.
• /proc and /sys are not on disk: they are kernel interfaces presented as files.
• /var/log and /var/lib are what fill a disk, so check them first.
• /opt and /usr/local are for software outside the package manager; leave /usr/bin to it.
• A file starting with . is hidden only by convention: ls -a shows it.

---

Frequently Asked Questions

What is the Filesystem Hierarchy Standard?

A specification defining what each top-level directory is for, which is why /etc holds configuration on Ubuntu, Alpine and Fedora alike. It means knowledge transfers between distributions and tooling can make safe assumptions about where things live. Compliance is not absolute. Distributions differ in details, and several have merged /bin into /usr/bin via symlinks, but the broad structure is dependable enough to navigate an unfamiliar system.

What is the difference between /etc, /var and /usr?

/etc holds system-wide configuration: text files you edit, and the first place to look when changing how something behaves. /var holds variable data the system writes during operation. Logs in /var/log, databases and container images in /var/lib, queued mail and print jobs in /var/spool, and it is what grows. /usr holds installed programs and their static supporting files, managed by the package manager and not normally edited by hand.

What is the difference between /tmp and /var/tmp?

/tmp is for short-lived files and is cleared on reboot, and on many modern systems it is a tmpfs living in RAM, which means writing a large file there consumes memory and disappears entirely on restart. /var/tmp is also temporary but is expected to survive a reboot, making it the right choice for a long-running job's intermediate files. Both are world-writable with the sticky bit set, so users cannot delete each other's files.

What are /proc and /sys?

Virtual filesystems that expose kernel state as readable files, occupying no disk space at all. /proc is mostly per-process information, /proc/<pid>/ describes a running process, plus system-wide values such as /proc/meminfo and /proc/cpuinfo. /sys exposes devices and kernel parameters, and writing to files there changes settings at runtime. This is why commands like free and ps work: they read and format these files rather than asking the kernel through a special interface.

Where should I install software that does not come from a package?

/opt for a self-contained third-party application that keeps its own directory tree, and /usr/local when you are installing something that follows the usual bin, lib, share layout, /usr/local/bin is on PATH by default and is the conventional place for a compiled binary. Avoid writing into /usr/bin yourself, because that belongs to the package manager and your file will eventually be overwritten or conflict with an upgrade.

Which directories should I check first when a disk fills up?

/var/log and /var/lib, in that order. Logs grow without limit when rotation is missing or misconfigured, and /var/lib/docker or /var/lib/containerd accumulates images, layers and volumes surprisingly fast on a build host. sudo du -sh /var/* | sort -h narrows it in one command. If df reports a full disk but du does not account for it, look for a deleted file still held open by a process with sudo lsof +L1.