Linux
Beginner 14 min read Linux

The Linux Filesystem & Directory Hierarchy

Everything in Linux lives in one tree rooted at /. Learn the Filesystem Hierarchy Standard — what /etc, /var, /usr, /home and the rest are for, why /bin is a symlink, and how virtual filesystems like /proc and /sys let you troubleshoot a live system.

filesystemFHSdirectory hierarchy/etc/var/usrsymlinks/proc/sysmount pointslinux
Prerequisites: Introduction to Linux
Introduction

What is this?

The Linux filesystem is a single tree rooted at / (the root directory). The Filesystem Hierarchy Standard (FHS) defines what most of those top-level directories are for, so /etc always holds configuration, /var holds logs and caches, /usr holds programs, and /home holds user data. Two of the branches, /proc and /sys, are not real disks at all — they are virtual views into the running kernel and hardware, which is exactly why they are so powerful for troubleshooting.

Motivation

Why do you need it?

  • Every mainstream distribution follows the FHS, so knowing /etc, /var and /usr transfers to Ubuntu, RHEL and even Alpine containers.
  • Logs, configs and binaries live in predictable places, so you can start debugging a server you have never seen before without reading a README.
  • /proc and /sys expose kernel and hardware state as plain files — no special tools required, just cat and ls.
  • Knowing what is volatile (/tmp, /run) versus persistent (/etc, /home) prevents embarrassing and costly data-loss mistakes.
  • Interviewers ask FHS questions to test real hands-on experience rather than memorised flags.
Think about it

Mental model

Imagine

A city zoned into districts

Think of

The Linux filesystem

A city zones residential, commercial and administrative areas so you always know where to find things. The FHS zones the Linux tree the same way — /etc is the council office (config), /var is the records archive (logs), /home is the housing (users), and /proc is the live traffic camera feed (kernel state).

Mechanics

How it works

  • At boot the kernel mounts the root filesystem at / and every other filesystem is attached beneath it at a mount point.
  • The FHS assigns each top-level directory a fixed role: binaries, config, logs, user data, temporary data.
  • Distributions use symlinks like /bin -> /usr/bin so legacy paths keep working after the merged /usr layout.
  • /proc and /sys generate files on demand from live kernel structures and hardware state.
  • Tools like df, mount and du read the mount table and block devices so you can see exactly what uses space and which device backs each path.

One tree, many roles: where things live in an FHS-compliant system.

Root (/)
/bin, /usr
/etc
/var, /tmp, /run
/home, /root
/proc, /sys, /dev
Reference

Key commands

ls /

List the top-level directories defined by the FHS.

bin  boot  dev  etc  home  lib  lib64  media  mnt  opt  proc  root  run  sbin  srv  sys  tmp  usr  var
ls -ld /var

Show the permissions, owner and type of /var itself.

drwxr-xr-x 13 root root 4096 Aug  8 09:14 /var
readlink /bin

Print where the symlink /bin actually points.

usr/bin
df -h /

Show disk usage in human-readable form for the root filesystem.

Filesystem      Size  Used Avail Use% Mounted on
/dev/sda2        98G   34G   59G  37% /
cat /proc/meminfo | head -3

Read the first three lines of virtual memory stats from /proc.

MemTotal:       16383924 kB
MemFree:          9876504 kB
MemAvailable:   14562000 kB
Hands-on

Examples

Map the tree before you touch anything

Map the tree before you touch anything
# See the top-level directories
ls /
 
# Where do commands actually live?
readlink /bin
readlink /sbin
 
# What is mounted, and how full is the disk?
mount | head -3
df -h /
 
# Peek inside a running system
cat /proc/loadavg
ls /dev | head -5

This 30-second survey tells you the FHS layout, which binaries are symlinks into merged /usr, what is mounted, and how full the disk is — the same five commands you run at the start of most incident investigations.

Real world

In production

  • Check free bytes and inodes with df -h and df -i before claiming 'the disk is fine'.
  • Watch /var/log for rotation with logrotate so application logs never fill the disk silently.
  • Tune kernel behaviour by writing /proc/sys entries via sysctl instead of touching files directly.
  • Mount network storage under /mnt or /srv rather than inside /home to keep user quotas and backups predictable.
  • Containers expose their own minimal FHS tree, so debugging inside a container uses the exact same layout as a server.
Guidelines

Best practices

  • Back up /etc before changing configuration; most servers can be restored from a clean /etc snapshot.
  • Keep custom binaries in /usr/local/bin, never /usr/bin, so package upgrades cannot overwrite them.
  • Run df -h and df -i together — a filesystem can be full of bytes or full of inodes.
  • Store application data in /var/lib or /srv, never in /tmp, which is volatile and often cleared.
  • Learn find and du early; they make exploring a 100 TB tree manageable.
Watch out

Common mistakes

  • Deleting files in /tmp to 'clean up' — running processes may hold them open and break in subtle ways.
  • Writing directly to /proc/sys for a quick fix — changes are lost on reboot unless persisted in /etc/sysctl.conf.
  • Assuming everything under / is one disk; a full /var mount can stop writes while / still has space.
  • Typing rm -rf /var when you meant /var/log — always double-check before a recursive delete.
Root cause analysis

Common issues

Error
df -h shows free space but writes fail with 'No space left on device'
Root cause

All inodes are used up — the filesystem cannot create new entries even though bytes remain.

Fix

Confirm with df -i, then find and remove unnecessary small files, e.g. find / -xdev -size 0 -delete.

Error
mount: /data: wrong fs type, bad option, bad superblock
Root cause

A non-Linux filesystem (NTFS, exFAT) is being mounted or a driver is missing.

Fix

Check the type with blkid /dev/sdb1 and install the matching driver (e.g. ntfs-3g) before mounting.

Error
Read-only file system
Root cause

A hard remount or an fsck failure left the filesystem mounted read-only.

Fix

Remount writable with mount -o remount,rw /, and if it recurs run fsck from a rescue shell.

When things break

Debugging tips

  • df -h shows a full disk instantly; df -i shows exhausted inodes.
  • lsof +L1 finds files that were deleted but are still held open by a process.
  • cat /proc/loadavg and cat /proc/meminfo give a live system snapshot with no installs.
  • mount and /proc/mounts reveal exactly which device backs each path.
  • find / -xdev -size +1G locates large files while staying on one filesystem.
Interviews

Interview checkpoint

Practice

Hands-on lab

Map the Linux Filesystem Hierarchy
15 min · beginner
In progress
Objectives
  • List the top-level directories and state the role of each
  • Identify symlinks such as /bin -> /usr/bin
  • Inspect mount points and disk usage with mount and df
  • Read kernel and hardware state from /proc and /sys

Map the Linux Filesystem Hierarchy

15 min · beginner

0/6 steps
0%
sandbox · Linux sandbox
$
Try these commands
Test yourself

Quick quiz

0/6
1

Which directory holds system-wide configuration files?

2

Which of these is a pseudo-filesystem that shows running processes and kernel state?

3

On a modern FHS-compliant distribution, what is /bin?

4

Files written to /tmp are guaranteed to survive a reboot.

5

Which directory is the home directory for the root user?

6

You need to temporarily mount an external backup disk to inspect its contents. Which mount point is the conventional choice?

Quick reference

Cheat sheet

Top-level directories
/etcSystem-wide configuration
/varLogs, caches, spooled data
/usrApplications, libraries, docs
/homeUser home directories
/rootHome of the root user
/optOptional third-party software
/srvService data (web, ftp)
/bootBoot loader and kernel images
Volatile & virtual filesystems
/tmpTemporary files, cleared on reboot
/runRuntime data for running processes
/procKernel and process info as files
/sysKernel/hardware attributes (sysfs)
/devDevice files (/dev/null, /dev/sda)
Mount points & symlinks
/mntTemporary manual mounts
/mediaRemovable media auto-mounts
/bin -> /usr/binEssential commands (symlink)
/lib -> /usr/libShared libraries (symlink)
/sbin -> /usr/sbinAdmin binaries (symlink)
Inspect the layout
df -hDisk usage per filesystem
df -iInode usage per filesystem
mountShow current mounts
readlink /binShow a symlink's target
du -sh /varSize of a directory
lsblkBlock devices and mount points
Go deeper

Official documentation

Filesystem Hierarchy Standard 3.0
docs
man hier — description of the filesystem hierarchy
docs
man proc — the /proc filesystem
docs
man sysfs — the /sys filesystem
docs