Filesystem Hierarchy#

Concepts#

The Filesystem Hierarchy Standard (FHS)#

Linux follows the Filesystem Hierarchy Standard — a convention that defines where files should go. Every Linux distribution (including Ubuntu and Debian) follows this structure. Once you know it, you can find your way around any Linux system.

Top-Level Directories# 

/
├── bin       → essential user commands
├── boot      → bootloader and kernel
├── dev       → device files
├── etc       → system configuration
├── home      → user home directories
├── lib       → shared libraries
├── media     → removable media mount points
├── mnt       → temporary mount points
├── opt       → optional/third-party software
├── proc      → process information (virtual)
├── root      → root user's home directory
├── run       → runtime data (virtual)
├── sbin      → essential system commands
├── srv       → service data
├── sys       → kernel/hardware information (virtual)
├── tmp       → temporary files
├── usr       → user programs and data
└── var       → variable data (logs, caches, mail)

Directory-by-Directory Breakdown#

/ — The Root#

The top of the tree. Everything is under /. Do not confuse it with /root (the root user’s home directory).

/home — User Home Directories#

Each user gets a directory under /home:

/home/
├── kmiguel/      → /home/kmiguel
├── alice/        → /home/alice
└── bob/          → /home/bob

Your home directory contains your personal files, configuration, and settings. The shorthand ~ always refers to your own home directory.

/etc — System Configuration#

Everything Configurable lives in /etc. This is where system-wide configuration files are stored:

/etc/
├── hostname          → the system's hostname
├── hosts             → static hostname-to-IP mappings
├── fstab             → filesystem mount table
├── passwd            → user account information
├── shadow            → encrypted passwords
├── group             → group information
├── apt/              → APT package manager config
│   └── sources.list  → package repository URLs
├── ssh/              → SSH server configuration
├── network/          → network configuration (Debian)
├── netplan/          → network configuration (Ubuntu)
├── systemd/          → systemd unit overrides
└── cron.d/           → cron job definitions

When something is misconfigured on a Linux system, /etc is almost always where you go to fix it.

/var — Variable Data#

Files that change frequently during system operation:

/var/
├── log/       → system and application logs
│   ├── syslog          → main system log
│   ├── auth.log        → authentication events
│   └── apt/            → APT logs
├── cache/     → application caches
│   └── apt/            → downloaded packages
├── lib/       → dynamic state data
├── mail/      → user mail
├── spool/     → print and mail queues
└── tmp/       → temporary files (preserved across reboots)

/var/log is critical for troubleshooting — when something goes wrong, logs are the first place to look.

/usr — User Programs#

The majority of installed programs live here:

/usr/
├── bin/       → most user commands (ls, grep, python, gcc, ...)
├── sbin/      → system administration commands (non-essential)
├── lib/       → libraries for /usr/bin and /usr/sbin
├── share/     → architecture-independent data (docs, icons, locales)
│   ├── doc/   → documentation for installed packages
│   └── man/   → manual pages
├── local/     → locally installed software (not managed by apt)
│   ├── bin/
│   ├── lib/
│   └── share/
└── include/   → C/C++ header files

On modern Ubuntu and Debian, /bin is actually a symlink to /usr/bin, and /sbin to /usr/sbin. This is called the usr-merge. The separation is historical — in practice, all commands live under /usr/bin and /usr/sbin. Symlinks will be discussed later in this course.

/bin and /sbin — Essential Commands#

  • /bin (→ /usr/bin) — commands available to all users: ls, cp, mv, cat, bash
  • /sbin (→ /usr/sbin) — commands for system administration: fdisk, iptables, reboot

/boot — Bootloader and Kernel#

Contains files needed to start the system:

/boot/
├── vmlinuz-6.8.0-41-generic     → the Linux kernel
├── initrd.img-6.8.0-41-generic  → initial RAM disk
├── grub/                        → GRUB bootloader configuration
└── config-6.8.0-41-generic      → kernel build configuration

You rarely need to touch this directory. It comes up in Module 13 (Boot Process).

/dev — Device Files#

Hardware and virtual devices are represented as files:

/dev/
├── sda        → first hard disk
├── sda1       → first partition on first disk
├── sdb        → second hard disk (or USB drive)
├── tty0       → first virtual console
├── null       → discards all data written to it
├── zero       → produces infinite null bytes
├── random     → produces random data
└── urandom    → produces pseudo-random data

/dev/null is especially useful: you can send unwanted output there, and it vanishes. Example: command 2>/dev/null discards error messages. It’s like a black hole in which you send things you don’t want to see ever again.

/proc — Process Information (Virtual)#

A virtual filesystem — it does not exist on disk. The kernel generates its contents on the fly. Each running process has a directory:

/proc/
├── 1/          → init/systemd process (PID 1)
├── 1234/       → process with PID 1234
│   ├── cmdline → command that started it
│   ├── status  → current status
│   └── fd/     → open file descriptors
├── cpuinfo     → CPU information
├── meminfo     → memory information
├── uptime      → system uptime
└── version     → kernel version

cat /proc/cpuinfo    # see your CPU details
cat /proc/meminfo    # see memory information
cat /proc/uptime     # see how long the system has been running

/sys — Kernel/Hardware Information (Virtual)#

Similar to /proc but organized by device/subsystem. Used by the kernel to expose hardware information and allow tuning. You rarely interact with it directly.

/tmp — Temporary Files#

Any user can write here. Contents may be deleted on reboot (configurable). Programs use it for scratch data. On many systems, /tmp is a tmpfs (lives in RAM, not on disk). This is a terrible place to write family photos on.

/opt — Optional Software#

Third-party software that does not follow the standard /usr layout goes here. Examples: Google Chrome installs to /opt/google/chrome/, some enterprise software installs to /opt/.

/media and /mnt — Mount Points#

  • /media/ — where automatically mounted removable devices appear (USB drives, CDs). GNOME auto-mounts to /media/yourusername/devicelabel/.
  • /mnt/ — traditionally used for manually mounting temporary filesystems.

/root — Root User’s Home#

The root (superuser) account’s home directory. It is at /root, not /home/root. Normal users cannot access it.

/srv — Service Data#

Data served by the system (e.g., web server files). Often empty on desktops. You might see /srv/www/ on a web server or /srv/ftp/ on an FTP server.

/run — Runtime Data (Virtual)#

A tmpfs that stores runtime information since boot: PID files, sockets, lock files. Cleared on every reboot.

Lab#

Exercise 1: Explore the Root Directory# 

# List everything at the top level
ls /

# See which directories are symlinks (on merged systems)
ls -la / | grep "^l"
# You should see bin -> usr/bin, sbin -> usr/sbin, lib -> usr/lib, etc.

Exercise 2: Explore /etc# 

# List the contents
ls /etc

# Look at some important configuration files
cat /etc/hostname
cat /etc/hosts
head -5 /etc/passwd
cat /etc/os-release

Exercise 3: Explore /var/log# 

# See what logs exist
ls /var/log

# Look at recent system log entries (may need sudo)
sudo tail -20 /var/log/syslog    # Ubuntu
sudo tail -20 /var/log/messages  # Debian (or syslog)

# Check authentication log
sudo tail -10 /var/log/auth.log

Exercise 4: Explore /proc (Virtual Filesystem)# 

# CPU information
cat /proc/cpuinfo | head -20

# Memory information
cat /proc/meminfo | head -10

# System uptime (in seconds)
cat /proc/uptime

# Kernel version
cat /proc/version

# List running process directories (each number is a PID)
ls /proc | head -20

Exercise 5: Explore /dev# 

# List device files
ls /dev | head -30

# Send something to /dev/null (it vanishes)
echo "This disappears" > /dev/null

# Read a few random bytes
head -c 16 /dev/urandom | xxd
# (xxd shows the hex representation — install with: sudo apt install xxd)

Exercise 6: Check the usr-merge# 

# On Ubuntu 24.04 and Debian 12, /bin is a symlink:
ls -la /bin
# Output: /bin -> usr/bin

ls -la /sbin
# Output: /sbin -> usr/sbin

# So these are the same file:
ls -la /bin/ls
ls -la /usr/bin/ls

Review#

1. Where are system configuration files stored?

In /etc. This is where you find configuration for networking, user accounts, package repositories, SSH, cron jobs, and almost every other system-wide setting.

2. Where do system logs live?

In /var/log. Key logs include syslog (general system log), auth.log (authentication events), and logs for specific applications.

3. What is the difference between `/` and `/root`?

/ is the root of the entire filesystem tree — the top-level directory that contains everything. /root is the home directory of the root (superuser) account.

4. What are `/proc` and `/sys`?

They are virtual filesystems that do not exist on disk. The kernel generates their contents dynamically. /proc exposes process information, CPU/memory details, and kernel parameters. /sys exposes hardware and device information.

5. What is `/dev/null` used for?

It is a special device file that discards all data written to it. It is commonly used to suppress unwanted output, e.g., command 2>/dev/null discards error messages.

6. What is the usr-merge, and does it affect Ubuntu/Debian?

The usr-merge makes /bin, /sbin, and /lib symlinks to their counterparts in /usr/ (/usr/bin, /usr/sbin, /usr/lib). Both Ubuntu 24.04 and Debian 12 use the usr-merge. In practice, all commands live under /usr/bin and /usr/sbin.

7. Where does automatically mounted removable media appear?

Under /media/yourusername/. For example, a USB drive labeled “BACKUP” would appear at /media/kmiguel/BACKUP/.

8. What is the difference between `/tmp` and `/var/tmp`?

Both are for temporary files. /tmp is often cleared on reboot (and may be a tmpfs living in RAM). /var/tmp preserves its contents across reboots and is meant for temporary files that need to persist longer.

Previous: File Operations | Next: Paths, Links, and Inodes