Linux Filesystem Explained: A Complete Guide to / and Its Directories

Linux Filesystem Explained: A Complete Guide to / and Its Directories

✅ Applies to all major Linux distributions (Ubuntu, Debian, Fedora, Arch) — Last updated: June 2026

The Linux filesystem is one of the first things that confuses new users coming from Windows or macOS. Where are my files? What is /etc? Why can't I just put everything in one folder? This guide explains the complete Linux directory structure — the Filesystem Hierarchy Standard (FHS) — so you'll understand exactly what each directory does, why it exists, and how to navigate it confidently.

Table of Contents

Everything Is a File

The foundational principle of Linux (inherited from Unix): everything is a file. Your hard drive is a file. Your keyboard is a file. Your network interface is a file. Processes expose their information as files in /proc. Even directories are just a special type of file that contains a list of other files.

This design means you can interact with almost any system resource using the same tools you use for regular files — cat, ls, read, write. It's a powerful and elegant design that makes Linux systems remarkably consistent.

The Root Directory /

Everything in Linux starts at / — the root directory (not to be confused with the root user). Unlike Windows which has C:, D: etc., Linux has a single unified filesystem tree. External drives, USB sticks, and network shares are all "mounted" into this tree at specific locations.

$ ls /
bin   boot  dev  etc  home  lib  lib64  lost+found
media  mnt  opt  proc  root  run  sbin  srv  sys  tmp  usr  var

Every Major Directory Explained

/bin — Essential User Binaries

Contains fundamental command-line programs needed by all users and required for the system to boot and function in single-user mode: ls, cp, mv, rm, cat, bash, grep, find.

On modern Linux distributions (Ubuntu 20.04+, Fedora, Arch), /bin is a symbolic link to /usr/bin. The historical separation between /bin (essential) and /usr/bin (non-essential) has been merged.

$ ls -la /bin
lrwxrwxrwx 1 root root 7 Apr  1 2026 /bin -> usr/bin

$ ls /bin | head -20
bash
cat
chmod
chown
cp
dash
date
dd
df
dir

/boot — Boot Files

Contains everything needed to boot the system: the Linux kernel (vmlinuz), initial RAM disk (initrd.img), and the GRUB bootloader configuration.

$ ls /boot
config-6.8.0-35-generic  grub/  initrd.img-6.8.0-35-generic
vmlinuz-6.8.0-35-generic  System.map-6.8.0-35-generic

If you have a separate /boot partition (common in dual-boot setups), it needs to be large enough for multiple kernel versions — 1 GB is typically sufficient.

/dev — Device Files

Contains device files — the "everything is a file" principle in action. Every piece of hardware appears here as a file.

# Storage devices:
/dev/sda         # First SATA/SCSI disk
/dev/sda1        # First partition of sda
/dev/nvme0n1     # NVMe SSD
/dev/nvme0n1p1   # First partition of NVMe

# Virtual/special devices:
/dev/null        # Discard everything written to it (the black hole)
/dev/zero        # Returns infinite zeros when read
/dev/random      # Random data (cryptographically secure but slow)
/dev/urandom     # Random data (fast, suitable for most uses)
/dev/stdin       # Standard input
/dev/stdout      # Standard output
/dev/tty         # Current terminal
/dev/pts/0       # First pseudo-terminal (SSH session, terminal emulator)

# GPU:
/dev/nvidia0     # First NVIDIA GPU
/dev/dri/card0   # DRM render device (AMD, Intel, NVIDIA with open driver)
# Useful device tricks:
cat /dev/null > bigfile.txt    # empty a file instantly
dd if=/dev/zero of=test.img bs=1M count=100  # create 100MB zero-filled file
dd if=/dev/urandom of=/tmp/random.bin bs=1M count=1  # 1MB of random data

/etc — System Configuration

The most important directory for sysadmins. Contains all system-wide configuration files. Every installed service has its config here. This is where you go to configure almost anything.

/etc/passwd          # User accounts (not passwords — just metadata)
/etc/shadow          # Hashed passwords (root readable only)
/etc/group           # Group definitions
/etc/hosts           # Local hostname-to-IP mapping
/etc/hostname        # System hostname
/etc/resolv.conf     # DNS server configuration
/etc/fstab           # Filesystem mount table (what mounts at boot)
/etc/sudoers         # sudo permission rules (always edit with visudo)
/etc/ssh/sshd_config # SSH server configuration
/etc/nginx/          # Nginx web server config directory
/etc/cron.d/         # Cron job definitions
/etc/systemd/        # systemd configuration
/etc/apt/            # APT package manager sources and config (Debian/Ubuntu)
/etc/dnf/            # DNF package manager config (Fedora)
/etc/environment     # System-wide environment variables
/etc/profile         # System-wide shell profile (runs at login)

/home — User Home Directories

Each regular user has a directory here: /home/username. This is where personal files, downloads, documents, and per-user configurations live.

$ ls -la ~
drwxr-x--- 1 jm jm 4096 Jun 08 10:30 .
drwxr-xr-x 1 root root 4096 Jun 01 09:00 ..
-rw------- 1 jm jm 12288 Jun 08 10:30 .bash_history
-rw-r--r-- 1 jm jm   220 Jun 01 .bash_logout
-rw-r--r-- 1 jm jm  3771 Jun 01 .bashrc
-rw-r--r-- 1 jm jm   807 Jun 01 .profile
drwxrwxr-x 3 jm jm 4096 Jun 05 .ssh/
drwxr-xr-x 2 jm jm 4096 Jun 06 Documents/
drwxr-xr-x 2 jm jm 4096 Jun 06 Downloads/

# Hidden files (dotfiles) = per-user app configuration
~/.bashrc           # bash configuration
~/.bash_profile     # bash login profile
~/.ssh/             # SSH keys and config
~/.gitconfig        # git configuration
~/.config/          # XDG-compliant app configs (most modern apps)
~/.local/share/     # user-specific application data

/lib and /lib64 — Shared Libraries

Contains shared libraries (equivalent to Windows .dll files) needed by programs in /bin and /sbin. On modern distributions, /lib is a symlink to /usr/lib.

# See which libraries a program uses:
ldd /usr/bin/nginx

# Output example:
# linux-vdso.so.1 (0x00007ffd...)
# libssl.so.3 => /lib/x86_64-linux-gnu/libssl.so.3
# libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6

/media and /mnt — Mount Points

  • /media — Auto-mounted removable media (USB drives, DVD, SD cards). Desktop environments mount your USB here automatically
  • /mnt — Temporary manual mount points. Used by sysadmins when mounting filesystems temporarily
# Manually mount a partition:
sudo mount /dev/sdb1 /mnt

# Mount a USB drive:
sudo mkdir -p /media/usb
sudo mount /dev/sdb1 /media/usb

# Unmount:
sudo umount /mnt

# List mounted filesystems:
mount | column -t
# or:
findmnt

/opt — Optional Software

Used for self-contained third-party applications that don't follow the typical Linux FHS layout. Software installed to /opt keeps all its files together in one directory:

/opt/google/chrome/       # Google Chrome installs here
/opt/JetBrains/           # JetBrains IDEs
/opt/containerd/          # Some container tools
/opt/myapp/               # Your custom applications

/proc — Process and Kernel Information

A virtual filesystem — it doesn't exist on disk. The kernel creates it in memory and updates it in real time. Every running process has a directory here (/proc/PID/). You can read live system information from files in /proc.

cat /proc/cpuinfo           # CPU details (model, cores, speed)
cat /proc/meminfo           # Memory usage in detail
cat /proc/uptime            # System uptime in seconds
cat /proc/loadavg           # CPU load averages
cat /proc/version           # Kernel version
cat /proc/net/if_inet6      # IPv6 interfaces
cat /proc/sys/vm/swappiness # Read kernel parameter

# Per-process info:
cat /proc/1234/status       # Status of PID 1234
cat /proc/1234/cmdline      # Command that started process 1234
ls /proc/1234/fd/           # Open file descriptors of process 1234

/root — Root User Home

The home directory for the root user. Separate from /home to ensure root can always log in even if /home is on a separate filesystem that fails to mount.

/run — Runtime Data

Stores runtime data that is needed since early boot but doesn't need to persist across reboots. Replaces the old /var/run. Contains PID files, lock files, and similar runtime information.

ls /run
# containerd/  docker/  lock/  nginx.pid  sshd.pid  systemd/  user/

/sbin — System Binaries

Essential system binaries for root/administration tasks: fsck (filesystem check), iptables, mount, fdisk, ip. Like /bin, it's now a symlink to /usr/sbin on modern distros.

/srv — Service Data

Data served by the system — web server document roots, FTP data, etc. Not used consistently across distributions. Nginx and Apache often use /var/www instead, but /srv is the "correct" FHS location.

/sys — System Filesystem

Another virtual filesystem (like /proc) that exposes kernel and hardware information. Provides a structured interface to kernel parameters, device tree, and more.

# Read CPU temperature (if sensor exposed):
cat /sys/class/thermal/thermal_zone0/temp

# Battery level (laptop):
cat /sys/class/power_supply/BAT0/capacity

# Change brightness:
echo 800 | sudo tee /sys/class/backlight/intel_backlight/brightness

# Change swappiness without rebooting:
echo 10 | sudo tee /sys/kernel/mm/transparent_hugepage/enabled

/tmp — Temporary Files

For temporary files that don't need to survive a reboot. On modern systems, /tmp is often a tmpfs (RAM-based filesystem), so it's very fast but limited in size and cleared on reboot.

# Check if /tmp is on tmpfs:
df -h /tmp
# tmpfs   1.6G  1.2M  1.6G   1% /tmp   ← yes, it's in RAM

# Good for: build outputs, downloads, temp scripts
# Bad for: large files, data that must persist

/usr — User Programs and Data

The largest directory on most systems. Contains the majority of user-land software:

/usr/bin/       # Most command-line programs (nginx, python3, git, vim...)
/usr/sbin/      # System administration programs
/usr/lib/       # Shared libraries for programs in /usr/bin
/usr/local/     # Software installed locally (not by package manager)
/usr/local/bin/ # Your custom scripts, manually compiled software
/usr/share/     # Architecture-independent data (docs, icons, fonts)
/usr/share/man/ # Man pages (manual pages)
/usr/include/   # Header files for C programming
/usr/src/       # Source code (kernel sources)

/var — Variable Data

/var contains data that changes as the system runs — logs, databases, package manager cache, mail spools, print queues.

/var/log/             # System and application logs
/var/log/syslog       # Main system log (Debian/Ubuntu)
/var/log/messages     # Main system log (RHEL/Fedora)
/var/log/auth.log     # Authentication logs (SSH logins, sudo)
/var/log/nginx/       # nginx access and error logs
/var/log/journal/     # systemd journal (binary format)

/var/cache/apt/       # APT downloaded packages cache
/var/cache/dnf/       # DNF cache (Fedora)
/var/lib/docker/      # Docker images, containers, volumes
/var/lib/mysql/       # MySQL/MariaDB database files
/var/lib/postgresql/  # PostgreSQL database files

/var/spool/cron/      # User crontabs
/var/www/html/        # Default web server document root
# /var/log is where you spend most of your debugging time:
tail -f /var/log/nginx/error.log    # follow nginx errors
grep "Failed password" /var/log/auth.log  # find failed SSH attempts
journalctl -u nginx -n 100          # last 100 lines of nginx systemd logs
journalctl --since "1 hour ago"     # logs from last hour

Mount Points and /etc/fstab

In Linux, you don't access drives by letter (C:). Instead, you mount them at a location in the filesystem tree. /etc/fstab defines what gets mounted automatically at boot:

cat /etc/fstab

# Device            Mount Point  FS     Options         Dump  Pass
UUID=abc123-...     /            ext4   errors=remount-ro  0  1
UUID=def456-...     /boot/efi    vfat   umask=0077      0    1
UUID=ghi789-...     /home        ext4   defaults        0    2
tmpfs               /tmp         tmpfs  defaults,size=2G 0   0

Each line specifies: what to mount, where to mount it, filesystem type, options, dump flag, and fsck pass order. Use UUIDs (not device names like /dev/sda1) because device names can change but UUIDs don't.

# Find UUID of a device:
blkid /dev/sda1

# Mount everything in fstab (after editing it):
sudo mount -a

# View all mounted filesystems in readable format:
findmnt --real

File Permissions Quick Reference

$ ls -la /etc/passwd
-rw-r--r-- 1 root root 2345 Jun 01 /etc/passwd

# Breakdown: -rw-r--r--
# -     = file type (- = regular file, d = directory, l = symlink)
# rw-   = owner (root) can read+write, not execute
# r--   = group (root) can read only
# r--   = others can read only

# File type indicators:
$ ls -la /
drwxr-xr-x = directory (d)
lrwxrwxrwx = symbolic link (l)
-rw-r--r-- = regular file (-)
crw-rw-rw- = character device (c)
brw-rw---- = block device (b)
# Find large directories taking up space:
du -sh /* 2>/dev/null | sort -rh | head -10

# Find files changed in the last 24 hours:
find /etc -newer /etc/hostname -ls 2>/dev/null

# Check what package owns a file:
dpkg -S /usr/bin/nginx          # Debian/Ubuntu
rpm -qf /usr/bin/nginx          # Fedora/RHEL/Arch

# See all files installed by a package:
dpkg -L nginx                   # Debian/Ubuntu
rpm -ql nginx                   # Fedora/RHEL

# Navigate quickly:
cd ~            # home directory
cd /            # root
cd -            # last directory
cd /var/log && ls -lt | head  # go there and see newest files

Frequently Asked Questions

Why can't I write to /etc or /usr without sudo?

These directories are owned by root and have permissions that only allow root to write to them. Regular users can read most of them but can't modify system files. This is a security design — you shouldn't be able to accidentally break system configuration or replace system binaries.

Where should I install my own software?

For scripts you write: ~/bin/ (add to PATH in ~/.bashrc) or /usr/local/bin/ (system-wide, requires sudo). For manually compiled software: /usr/local/ is the conventional location (won't conflict with package-managed software). For self-contained applications: /opt/appname/.

What fills up /var/log and how do I clean it?

# Check log sizes:
du -sh /var/log/*

# Truncate systemd journal:
sudo journalctl --vacuum-size=500M   # keep max 500MB of logs
sudo journalctl --vacuum-time=7d     # keep max 7 days of logs

# Clean apt cache:
sudo apt autoclean && sudo apt autoremove    # Ubuntu/Debian

What is /lost+found?

When fsck (filesystem check) repairs a damaged filesystem, it puts recovered files with unknown locations here. It exists at the root of each ext4 filesystem. You'll rarely need to touch it — if you see files there after a crash, they're your data that the filesystem couldn't figure out where to put.

What's the difference between /bin and /usr/bin?

Historically, /bin contained tools needed for single-user recovery mode (when /usr might not be mounted), while /usr/bin held non-essential programs. Modern distributions have merged them — on Ubuntu, Fedora, and Arch, /bin is just a symlink to /usr/bin. This distinction is effectively historical at this point.

Understanding the Linux filesystem tree makes you dramatically more effective at the terminal. Once you know where to look for logs (/var/log), configuration (/etc), and binaries (/usr/bin), you can troubleshoot almost any problem without guessing. Pair this knowledge with our Linux commands cheat sheet for a complete foundation.

Further Reading

Go up