Linux Fundamentals, June 2021

Understanding the Linux File System Hierarchy

Coming from other systems, the Linux directory layout can look arbitrary, a scatter of short cryptic names at the root, but it follows a deliberate standard, the Filesystem Hierarchy Standard, and every top level directory has a defined purpose. The single most important idea is that Linux presents everything as one unified tree rooted at the slash, with no drive letters, so additional disks, partitions, and even network shares are attached at directories within that single tree rather than appearing as separate volumes. Learning what each top level directory is for turns the layout from a memorization exercise into a map you can reason about.

PATHPURPOSE
/etcSystem wide configuration files, text based and meant to be edited.
/varVariable data that changes at runtime, logs, spools, caches, databases.
/homeThe personal directories of users and their per user configuration.
/usrInstalled software and its files, the bulk of the programs and libraries.
/bin, /sbinEssential command binaries, with sbin for those meant for the administrator.
/tmpTemporary files, often cleared on reboot, writable by all.
/devDevice files, the interface through which hardware appears as files.
/proc, /sysVirtual filesystems exposing kernel and process state as readable files.

Two of those entries reveal a defining principle of Unix design, that almost everything is presented as a file. The /dev directory contains device files, so a disk, a serial port, or the source of random bytes is accessed through the same read and write operations as an ordinary file, which is why you can, for instance, write a disk image directly to a device. The /proc and /sys directories go further, they are virtual filesystems that exist on no disk, they are the kernel exposing its own internal state and that of every running process as files you can read, so the details of a process, its memory maps, its open files, its status, are all readable under /proc by its process ID. This is not a gimmick, it is what lets ordinary text tools inspect and even adjust the running kernel.

The practical payoff of knowing this layout is that you always know where to look. Configuration lives in /etc, so that is where you go to change how the system behaves. Logs and other growing data live in /var, which is why a full /var is a classic cause of a system that suddenly stops working, and knowing that sends you straight to /var/log rather than hunting. Software lives under /usr, temporary scratch space under /tmp. The hierarchy is a convention rather than a technical necessity, but it is a convention followed consistently enough across distributions that an engineer who has internalized it can sit down at an unfamiliar machine and know, without being told, where its configuration, its logs, and its programs will be found, which is precisely the kind of transferable knowledge that makes the layout worth learning properly.