Linux is built around a simple but powerful concept: everything is organized under a single directory tree.

Whether you are working with Ubuntu, Debian, RHEL, CentOS, Fedora, Amazon Linux, or another Linux distribution, you will encounter directories such as /etc, /var, /usr, /home, /tmp, /dev, and /proc.

Understanding these directories is fundamental for:

• Linux administration

• DevOps

• Docker and Kubernetes

• Cloud engineering

• Troubleshooting

• Security

• Application deployment

• System performance analysis

The Linux directory structure follows conventions described by the Filesystem Hierarchy Standard (FHS), although individual distributions and modern Linux systems can differ in their exact implementation.

1. Linux Directory Structure

The Linux filesystem starts from a single root directory:

/

Unlike Windows, Linux does not normally use drive letters such as C:\ or D:\ to represent the primary filesystem hierarchy.

A simplified Linux filesystem looks like this:

/
├── bin
├── boot
├── dev
├── etc
├── home
├── lib
├── media
├── mnt
├── opt
├── proc
├── root
├── run
├── sbin
├── srv
├── sys
├── tmp
├── usr
└── var

The / directory is called the root directory. It is the starting point of the entire filesystem tree.

Important: / and /root are different.

/ = filesystem root
/root = home directory of the root user

2. / — Root Directory

The root directory is the top-level directory of the Linux filesystem.

/

Everything else exists below it.

For example:

/
├── etc
├── home
├── var
└── usr

You can move to the root directory with:

cd /

List its contents:

ls

For a detailed listing:

ls -lah /

The root filesystem contains the directories required to operate the system and provide the basic filesystem hierarchy.

3. /bin — Essential User Commands

Historically, /bin contained essential executable commands required for normal system operation and recovery.

Examples traditionally associated with this location include:

/bin/ls
/bin/cp
/bin/mv
/bin/cat
/bin/sh

However, modern Linux distributions may merge /bin with /usr/bin.

For example, on many modern systems:

ls -ld /bin

may show that /bin is a symbolic link to another location.

Therefore, do not assume that /bin is always a physically separate directory.

4. /boot — Boot Files

The /boot directory contains files required during the system boot process.

Typical contents may include:

/boot/
├── vmlinuz-...
├── initrd.img-...
├── grub/
└── config-...

The Linux kernel and initial RAM filesystem are commonly stored here.

You can inspect it using:

ls -lah /boot

Why is /boot important?

During startup, the bootloader loads the kernel and initial filesystem needed to begin the Linux boot process.

If /boot becomes corrupted or important boot files are removed, the system may fail to boot.

5. /dev — Device Files

Linux represents many hardware and kernel devices through files under /dev.

Examples:

/dev/sda
/dev/nvme0n1
/dev/null
/dev/zero
/dev/random
/dev/tty

For example:

ls -lah /dev

Example: /dev/null

/dev/null is a special device that discards anything written to it.

echo "Hello" > /dev/null

The output disappears.

A common DevOps example is:

command > /dev/null 2>&1

This redirects both standard output and standard error to /dev/null.

6. /etc — System Configuration

/etc is one of the most important directories for Linux administrators.

It contains system and application configuration files.

Examples include:

/etc/hosts
/etc/hostname
/etc/fstab
/etc/passwd
/etc/group
/etc/shadow
/etc/ssh/
/etc/systemd/
/etc/nginx/

For example:

cat /etc/hostname

displays the system hostname.

Check configured files:

ls -lah /etc

Important files

The FHS describes /etc as the location for host-specific system configuration.

7. /home — User Home Directories

/home normally contains the home directories of regular users.

Example:

/home
├── alice
├── bob
└── shubhankar

A user might have:

/home/shubhankar/

Inside the directory:

/home/shubhankar/
├── Documents
├── Downloads
├── Pictures
├── Videos
└── projects

You can find your current home directory using:

echo $HOME

or:

pwd

after logging in.

To move there:

cd ~

The ~ character represents the current user's home directory.

8. /lib — System Libraries

/lib traditionally contains essential shared libraries required by programs in the root filesystem.

For example:

/lib
/lib64

Depending on the Linux distribution and architecture, these directories may contain shared libraries and kernel modules.

You can inspect:

ls -lah /lib

Modern distributions may also use merged /usr layouts, so /lib may be a symbolic link.

9. /media — Removable Media

/media is commonly used as a mount point for removable media.

For example:

/media/user/USB
/media/user/MyDrive

When a desktop Linux system automatically mounts a USB drive, it may appear somewhere under /media.

Check mounted filesystems:

mount

or preferably:

findmnt

10. /mnt — Temporary Mount Point

/mnt is traditionally used as a temporary mount point.

For example:

sudo mount /dev/sdb1 /mnt

After mounting:

ls -lah /mnt

You can access the filesystem mounted there.

Unlike /media, which is commonly associated with removable media, /mnt is generally used by administrators for temporary filesystem mounts.

11. /opt — Optional / Add-on Software

/opt is intended for add-on application software packages.

For example:

/opt/application/
/opt/company-tool/
/opt/custom-software/

An organization might install a third-party application under:

/opt/myapplication

This keeps that application separate from the distribution's normal package hierarchy.

The FHS defines /opt for add-on application software packages.

12. /proc — Process and Kernel Information

/proc is very different from a normal directory.

It is a virtual filesystem that exposes information about running processes and the Linux kernel.

Examples:

/proc/cpuinfo
/proc/meminfo
/proc/loadavg
/proc/uptime
/proc/<PID>/

Check CPU information:

cat /proc/cpuinfo

Check memory:

cat /proc/meminfo

Check system uptime:

cat /proc/uptime

You can also inspect a process:

ls /proc/1

Here 1 normally represents the process with PID 1.

Linux's proc filesystem provides information about processes and the kernel.

13. /root — Root User's Home Directory

/root is normally the home directory of the root user.

It is not the same as /.

/       → filesystem root
/root   → root user's home

For example:

sudo ls -lah /root

Access may be restricted for normal users.

14. /run — Runtime System Data

/run contains runtime information created since the system booted.

Examples can include:

/run/
├── systemd/
├── lock/
├── user/
└── ...

Applications and services can place runtime state here.

Unlike persistent configuration, runtime information is generally temporary and associated with the current boot.

The Linux hier(7) documentation describes /run as containing information describing the system since it was booted.

15. /sbin — System Administration Commands

Historically, /sbin contained system administration commands, particularly commands associated with booting and system repair.

Modern Linux distributions may merge /sbin with /usr/sbin.

You may encounter commands such as:

/sbin/fsck
/sbin/mount
/sbin/reboot

The exact layout depends on the distribution.

16. /srv — Service Data

/srv is intended for data served by the system.

For example, a server might use:

/srv/www/
/srv/ftp/

The purpose is to provide a conventional location for service-specific data.

The exact use of /srv varies between systems.

17. /sys — Kernel and Device Information

/sys is another virtual filesystem.

It exposes structured information about devices, drivers, buses, and other kernel objects.

For example:

ls /sys

You may find:

/sys/block
/sys/bus
/sys/class
/sys/devices
/sys/firmware

For example:

ls /sys/class/net

can show network interfaces known through the kernel's device model.

The sysfs documentation describes /sys as a filesystem exposing kernel device and subsystem information.

18. /tmp — Temporary Files

/tmp is used for temporary files.

Example:

echo "temporary data" > /tmp/example.txt

Check it:

cat /tmp/example.txt

Temporary files may be removed automatically depending on the system's configuration and lifecycle policies.

Therefore, /tmp should not be used for important persistent application data.

The FHS describes /tmp as a location for temporary files.

19. /usr — User Applications and Shared Data

/usr is one of the largest directories on a typical Linux installation.

A simplified structure is:

/usr
├── bin
├── lib
├── libexec
├── local
├── sbin
├── share
└── src

Important subdirectories include:

/usr/bin

Contains most user executable programs.

Examples:

/usr/bin/python3
/usr/bin/git
/usr/bin/curl

/usr/sbin

Contains system administration programs that are not necessarily required for the earliest boot process.

/usr/lib

Contains libraries and other program support files.

/usr/share

Contains architecture-independent shared data.

Examples:

/usr/share/doc
/usr/share/man
/usr/share/locale
/usr/share/zoneinfo

/usr/local

Used for software installed locally by the administrator or organization.

For example:

/usr/local/bin
/usr/local/lib
/usr/local/share

The FHS defines /usr as a major hierarchy containing user commands, libraries, local software, system binaries, and architecture-independent shared data.

20. /var — Variable Data

/var contains data that changes during normal system operation.

This makes /var particularly important when troubleshooting Linux servers.

A simplified structure:

/var
├── cache
├── lib
├── log
├── local
├── mail
├── opt
├── spool
└── tmp

/var/log

Contains system and application logs.

Examples may include:

/var/log/syslog
/var/log/auth.log
/var/log/kern.log

Depending on the distribution and logging configuration, the exact files vary.

Check disk usage:

sudo du -sh /var/log/*

This is extremely useful when a server's disk suddenly becomes full.

/var/lib

Contains persistent variable state used by applications and system services.

For example:

/var/lib/docker
/var/lib/postgresql
/var/lib/systemd

Application-specific directories under /var/lib can contain important persistent state.

/var/cache

Contains cached application data.

Cache data can often be regenerated by the application.

/var/spool

Contains queued or spooled data.

Examples include mail, printing, and scheduled-job related queues.

The FHS describes /var as containing files whose contents or size may change during system operation, including logs, caches, state data, and spool data.

21. Important Linux Directories at a Glance

22. Static vs Variable Data

One of the important ideas behind the Linux filesystem hierarchy is the separation of relatively static data from data that changes frequently.

Conceptually:

Static / relatively stable
        │
        ├── /usr
        ├── /opt
        └── /etc

Variable / changing
        │
        ├── /var
        ├── /run
        └── /tmp

The FHS was designed partly around separating static and variable data so that they could be managed differently, including through different mounting and backup strategies.

23. How to Explore the Linux Directory Structure

Linux provides several commands for exploring the filesystem.

List directories

ls /

Detailed listing

ls -lah /

Display current directory

pwd

Change directory

cd /etc

Display directory tree

If tree is installed:

tree -L 2 /

Because / contains many system paths, a more practical command is:

tree -L 2 /etc

24. Finding Files

The find command searches a directory hierarchy.

For example:

find /etc -name "*.conf"

Find all Python files:

find /home -name "*.py"

Find files larger than 1 GB:

find / -type f -size +1G 2>/dev/null

The GNU find utility evaluates expressions while traversing a directory hierarchy.

25. Understanding Disk Usage

One of the most useful commands for Linux administrators is du.

Check the size of a directory:

du -sh /var

Check individual directories:

du -sh /var/*

Find the largest directories:

sudo du -xh /var | sort -h | tail -20

For overall filesystem capacity:

df -h

Difference between df and du

df
│
└── Filesystem-level disk usage

du
│
└── Directory/file-level disk usage

This distinction is very important during disk-space troubleshooting.

26. Linux Directory Structure in DevOps

Understanding Linux directories becomes even more important in DevOps.

Consider a web application:

/etc/nginx/
        │
        └── Nginx configuration

/var/log/nginx/
        │
        └── Nginx logs

/var/www/
        │
        └── Application/web content

/var/lib/
        │
        └── Persistent application state

/tmp/
        │
        └── Temporary files

/usr/bin/
        │
        └── Executable programs

A DevOps engineer troubleshooting a production server may need to inspect all of these locations.

27. Linux Directories and Docker

The Linux filesystem hierarchy is particularly important when working with Docker.

For example, Docker commonly stores persistent state under:

/var/lib/docker

You can inspect its size with:

sudo du -sh /var/lib/docker

Docker containers also have their own filesystem hierarchy.

For example:

docker exec -it <container> bash

Then:

ls /

You will see a Linux-like filesystem inside the container.

However, the container's filesystem is isolated from the host unless you explicitly mount directories or volumes.

28. Linux Directories and Kubernetes

Kubernetes workloads also depend heavily on Linux filesystem concepts.

For example:

Container
   │
   ├── /etc
   │     └── configuration
   │
   ├── /tmp
   │     └── temporary data
   │
   ├── /var
   │     └── application state/logs
   │
   └── /app
         └── application code

Kubernetes volumes can be mounted into specific paths:

volumeMounts:
  - name: application-data
    mountPath: /app/data

The application then sees:

/app/data

as part of its filesystem.

Understanding Linux paths, mount points, permissions, ownership, and filesystem behavior therefore becomes essential when debugging Kubernetes containers.

29. Symbolic Links

Linux directories may contain symbolic links.

Check them using:

ls -l /

For example, on systems using a merged /usr layout you may encounter relationships such as:

/bin  -> /usr/bin
/sbin -> /usr/sbin
/lib  -> /usr/lib

This is one reason you should inspect the actual system rather than assuming every Linux distribution has exactly the same physical directory layout.

The Linux manual explicitly notes that different distributions and systems can be configured differently.

30. Mount Points

A Linux directory can act as a mount point for another filesystem.

For example:

/
├── home
├── var
└── data

/data could represent a separate disk or filesystem.

Check mounts with:

findmnt

or:

lsblk -f

You can also inspect:

cat /etc/fstab

for persistent mount configuration.

This concept is especially important for:

• Databases

• Docker

• Kubernetes

• Cloud servers

• Storage systems

• Backup systems

31. Practical Troubleshooting Example

Imagine a Linux server reports:

No space left on device

A good investigation might begin with:

df -h

Suppose /var is consuming most of the available space.

Then:

sudo du -sh /var/*

Suppose /var/log is large:

sudo du -sh /var/log/*

You can then investigate individual log files.

This is much better than randomly deleting files.

Never blindly delete files from /etc, /usr, /var/lib, /boot, or other system directories.

First understand what the file belongs to and which service manages it.

32. A Simple Mental Model

A useful way to remember the Linux filesystem is:

/
│
├── boot     → Start Linux
├── dev      → Devices
├── etc      → Configuration
├── home     → Users
├── proc     → Processes / kernel view
├── root     → Root user's home
├── run      → Runtime information
├── sys      → Kernel/device model
├── tmp      → Temporary files
├── usr      → Programs and shared data
└── var      → Changing application/system data

Remember this relationship:

/etc  → "How is the system configured?"

/var  → "What is changing or being stored?"

/usr  → "What software and shared data are installed?"

/home → "What belongs to regular users?"

/tmp  → "What is temporary?"

/proc → "What is the kernel/process state?"

/sys  → "What does the kernel know about devices?"

/dev  → "What devices are exposed to userspace?"

33. Interview Questions

Q1. What is /etc used for?

/etc contains host-specific system configuration files.

Q2. What is the difference between / and /root?

/ is the root of the entire filesystem hierarchy.

/root is normally the home directory of the root user.

Q3. What is /var used for?

/var contains variable data such as logs, caches, application state, and spool data.

Q4. What is /proc?

/proc is a virtual filesystem that exposes information about processes and the Linux kernel.

Q5. What is /sys?

/sys is a virtual filesystem exposing structured information about kernel devices, drivers, buses, and related kernel objects.

Q6. What is the difference between /tmp and /var/tmp?

Both are intended for temporary data, but they have different lifecycle expectations. /tmp is intended for temporary files that can be removed relatively aggressively, while /var/tmp is intended for temporary files that may need to persist longer.

Q7. What is /usr?

/usr is a major filesystem hierarchy containing user commands, libraries, shared data, and other installed software.

Q8. What is /opt?

/opt is intended for add-on application software packages.

Q9. How do you find which directory is consuming disk space?

Start with:

df -h

Then use:

du -sh /path/*

to investigate directory-level usage.

Q10. How do you find a file in Linux?

Use:

find /path -name "filename"

For example:

find /etc -name "*.conf"

34. Conclusion

The Linux filesystem hierarchy is more than a collection of directories. It provides a structured way to organize:

• System configuration

• User data

• Applications

• Libraries

• Logs

• Runtime information

• Devices

• Kernel interfaces

• Temporary files

• Persistent application state

For someone learning Linux, DevOps, Docker, Kubernetes, or Cloud Engineering, understanding this hierarchy is foundational.

The most important directories to master first are:

/etc      → Configuration
/home     → User data
/var      → Variable data and logs
/usr      → Applications and shared data
/tmp      → Temporary files
/dev      → Devices
/proc     → Processes/kernel information
/sys      → Kernel/device information
/boot     → Boot files
/opt      → Add-on software

Once you understand these directories, Linux troubleshooting becomes much more intuitive because you can reason about where configuration, executable code, runtime state, logs, user data, and system interfaces are expected to live.

References

• Linux hier(7) manual — filesystem hierarchy.

• Linux file-hierarchy(7) manual — systemd filesystem hierarchy.

• Linux Foundation — Filesystem Hierarchy Standard 3.0.

• GNU/Linux find(1) manual — searching directory hierarchies.