Linux Directory Structure Explained

Open a Linux terminal and run ls / — you'll see directories like etc, proc, sys, var. What do they all mean? Unlike Windows where files go in C:\Program Files or C:\Users, Linux follows a strict standard called the FHS.

The Filesystem Hierarchy Standard (FHS)

Why does Linux have such a specific folder layout? The FHS (Filesystem Hierarchy Standard) defines where every type of file should live. This means any Linux system — Ubuntu, Fedora, Arch — follows the same layout. A sysadmin moving between systems always knows where to look.

/ (root)
├── bin/        → Essential user binaries (ls, cp, mv)
├── boot/       → Kernel and bootloader files
├── dev/        → Device files (disks, terminals)
├── etc/        → System-wide configuration files
├── home/       → User home directories
├── lib/        → Shared libraries for /bin and /sbin
├── media/      → Removable media mount points
├── mnt/        → Temporary manual mounts
├── opt/        → Optional/third-party software
├── proc/       → Virtual: kernel process info (not on disk)
├── root/       → Home directory for root user
├── run/        → Runtime data (PIDs, sockets) — cleared on boot
├── sbin/       → System binaries (for root: fdisk, iptables)
├── srv/        → Data served by services (www, ftp)
├── sys/        → Virtual: kernel hardware info (not on disk)
├── tmp/        → Temporary files — cleared on reboot
├── usr/        → User programs and data (second layer)
└── var/        → Variable data: logs, caches, databases

The Most Important Directories

/etc — Configuration Lives Here

Every system-wide config file lives in /etc. Network config, user accounts, SSH settings, cron jobs — all here. The name historically stands for "etcetera" but now think of it as "everything to configure." Examples: /etc/passwd (users), /etc/fstab (mounts), /etc/nginx/nginx.conf.

/proc — The Kernel's Window (Not Real Files)

/proc is a virtual filesystem. Nothing in it is stored on disk — the kernel generates these files on the fly when you read them. /proc/cpuinfo tells you about your CPU. /proc/1234/ tells you everything about process 1234. /proc/meminfo shows memory usage. This is how tools like top and ps get their data.

/sys — Hardware Exposed as Files

Also virtual, like /proc, but focused on hardware. /sys/class/net/eth0/ contains your network interface details. /sys/block/sda/ describes your disk. You can even write to some of these files to change hardware behavior — like adjusting screen brightness or the I/O scheduler.

/var — Logs, Databases, Mail

Files that grow over time live in /var. /var/log/ holds system logs. /var/lib/ holds application state (databases, package manager info). /var/spool/ holds queued jobs (print queue, mail). When a disk fills up on a server, /var/log/ is often the culprit.

/usr — The "Second Root"

Most user-installed software goes into /usr. /usr/bin/ has most commands (python3, git, vim). /usr/lib/ has their libraries. /usr/share/ has docs and data. /usr/local/ is for software you compile yourself — so package managers don't overwrite it.

/dev — Every Device Is a File

Linux treats hardware as files. /dev/sda is your first hard disk. /dev/null discards anything written to it. /dev/random generates random bytes. /dev/tty is your terminal. This "everything is a file" design lets you use the same tools (read, write, cat) for both files and hardware.

Practical Tips

Where should I put my own scripts or software? /usr/local/bin/ for system-wide scripts you compile yourself. ~/.local/bin/ for per-user scripts. Never drop things in /bin/ or /usr/bin/ — those are managed by your package manager.

Why is /tmp dangerous? On many systems, /tmp is a tmpfs mount — stored in RAM, cleared on reboot. Never store anything important there. Also, it's world-writable, so other users can see files there.