bigonotes
LinuxThe System

The Linux Filesystem Hierarchy

What lives in each top-level Linux directory, and how to tell apart the confusing pairs like /bin and /usr/bin or /mnt and /media.

4 min readLast updated

Linux has one directory tree, and every file lives somewhere under /. Disks, USB drives and even the kernel's view of running processes all appear as directories in that tree. The layout follows the Filesystem Hierarchy Standard (FHS). Once you know it, you can find a config file, a log or a binary on almost any Linux machine.

The top-level directories#

Each top-level directory has one job. The tables below group them by what they hold.

Programs and libraries#

These are the directories you'll look in when you're hunting for a command or a library.

Directory What it holds
/bin Core commands every user needs, such as ls, cp and sh
/sbin Admin commands, such as reboot, fdisk and ip. Most need root.
/lib Shared libraries that the programs in /bin and /sbin load at run time
/usr Most installed software: /usr/bin, /usr/lib, /usr/share (docs, data)
/usr/local Software you build or install yourself, outside the package manager
/opt Self-contained third-party packages, each in its own folder

Configuration, data and state#

When you debug a service, you'll spend most of your time here: config in one place, logs and changing data in another.

Directory What it holds
/etc System-wide config files, such as /etc/passwd (users) and /etc/fstab (mounts)
/var Data that changes while the system runs: logs in /var/log, caches, mail and print queues
/srv Data this machine serves, such as a web or FTP server's files
/tmp Short-lived files any user can write
/run Runtime state since the last boot: PID files, sockets, locks

Users, boot and devices#

The rest cover user files, booting and the hardware itself.

Directory What it holds
/ The root of the tree. Everything branches from here.
/home One folder per user, such as /home/alice, for personal files and settings
/root The home folder of the root user
/boot Files needed to boot: the kernel (vmlinuz), the initramfs and GRUB config
/dev Device files. /dev/sda is a disk; reading and writing it talks to the hardware.
/mnt A place to mount a filesystem by hand, for a short time
/media Mount points for removable media, often created automatically
/proc A virtual filesystem the kernel fills with live process and system data

The last row needs a closer look, because /proc isn't a normal directory. It takes no disk space. Its files are generated when you read them. For example, cat /proc/cpuinfo shows your CPU details, and /proc/<pid>/ holds data about one process.

The confusing pairs#

Reading those tables, you'll notice some directories seem to do the same job. These are the differences that matter.

/bin vs /usr/bin#

The split comes from history. /bin held the small set of tools needed to boot and repair the system. /usr could sit on a separate partition that was mounted later. So /bin had to work alone, and /usr/bin held everything else.

/bin /usr/bin
Original purpose Tools for boot and recovery All other user programs
Available in single-user mode ✓ Not always, on old systems
Examples ls, cp, rm, sh vim, gcc, python3, git

Today many distros (Fedora, Arch, recent Debian and Ubuntu) have merged the two. /bin is a symbolic link to /usr/bin, and /sbin and /lib link into /usr the same way. Run ls -l /bin to check your system.

/root vs /home#

Both are home folders, for different users.

/root /home/<user>
Belongs to The root user Each regular user
Location Directly under / Under /home
Access Root only Each user owns their own folder
Partition On the root partition Often a separate partition

/root stays on the root partition so the admin can still log in if /home fails to mount.

/mnt vs /media#

Both are places to attach (mount) another filesystem. The difference is who mounts it.

/mnt /media
Used for Temporary manual mounts Removable media (USB drives, discs)
Who mounts An admin or a script Often the desktop, automatically
Subfolders Usually empty until you mount something Created per device as it is plugged in

Mount permanent internal disks somewhere of your choice (for example /data) and list them in /etc/fstab. Use /media for removable devices only.

/tmp vs /run vs /var/tmp#

All three hold temporary data, with different lifetimes.

  • /tmp is for short-lived files from any program or user. You can write here without root. Many systems clear it at boot, and some keep it in RAM.
  • /var/tmp is also temporary, but its files survive a reboot.
  • /run is in RAM and is cleared at every boot. System services keep PID files and sockets here. Don't edit it by hand.

/srv#

/srv isn't part of a pair, but it's easy to mix up with /var. It holds the data that this machine serves to others. A web server might keep sites in /srv/www, and an FTP server in /srv/ftp. Distros differ here: many web servers default to /var/www instead.

Key takeaways#

  • Linux has one tree rooted at /. Disks and devices are mounted into it.
  • Config lives in /etc, changing data and logs in /var, user files in /home.
  • /proc is virtual: the kernel generates its files on read.
  • On modern distros /bin, /sbin and /lib are links into /usr.
  • /mnt is for manual temporary mounts. /media is for removable media.
  • /tmp is short-lived and often cleared at boot; /run is runtime state; /var/tmp survives reboots.
Revision notes · 2 min

Core idea#

Linux has one directory tree rooted at /. The Filesystem Hierarchy Standard (FHS) gives each top-level directory one job.

Key directories#

Directory Holds
/bin, /sbin Core commands; admin commands that need root
/lib Shared libraries for core commands
/usr Most installed software
/usr/local Software you build or install yourself
/opt Self-contained third-party packages
/etc System-wide config, such as /etc/passwd and /etc/fstab
/var Changing data: logs in /var/log, caches, queues
/home, /root Regular users' home folders; root's home folder
/boot Kernel, initramfs, GRUB config
/dev Device files, such as /dev/sda
/proc Virtual filesystem of live process and kernel data
/srv Data this machine serves

Confusing pairs#

  • /bin vs /usr/bin: /bin once held boot and repair tools, because /usr could mount later. Modern distros merge them; /bin, /sbin and /lib link into /usr.
  • /root vs /home: /root stays on the root partition, so the admin can log in if /home fails to mount.
  • /mnt vs /media: /mnt for manual temporary mounts by an admin. /media for removable media, often mounted automatically.
  • /tmp: short-lived files any user can write. Often cleared at boot.
  • /var/tmp: temporary, but survives reboots.
  • /run: runtime state in RAM (PID files, sockets). Cleared at every boot.

Pitfalls#

  • Do not edit /run by hand.
  • Do not mount permanent disks under /media. Pick a path such as /data and list it in /etc/fstab.
  • Many web servers default to /var/www, not /srv.

Say it in an interview#

  • "Config is in /etc, logs in /var/log, and /proc is generated by the kernel on read."

Found a mistake? Email ask@bigonotes.com

Further reading#