Linux Basic — FHS Directory Hierarchy

5 minute read

FHS Directory Hierarchy

The Filesystem Hierarchy Standard (FHS) defines the purpose of each directory in a Linux system. Understanding FHS means you always know where to look for a config file, log, or binary — on any Linux distribution.

The Root Directory — /

ls /
# bin  boot  dev  etc  home  lib  lib64  lost+found
# media  mnt  opt  proc  root  run  sbin  srv  sys  tmp  usr  var

Every path starts here. There is no drive letter — just /.

Essential Directories

/bin — Essential User Binaries

ls /bin | head -20
# bash  cat  chmod  cp  date  df  echo  grep  ls  mkdir  mv  rm  sh  ...

# /bin contains commands available to ALL users, needed during system boot
# In modern Linux (Ubuntu 22.04+), /bin is a symlink to /usr/bin
ls -la /bin
# lrwxrwxrwx 1 root root 7 ... /bin -> usr/bin

/sbin — System Binaries

ls /sbin | head -10
# fdisk  fsck  ifconfig  init  iptables  mount  reboot  useradd  ...

# /sbin commands are for system administration (usually need root)
# In modern Linux, /sbin → /usr/sbin

/usr — Unix System Resources

ls /usr
# bin  games  include  lib  lib64  local  sbin  share  src

# /usr/bin  — all user commands (ls, grep, python3, etc.)
# /usr/sbin — system admin commands
# /usr/lib  — libraries for programs
# /usr/local — locally installed software (not from package manager)
# /usr/share — architecture-independent data (man pages, icons, locales)

ls /usr/local
# bin  etc  games  include  lib  man  sbin  share  src
# Terraform, kubectl, and other manually installed tools go in /usr/local/bin

/etc — Configuration Files

ls /etc | head -20
# apt  bash.bashrc  crontab  fstab  group  hosts  hostname
# nginx  passwd  resolv.conf  shadow  ssh  sudoers  ...

# Key config files:
cat /etc/hostname          # Machine hostname
cat /etc/hosts             # Static hostname → IP mappings
cat /etc/resolv.conf       # DNS servers
cat /etc/fstab             # Filesystems to mount at boot
cat /etc/passwd            # User accounts (no passwords stored here)
sudo cat /etc/shadow       # Hashed passwords (root only)
cat /etc/group             # Group definitions
sudo cat /etc/sudoers      # sudo permissions

# Service configurations live in their own directories
ls /etc/nginx/             # nginx config
ls /etc/ssh/               # SSH server config
ls /etc/cron.d/            # Cron job files

/home — User Home Directories

ls /home
# alice  ubuntu  bob

# Each user's home contains their personal files and configs
ls -la /home/ubuntu
# drwxr-x--- 7 ubuntu ubuntu 4096 ... .
# -rw-r--r-- 1 ubuntu ubuntu 3526 ... .bashrc
# -rw-r--r-- 1 ubuntu ubuntu  807 ... .profile
# drwxr-xr-x 3 ubuntu ubuntu 4096 ... projects

# Home directory permissions (750): owner full access, group read+exec, others nothing
stat -c "%a %U %G" /home/ubuntu
# 750 ubuntu ubuntu

/root — Root User’s Home

# /root is the home directory of the root user — NOT inside /home
ls -la /root
# (you need sudo to see this)
sudo ls -la /root

echo "Root's home:"
sudo -i -c 'echo $HOME'
# /root

/var — Variable Data

ls /var
# backups  cache  lib  lock  log  mail  run  spool  tmp

# /var/log — system and application logs
ls /var/log
# auth.log  dpkg.log  kern.log  nginx/  syslog  ...

tail -5 /var/log/syslog

# /var/lib — persistent application state
ls /var/lib
# apt  docker  dpkg  postgresql  snapd  ...

# /var/cache — cached data (safe to delete)
ls /var/cache
# apt  debconf  man  ...

# /var/run — runtime data (PID files, sockets)
ls /var/run
# docker.pid  nginx.pid  sshd.pid  ...

/tmp — Temporary Files

ls /tmp
# (random temp files from running applications)

# /tmp is cleared on reboot
# World-writable (any user can write here)
stat -c "%a" /tmp
# 1777  (sticky bit set: users can only delete their own files)

# /tmp use:
temp_file=$(mktemp)            # Create a temp file safely
echo "data" > "$temp_file"
rm "$temp_file"                # Clean up when done

Virtual Filesystems (Not Real Disks)

/proc — Process and Kernel Information

# /proc is NOT a real directory — it's generated by the kernel in RAM

# System-wide info
cat /proc/version           # Kernel version
cat /proc/uptime            # Seconds since boot
cat /proc/meminfo           # Memory statistics
cat /proc/cpuinfo           # CPU information
cat /proc/loadavg           # Load averages

# Per-process info (each PID has its own directory)
ls /proc/1/                 # PID 1 (init/systemd)
# cmdline  cwd  environ  exe  fd  maps  mem  net  stat  ...

cat /proc/1/cmdline | tr '\0' ' '
# /sbin/init

# Get any running process's command line
cat /proc/$(pgrep nginx | head -1)/cmdline | tr '\0' ' '
# nginx: master process /usr/sbin/nginx -g daemon on; master_process on;

/sys — Kernel and Hardware Interface

# /sys exposes kernel parameters and hardware info

# Get CPU info
cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_cur_freq   # Current CPU MHz (÷1000)

# Control power state (advanced)
cat /sys/power/state
# freeze mem disk

# Network interface info
ls /sys/class/net/
# ens3  lo  docker0

cat /sys/class/net/ens3/operstate
# up

/dev — Device Files

ls /dev | head -20
# disk  full  kmsg  mem  null  pts  random  sda  sda1  tty  urandom  zero  ...

# /dev/null  — discard anything written here (the "black hole")
echo "this is discarded" > /dev/null
ls > /dev/null     # Suppress output completely

# /dev/zero  — infinite source of null bytes
dd if=/dev/zero of=/tmp/zeroed-file bs=1M count=10
# Creates a 10 MB file of zeroes

# /dev/random and /dev/urandom — random data sources
head -c 16 /dev/urandom | base64   # Generate 16 random bytes as base64

# Block devices (disks)
ls /dev/sd*    # SATA/SCSI disks and partitions
# /dev/sda  /dev/sda1  /dev/sda2

ls /dev/nvme*  # NVMe SSDs
# /dev/nvme0  /dev/nvme0n1  /dev/nvme0n1p1

Other Important Directories

/opt — Optional Software

# Third-party software that doesn't follow FHS typically installs here
ls /opt
# google  myapp  terraform

# Common /opt pattern: versioned installs with a symlink
ls -la /opt/myapp-v2.3.0/   # The actual install
ls -la /opt/myapp            # → symlink to myapp-v2.3.0

/mnt and /media — Mount Points

# /mnt — temporary mounts (manual)
sudo mount /dev/sdb1 /mnt
ls /mnt/    # Files from /dev/sdb1

# /media — automounted removable media (USB drives, CDs)
ls /media/ubuntu/   # Mounted USB drive appears here

/srv — Service Data

# Data served by the system (web, FTP, etc.)
ls /srv
# www  ftp  git

# nginx serving /srv/www example
# /etc/nginx/sites-available/default → root /srv/www/mysite;

Quick Reference

Directory Purpose
/bin → /usr/bin User commands (ls, grep, python3)
/sbin → /usr/sbin Admin commands (useradd, mount)
/usr All user software and libraries
/usr/local Locally installed software
/etc System-wide configuration files
/home User home directories
/root Root user’s home directory
/var/log Log files
/var/lib Application state/data
/tmp Temporary files (cleared on reboot)
/proc Kernel and process info (virtual)
/sys Hardware and kernel parameters (virtual)
/dev Device files
/opt Optional third-party software
/mnt Manual mount points
/media Automounted removable media

Key Takeaways

  • FHS defines where everything belongs — configuration in /etc, logs in /var/log, user data in /home
  • /bin, /sbin are symlinks to /usr/bin, /usr/sbin on modern distros
  • /proc and /sys are virtual — generated by the kernel, no disk space used
  • /dev/null discards all writes — useful for suppressing command output
  • /tmp is world-writable and cleared on reboot — never store important data here
  • /opt and /usr/local/bin are where manually installed tools (Terraform, kubectl) belong
← Back to Linux File System Overview Next → Absolute vs Relative Paths

Updated:

You may also enjoy