VMware ESXi and vSphere Cluster Management

Linux File System Structure and the Filesystem Hierarchy Standard

Learn how Linux organizes files, directories, devices, mounted storage, paths, and system data under the root directory using the Filesystem Hierarchy Standard.

Overview: one hierarchy, one root

Linux organizes accessible files and file-like objects in a single directory hierarchy. The top of that hierarchy is the root directory, written as /. Directories, ordinary files, mounted disks, removable media, network filesystems, device interfaces, and kernel-provided information can all appear somewhere below /.

The root directory is not the same thing as the root user. The root user is the privileged administrative account. That account commonly has /root as its home directory. In contrast, / is the top of the entire pathname hierarchy and is not a user's personal directory.

A storage device may physically be a separate disk, partition, USB drive, optical disc, or network filesystem. After it is mounted, Linux attaches it to a directory in the existing hierarchy. Therefore, users address the mounted data through a pathname such as /mnt/data or /home/bob/photos, regardless of which physical device stores the data.

The Filesystem Hierarchy Standard (FHS) is a convention describing the usual purpose of major Linux directories. It helps users, administrators, and software agree on where files belong. The FHS is not an absolute rule: distributions, installation choices, containers, and modern filesystem layouts can vary.

Filesystem objects and the “everything is a file” model

A filesystem is the organized structure through which Linux stores and accesses names, directories, and file objects. Several object types can appear in this structure:

The phrase “everything is a file” describes a useful Unix and Linux design principle: many resources can be accessed through file-like names and operations. For example, device access is represented by special files called device nodes, commonly under /dev. Programs can open and interact with them through kernel drivers.

However, this phrase does not mean every object behaves exactly like a regular text file. A directory has special traversal rules, a socket provides communication, a named pipe transfers data between processes, and entries in /proc or /sys expose dynamic kernel interfaces. Their common naming and permission model is useful, but their behavior differs.

Pathnames and path components

A pathname is a slash-separated address for a filesystem object. For example, /home/bob/documents/notes.txt contains the components home, bob, documents, and notes.txt. The slashes separate components; they are not part of the component names.

Absolute paths

An absolute path begins with / and is resolved from the root directory. It identifies a location independently of the shell's current directory.

/home/bob/documents/notes.txt
/etc/hosts
/var/log

Relative paths

A relative path does not begin with /. The shell resolves it from the current working directory, which is the directory from which relative pathnames are interpreted.

Suppose the current directory is /home/bob:

In this example, the absolute path /home/bob/file.txt and the relative path file.txt refer to the same file. A child path such as documents/notes.txt means /home/bob/documents/notes.txt when run from /home/bob.

The shell expands ~ as shorthand for a user's home directory. It is shell syntax, not a directory literally named ~. The entries . and .. have special meanings for the current directory and its parent directory.

Spaces and special characters

Spaces separate command arguments in the shell. If a pathname contains spaces, quote it or escape each space:

ls "project files"
ls project\ files
cat "$HOME/project files/notes.txt"

Quoting also helps prevent shell expansion of characters that have special meanings. When possible, simple names without spaces or shell metacharacters are easier to use in scripts.

Current working directory and navigation

The shell remembers a current working directory for each session. Commands use it when given relative paths, so checking it is a useful first troubleshooting step.

pwd
ls
cd /etc
pwd
cd ..
cd ~
cd /

• pwd prints the current working directory.
• ls lists the contents of a directory. With no argument, it lists the current directory.
• cd /etc changes directory using an absolute path.
• cd .. moves to the parent directory.
• cd ~ changes to the current user's home directory.
• cd with no argument normally also returns to the current user's home directory.
• cd / moves to the root directory.

Names beginning with a period are hidden files or hidden directories by convention. Ordinary ls output omits them. Use ls -la to display hidden entries and metadata:

ls -la ~

Entries named . and .. appear in this detailed listing. A hidden configuration directory might look like ~/.config, while a hidden configuration file might look like ~/.profile. Hidden does not mean protected or encrypted; it only changes ordinary listing behavior.

Common top-level Linux directories

The following table describes conventional purposes. Exact contents differ between distributions and installations. Some modern systems use usr merge, in which directories such as /bin and /lib are symbolic links to directories under /usr.

Understanding /usr, /bin, and /sbin

Historically, /bin contained commands considered essential, while /usr/bin contained many other user commands. Similarly, /sbin was associated with system-administration commands and /usr/sbin with additional administrative programs.

Modern distributions commonly use usr merge. In such a layout, /bin may be a symbolic link to /usr/bin, and /sbin may be a symbolic link to /usr/sbin. The distinction remains useful for understanding conventions, but you should inspect the current system rather than assume that these are separate physical directories.

stat /bin
readlink -f /bin
stat /sbin
readlink -f /sbin

Mount points: connecting storage to the hierarchy

A mount point is a directory where another filesystem is attached to the existing hierarchy. Partitions, external drives, optical media, and network filesystems can all be mounted this way.

A device node and a mounted filesystem are different things. For example, /dev/sda can represent a whole storage device, while a partition might be represented by /dev/sda1. Neither path is normally where you browse the partition's files. After the partition is mounted, its usable contents might be visible at /mnt/data.

lsblk
findmnt
df -h

• lsblk displays block devices and often shows their filesystem and mount relationships.
• findmnt displays active filesystems and their mount points.
• df -h reports mounted filesystem capacity in human-readable units.

When a filesystem is mounted on a directory that already contains files, the mounted filesystem's contents become visible at that path. The previous contents are not necessarily deleted; they are hidden while the mount remains active. After unmounting, the underlying directory contents become visible again.

Safe inspection and beginner boundaries

Inspect system locations before changing them. Ownership and permissions determine who may read, modify, or execute an object. Many system directories are owned by root and require elevated privileges for changes. Administrative privileges bypass important safety barriers, so use them only when the task is understood and necessary.

• Do not manually delete files from /bin, /lib, /usr, or /etc. Use the distribution's package and configuration tools when appropriate.
• Do not delete or modify entries in /dev as if they were ordinary files.
• Do not treat /proc or /sys as ordinary on-disk storage. Some entries are readable views; others expose controls that can affect the running kernel.
• Use your home directory for personal files and persistent user configuration.
• Do not rely on /tmp for permanent data because cleanup may occur at reboot or earlier.

Useful inspection commands include:

pwd
ls -la /
ls -ld /etc /home /tmp
ls -la /var/log
findmnt
lsblk

Reading a directory does not necessarily grant permission to read every file inside it. Likewise, seeing a device or mount point does not guarantee that your account can access its contents.

Troubleshooting common path and filesystem problems

A relative filename cannot be found

First check the current working directory, then inspect the expected directory including hidden names:

pwd
ls -la
ls -la /absolute/path/to/the/parent

Common causes include being in a different directory, using the wrong letter case, omitting a directory component, or forgetting that a name beginning with a period is hidden. Use an absolute path to verify the intended object.

A command expected in /bin appears under /usr/bin

The distribution may use usr merge, so /bin may be a symbolic link:

stat /bin
readlink -f /bin

Use the layout on the current system as the authority. Do not assume that every distribution keeps separate copies.

A disk appears in /dev, but its files are not visible

The device or partition may not be mounted, it may be mounted elsewhere, or it may not contain a recognized filesystem. Inspect without modifying the device:

lsblk
findmnt

Permission restrictions can also prevent access. Never experiment by writing to an unfamiliar device node.

A user cannot create a file in a system directory

The directory may be owned by root, have restrictive permissions, or belong to a read-only mounted filesystem. Inspect the directory:

ls -ld /etc /var/log /usr

Place personal files in a user-writable location such as the home directory. If an administrative change is genuinely required, understand the change before using elevated privileges.

Data disappears from /tmp

Temporary files may be removed by a cleanup service, during boot, or after reaching an age limit. Some systems mount /tmp in memory. Store persistent data under the home directory or another location intended for long-term storage.

Exam-relevant summary

• / is the root directory, the top of the Linux pathname hierarchy.
• /root is commonly the root user's home directory; it is not the root directory.
• An absolute path starts with /; a relative path starts from the current working directory.
• . means the current directory, .. means the parent, and ~ expands to a user's home directory.
• /etc usually contains host-specific system configuration, /var contains changing data, and /home contains regular users' home directories.
• /dev contains device nodes, while a mount point such as /mnt/data exposes the files of a mounted filesystem.
• /proc and /sys are virtual filesystems generated by the kernel or system, not ordinary persistent disk storage.
• /usr contains much installed software and shared resources; usr merge may make /bin, /sbin, and library paths link into /usr.
• Use pwd, ls, findmnt, df -h, and lsblk to inspect before making changes.

For a related refresher on this topic, see Linux file structure.