Filesystem Hierarchy Standard (FHS) in Linux
Learn the Linux Filesystem Hierarchy Standard (FHS), including the purpose of /etc, /usr, /var, /home, /boot, /dev, /proc, /sys, and other directories.
The Filesystem Hierarchy Standard (FHS) describes conventional directory names and file locations on Unix-like systems. It helps Linux users and administrators predict where to find programs, configuration files, logs, libraries, user data, boot files, and temporary information.
Linux distributions generally follow the FHS, but they may implement details differently. A distribution can add directories, place some directories on separate filesystems, or use symbolic links while preserving the overall hierarchy.
What the Filesystem Hierarchy Standard Does
FHS specifies the expected layout of the filesystem and the kinds of data normally stored in each location. Standardized locations improve:
- Portability: software can expect configuration, executable, and library paths to follow familiar conventions.
- Administration: system administrators know where to look for logs, persistent data, boot files, and configuration.
- Documentation and support: instructions can refer to conventional locations that exist on many distributions.
- Software packaging: package managers can place files consistently and track their purpose.
FHS developed from the earlier FSSTND, or Filesystem Standard. FSSTND was an earlier effort to define a common Unix filesystem layout; FHS extended and refined that approach.
The Root Directory: /
The slash character by itself, /, names the root directory. It is the top of the entire filesystem tree. Every file and directory is reached through a path that begins at, or ultimately connects to, /.
The root directory is not the same as the root user. The root user is the privileged administrative account, and that account normally has /root as its home directory. Thus, /root is one directory inside /.
An absolute path starts at the root directory. Examples include /etc/hosts, /home/alex, and /var/log. A relative path is interpreted from the current working directory.
pwd
ls -la /
ls -la /etc/hostspwd shows where you are. Listing / displays the top-level directories without changing anything.
Main Linux Directories
| Directory | Primary purpose | Typical contents | Important cautions or notes |
|---|---|---|---|
/ | Top of the filesystem hierarchy | Directories such as /etc, /usr, and /var | It is the filesystem root, not the root user's home |
/boot | Boot-related files | Bootloader files, kernel images, and initial RAM filesystem files | Changes can prevent the system from booting |
/bin | Traditional location for essential user commands | Basic commands needed for normal operation and recovery | Often a symbolic link into /usr/bin on modern systems |
/sbin | Traditional location for essential system-administration commands | Commands used for system repair, setup, and administration | Often a symbolic link into /usr/sbin |
/dev | Device interfaces | Device nodes for disks, terminals, /dev/null, and pseudo-devices | Device nodes are special interfaces, not ordinary copies of hardware data |
/etc | Host-specific, system-wide configuration | /etc/hosts, service configuration, user and network settings | Editing files can change system behavior; make backups and follow documentation |
/home | Parent directory for regular users' home directories | /home/alex, personal files, and user configuration | Exact home-directory arrangement can vary |
/lib and /lib64 | Essential libraries and, where applicable, kernel modules | Shared libraries and architecture-specific library files | Often linked into /usr/lib on merged-/usr systems |
/media | Conventional mount location for removable media | Mounted USB drives, memory cards, and optical media | It may be empty, and desktop environments may choose another path |
/mnt | Temporary mount location for administrators | Manually mounted disks or filesystems used for maintenance | It is a convention, not an automatic guarantee that media appears there |
/opt | Optional or self-contained third-party software | Application directories installed outside normal distribution locations | Package and vendor conventions determine its contents |
/proc | Kernel-provided process and system information | Process directories and files such as /proc/cpuinfo | It is a virtual filesystem generated dynamically |
/root | Home directory of the root account | Administrative user's shell files and personal data | Distinct from / and usually inaccessible to regular users |
/run | Volatile runtime state created since boot | PID files, Unix sockets, locks, and service state | Much of its content normally disappears during reboot |
/sys | Kernel device and subsystem information | Device, driver, bus, and hardware-related interfaces | It is a virtual filesystem; do not treat it as ordinary stored files |
/tmp | Shared temporary-file storage | Short-lived files created by users and programs | Contents may be cleaned automatically or removed during reboot |
/usr | Most installed user commands, applications, libraries, documentation, and shared read-only data | /usr/bin, /usr/lib, /usr/share, and /usr/local | Do not casually modify files managed by the package system |
/var | Data that changes during normal operation | Logs, caches, package state, queues, spools, and application state | Unexpected growth can fill a filesystem |
Core System Directories
/boot
/boot contains files needed early in the boot process. Common contents include bootloader support files, Linux kernel images, and initramfs files. An initramfs, or initial RAM filesystem, is a temporary filesystem loaded during startup so the kernel can find devices and continue booting.
ls -la /bootListing is safe, but deleting or replacing boot files without understanding the bootloader and installed kernels can make a system unbootable.
/bin and /sbin
In the traditional layout, /bin held essential commands for users and basic recovery, while /sbin held essential system-administration commands. Examples of commands historically associated with these roles include ls, cp, and system repair or setup tools.
The distinction is useful for understanding older documentation, but modern distributions often use a merged-/usr layout.
/lib and /lib64
A shared library is reusable program code loaded by executable programs. Essential shared libraries belong in the library directories needed by programs in the essential command directories. Kernel modules may also be stored in an appropriate library hierarchy.
/etc
/etc stores host-specific, system-wide configuration. For example, /etc/hosts contains local hostname mappings. Service configuration, account-related configuration, and network settings are also commonly found below /etc.
ls -la /etc
ls -l /etc/hostsDevices, Runtime Data, and Virtual Filesystems
/dev: device nodes
/dev contains device nodes. A device node is a special filesystem entry that provides a kernel-mediated interface to hardware or a pseudo-device. For example, /dev/null accepts discarded output, while disk device nodes provide interfaces to storage devices.
These entries are not ordinary files containing a copy of the device's data. Reading or writing one invokes behavior supplied by the kernel and device driver.
/proc: process and kernel information
/proc is a virtual filesystem. Its contents are generated from live kernel state rather than stored like ordinary files. Numbered directories commonly represent running processes, and files such as /proc/cpuinfo expose system information.
/sys: devices and subsystems
/sys is another virtual filesystem. It exposes kernel information about devices, drivers, buses, and other subsystems. Some entries can be used as administrative interfaces, but changes should only be made through documented procedures.
/run: volatile runtime state
Volatile data is temporary data that normally does not survive a reboot. /run is commonly used for service PID files, sockets, locks, and other state created after boot.
stat /dev/null /proc/cpuinfo /sys
ls -la /runstat helps compare a device node, a virtual file, and a virtual directory. The displayed type and metadata do not mean all three behave like ordinary regular files.
User, Application, and Shared-Data Directories
/home and /root
/home is the usual parent for regular users' home directories. A user named alex might have /home/alex as a home directory. Personal documents and user-specific configuration normally belong there.
/root is normally the home directory of the root account. It is not the top of the filesystem. The distinction is important:
/means the root directory./rootmeans the root user's home directory.
/usr
/usr contains most installed user commands, applications, libraries, documentation, and shared read-only data.
/usr/bin: most user commands and executable programs./usr/sbin: system-administration programs that are not necessarily part of the minimal boot environment./usr/lib: libraries and supporting program files./usr/share: architecture-independent data such as documentation, locale data, icons, and other shared resources./usr/local: software installed locally by an administrator or organization, conventionally outside the distribution package manager's ownership. It commonly contains its ownbin,lib, andsharedirectories.
/opt
/opt is a conventional location for optional or self-contained third-party application packages. A vendor may place an application in a directory such as /opt/application-name rather than distributing its files throughout the standard system directories.
Variable, Temporary, and Mounted Content
/var
/var stores data expected to change during normal operation. Common examples include:
/var/log: system and application logs.- Package-management databases and downloaded package data.
- Caches used to speed up later operations.
- Spools and queues for mail, printing, or scheduled work.
- Application state that must persist beyond a single process or session.
A rapidly growing /var directory can consume the space on the filesystem containing it, especially through logs, caches, or application data.
/tmp
/tmp is a shared location for temporary files. Programs should not assume that files placed there will remain indefinitely. Cleanup policies may remove old files, and a reboot may clear some or all of the directory.
Use a home directory or an application-specific persistent location under /var when data must survive cleanup.
/media, /mnt, and mount points
A mount point is a directory where another filesystem is attached to the main directory tree. After a filesystem is mounted at /mnt/example, its contents are accessed through that path.
/media is conventionally used for removable media, often by desktop or automount software. /mnt is conventionally used by administrators for temporary manual mounts. Neither directory guarantees that a particular drive is present.
findmnt
df -hT
mount | column -tfindmnt is usually the easiest of these commands to read. df -hT shows space usage, filesystem types, and mount locations. The mount command provides another view; its output can be extensive.
Traditional Paths and the Modern Merged-/usr Layout
Historically, /bin, /sbin, and /lib held essential files separate from the broader contents of /usr/bin, /usr/sbin, and /usr/lib. Many current distributions use usr merge: the traditional top-level directories are symbolic links to corresponding locations under /usr.
| Traditional path | Traditional role | Common modern implementation | Learner takeaway |
|---|---|---|---|
/bin and /usr/bin | Essential commands versus most installed user commands | /bin may be a symbolic link to /usr/bin | Both names remain useful when reading documentation |
/sbin and /usr/sbin | Essential administration commands versus other administration commands | /sbin may link to /usr/sbin | The functional distinction may be less visible on modern systems |
/lib and /usr/lib | Essential libraries versus general program libraries | /lib may link to /usr/lib; architecture-specific links may also exist | Use the system's actual paths when inspecting files |
command -v ls cp mount
ls -ld /bin /sbin /lib
readlink -f /bin /sbin /libcommand -v shows the executable path selected by the shell. readlink -f resolves symbolic links to their final destinations. A merged-/usr system may report paths under /usr, even when traditional documentation refers to /bin or /sbin.
Persistent, Variable, Temporary, and Virtual Data
| Location | Data behavior | Examples | Expected reboot behavior |
|---|---|---|---|
/etc | Persistent system configuration | Host, service, and network configuration | Normally remains |
/home | Persistent user data | Documents and user settings | Normally remains |
/usr | Mostly installed, relatively stable shared data | Programs, libraries, and documentation | Normally remains |
/var | Persistent but frequently changing data | Logs, caches, queues, and application state | Usually remains, subject to cleanup policies |
/tmp | Temporary shared data | Short-lived working files | May be cleaned or cleared |
/run | Volatile runtime state | PID files, sockets, and service state | Normally recreated during boot |
/proc | Live virtual kernel and process data | Process directories and CPU information | Recreated dynamically |
/sys | Live virtual device and subsystem data | Driver and hardware interfaces | Recreated dynamically |
Safe Filesystem Exploration
Start by checking your location, then inspect directories with listing and identification commands. These operations do not modify the files they examine.
pwd
ls -la /
ls -la /boot /etc /home /usr /var
stat /dev/null /proc/cpuinfo /sys
findmnt
df -hT- List a directory:
ls -la /etcshows entries, permissions, ownership, hidden files, and symbolic-link targets. - Identify a file type:
statdisplays metadata and distinguishes special entries from ordinary files. A dedicated file-type command can also be useful. - Check mounted filesystems:
findmnt,df -hT, andmount | column -tshow mount relationships and usage. - Resolve symbolic links:
readlink -f /binfollows links to the final path.
Do not casually delete or edit files in /boot, /etc, /lib, /usr, or /var. Be especially careful with /proc and /sys: they are kernel-backed interfaces, not ordinary storage directories. Administrative changes should follow distribution and application documentation.
Practical Examples
Find a system-wide configuration file
Use an absolute path to inspect a common host-specific configuration file:
ls -l /etc/hosts
cat /etc/hostsThe file is under /etc because it describes system-wide, host-specific configuration rather than one user's personal data.
Differentiate regular-user and administrator files
echo "$HOME"
ls -ld /home /rootA regular account commonly has a home directory below /home. The root account normally uses /root. Neither fact changes the meaning of / as the top-level directory.
Locate a command
command -v ls cp mount
readlink -f /bin /sbin /libThe command may be reported under /usr/bin on a merged-/usr distribution. This is normal and does not mean the command is missing.
Compare changing and virtual information
ls -la /var/log
ls -la /run
cat /proc/mounts/var/log contains changing log data, /run contains volatile runtime state, and /proc/mounts reports kernel-maintained mount information. The last command can produce extensive output.
Inspect boot-related storage
ls -la /bootLook for kernel and initramfs files, but do not modify them merely as an exploration exercise.
Troubleshooting FHS Questions
“Is / the root user's directory?”
No. / is the root of the filesystem tree. /root is normally the root account's home directory.
“Why is a command in /usr/bin instead of /bin?”
The system probably uses merged-/usr. Check with ls -ld /bin and readlink -f /bin. The traditional path may resolve to /usr/bin.
“Why is my USB drive not under /media?”
The device may not be mounted, the desktop environment may use a different mount point, or the device may not have been detected. Use findmnt to inspect active mounts and a hardware-aware disk listing tool such as lsblk to check detected block devices.
“Why did a file in /tmp disappear?”
Temporary-file cleanup or reboot behavior probably removed it. Store persistent data in a suitable home-directory or application-specific location instead.
“Can I edit a file under /proc or /sys?”
These are virtual filesystems. Their entries represent live kernel state, and some writable entries are administrative interfaces. Read them cautiously and change settings only through documented interfaces.
“Why is the root filesystem full?”
Large variable data under /var, including logs, caches, package data, or application state, may be responsible. First identify the full filesystem with df -hT, then investigate likely directories using appropriate permissions and safe retention procedures.
Key Takeaways
- FHS defines conventional locations for files and directories on Unix-like systems.
/is the filesystem root;/rootis normally the root user's home./etccontains system-wide configuration,/usrcontains most installed software, and/varcontains changing operational data./homeholds regular-user homes, while/tmpand/runhold temporary or volatile data./dev,/proc, and/sysexpose special device or kernel-backed interfaces./mediaand/mntare conventional mount locations, not guarantees that a filesystem is mounted there.- Many current distributions use usr merge, so
/bin,/sbin, and/libmay be symbolic links into/usr. - Inspect system directories safely, and avoid casual edits or deletions in system and virtual filesystem paths.
For related practice, see File Structure in Linux, Determine File Type, and Show The Full Path Of Shell Commands.