One of the biggest mindset shifts for beginners is that Linux does not organize storage around drive letters like C: or D:. Instead, everything starts from a single top-level directory called the root directory, written as /.
Files, folders, devices, and even process information appear somewhere under that root. This design makes Linux systems predictable once you learn the layout.
The Filesystem Hierarchy Standard (FHS) is a convention that describes where different types of files should live on Unix-like systems. Not every distribution follows it perfectly, but most of them follow the general structure.
The goal is consistency. If configuration files are usually in /etc and logs are usually in /var/log, administrators do not have to guess where important data is stored.
Tip: Memorizing a few key directories saves time when troubleshooting a server over SSH.
/The root directory is the top of the filesystem tree. Every path begins from here.
For example:
/etc/ssh/sshd_config
/var/log/syslog
/home/devops/.bashrcDo not confuse / with the root user. The slash is the top directory. The root user is the superuser account with administrative power.
/etc/etc stores system-wide configuration files. You will often edit files here when managing services, users, networking, or security.
Examples:
/etc/hosts
/etc/passwd
/etc/ssh/sshd_configIn DevOps, /etc matters because many service settings are plain text and easy to automate.
/var/var holds variable data that changes over time. This includes logs, caches, spool files, and application state.
Common examples:
/var/log/
/var/lib/
/var/cache/When a service fails, logs in /var/log are usually one of the first places to check.
/tmp/tmp is used for temporary files. Applications often write short-lived data here. On many systems, its contents may be cleaned automatically.
You should never store important long-term files in /tmp.
Note: In operations work, a missing file in
/tmpis often expected because cleanup jobs may remove old temporary data.
/home/home stores personal directories for regular users.
Example:
/home/alex
/home/devopsA userâs shell profile, SSH keys, and personal scripts are often stored here.
/usr/usr contains many user-space programs, libraries, and documentation. Despite its name, it is not only for user home data.
Common subdirectories include:
/usr/bin for commands/usr/sbin for admin commands/usr/lib for libraries/usr/share for shared data and docs/proc/proc is a virtual filesystem that exposes kernel and process information. Files here are generated dynamically by the system rather than stored like normal files.
Useful examples:
cat /proc/cpuinfo
cat /proc/meminfo
cat /proc/1/statusThis directory is valuable when diagnosing performance or understanding system state.
A path tells Linux where a file or directory is located.
An absolute path starts with / and gives the full location from the root directory.
Example:
/home/devops/projects/app/config.yamlNo matter where you currently are in the shell, that path points to the same file.
A relative path starts from your current working directory.
If you are in /home/devops/projects, then:
cd app
cat config.yamlHere, app and config.yaml are relative paths.
Linux also uses a few path shortcuts:
. means the current directory.. means the parent directory~ usually means your home directoryExample:
cd ~/projects
ls ../Suppose an Nginx service fails. A practical workflow might look like this:
cd /etc/nginx
ls
cat nginx.conf
cd /var/log/nginx
tail -n 20 error.logThis simple flow uses two key areas of the filesystem: configuration in /etc and logs in /var/log.
Another example is user troubleshooting:
cat /etc/passwd
ls /homeThese commands help you see registered users and their home directories.
Filesystem knowledge is not trivia. It directly improves troubleshooting speed.
When you know where things usually live, you can:
Beginners often struggle because Linux feels unfamiliar. The fix is repetition: navigate, inspect, and connect each directory to a real use case.
Scenario: Nginx fails to start, and you want its configuration file first.
Question: Which directory from the lesson is the most likely place to check?
<MCQExercise exercise={{
id: 'linux-filesystem-q1',
title: 'Exercise 1: Finding configuration files',
description: 'Identify which top-level Linux directory usually stores system-wide configuration files.',
options: [
{ id: 'a', text: '/var' },
{ id: 'b', text: '/home' },
{ id: 'c', text: '/etc' },
{ id: 'd', text: '/proc' },
],
correctId: 'c',
explanation: 'The tutorial explains that /etc is the standard home for system-wide configuration files such as /etc/hosts and /etc/ssh/sshd_config. That makes it a natural starting point when a service config is involved.',
wrongExplanations: {
a: '/var usually holds changing data such as logs, caches, and application state rather than primary config files.',
b: '/home stores user home directories. It is not where system-wide service configuration normally lives.',
d: '/proc is a virtual filesystem for live kernel and process information, not a place for ordinary config files.',
},
}} />
Question: What makes /proc different from a regular disk-backed directory?
<MCQExercise exercise={{
id: 'linux-filesystem-q2',
title: 'Exercise 2: Reading /proc correctly',
description: 'Choose the statement that correctly describes the /proc directory.',
options: [
{ id: 'a', text: 'It stores personal user files and SSH keys.' },
{ id: 'b', text: 'It is a virtual filesystem that exposes live kernel and process information.' },
{ id: 'c', text: 'It only exists to cache package downloads.' },
{ id: 'd', text: 'It is the default mount point for removable USB drives.' },
],
correctId: 'b',
explanation: 'The lesson describes /proc as a virtual filesystem whose files are generated dynamically by the system. That is why commands like cat /proc/cpuinfo reveal live system details instead of ordinary saved file content.',
wrongExplanations: {
a: 'User files usually live under /home, not /proc. /proc is about system and process state.',
c: 'Package caches are more likely under directories such as /var/cache. That is not the role of /proc.',
d: '/proc is unrelated to removable media mount points. It exposes runtime information from the kernel.',
},
}} />
Scenario: You are currently in /home/devops/projects.
Question: Which path to config.yaml is relative rather than absolute?
<MCQExercise exercise={{
id: 'linux-filesystem-q3',
title: 'Exercise 3: Spotting a relative path',
description: 'Determine which example path depends on the current working directory.',
options: [
{ id: 'a', text: '/home/devops/projects/app/config.yaml' },
{ id: 'b', text: '/etc/ssh/sshd_config' },
{ id: 'c', text: '/var/log/syslog' },
{ id: 'd', text: 'app/config.yaml' },
],
correctId: 'd',
explanation: 'A relative path does not begin with /. The tutorial uses examples like app and config.yaml to show paths that are resolved from your current working directory.',
wrongExplanations: {
a: 'This is an absolute path because it starts at the root directory with /. It points to the same file no matter where you currently are.',
b: 'Because it begins with /, this is also absolute and independent of the current directory.',
c: 'This path is absolute as well. The leading slash tells Linux to resolve it from the filesystem root.',
},
}} />
/. There are no drive letters; additional disks are mounted into the tree./etc is configuration, /var is changing data, /usr is installed software. That split explains most of the layout./tmp may be cleared on reboot and is often a tmpfs in RAM; /var/tmp persists./proc and /sys are not on disk: they are kernel interfaces presented as files./var/log and /var/lib are what fill a disk, so check them first./opt and /usr/local are for software outside the package manager; leave /usr/bin to it.. is hidden only by convention: ls -a shows it./etc holds system-wide configuration: text files you edit, and the first place to look when changing how something behaves. /var holds variable data the system writes during operation. Logs in /var/log, databases and container images in /var/lib, queued mail and print jobs in /var/spool, and it is what grows. /usr holds installed programs and their static supporting files, managed by the package manager and not normally edited by hand.
/tmp is for short-lived files and is cleared on reboot, and on many modern systems it is a tmpfs living in RAM, which means writing a large file there consumes memory and disappears entirely on restart. /var/tmp is also temporary but is expected to survive a reboot, making it the right choice for a long-running job's intermediate files. Both are world-writable with the sticky bit set, so users cannot delete each other's files.
Virtual filesystems that expose kernel state as readable files, occupying no disk space at all. /proc is mostly per-process information, /proc/<pid>/ describes a running process, plus system-wide values such as /proc/meminfo and /proc/cpuinfo. /sys exposes devices and kernel parameters, and writing to files there changes settings at runtime. This is why commands like free and ps work: they read and format these files rather than asking the kernel through a special interface.
/opt for a self-contained third-party application that keeps its own directory tree, and /usr/local when you are installing something that follows the usual bin, lib, share layout, /usr/local/bin is on PATH by default and is the conventional place for a compiled binary. Avoid writing into /usr/bin yourself, because that belongs to the package manager and your file will eventually be overwritten or conflict with an upgrade.
/var/log and /var/lib, in that order. Logs grow without limit when rotation is missing or misconfigured, and /var/lib/docker or /var/lib/containerd accumulates images, layers and volumes surprisingly fast on a build host. sudo du -sh /var/* | sort -h narrows it in one command. If df reports a full disk but du does not account for it, look for a deleted file still held open by a process with sudo lsof +L1.
Move around Linux with confidence: absolute versus relative paths, reading ls -l output, which versus type, man pages and fixing command not found errors.
Copy, move, delete and read files safely on Linux: why rm has no undo, cp -r versus cp -a, the trailing-slash trap, find by name and size, less versus tail.
Use grep, sed, awk, sort and uniq for real work: pick the right tool for each question, avoid the sed -i portability trap and see why errors vanish in pipes.