The Linux Filesystem Hierarchy: Why Files Go Where They Go

Coming from Windows, the Linux filesystem can feel like a chaotic mess. There are no "Drive C:" or "Drive D:". Instead, everything starts from a single point—the Root (/)—and branches out into folders with strange names like /etc, /var, and /usr.

But this "chaos" is actually governed by a strict set of rules called the Filesystem Hierarchy Standard (FHS). Developed in the 1990s, the FHS ensures that any Linux user can sit down at a strange system and immediately know where to find the logs, the settings, and the executable files.

In this lesson, we will map out the "Linux Tree" so you never get lost again.

1. The Root Directory ( / )

In Linux, everything is a file, and all files live under the root directory. Even if you plug in a second hard drive or a USB stick, it doesn't get a new letter; it gets "mounted" as a folder somewhere under /.

graph TD
    Root[/] --> bin[bin: Essential Binaries]
    Root --> boot[boot: Kernel & Bootloader]
    Root --> dev[dev: Device Files]
    Root --> etc[etc: Configuration Files]
    Root --> home[home: User Folders]
    Root --> lib[lib: Shared Libraries]
    Root --> mnt[mnt: Temporary Mounts]
    Root --> opt[opt: Optional Add-on Software]
    Root --> proc[proc: Kernel & Process Info]
    Root --> root[root: Admin Home Folder]
    Root --> run[run: Volatile Runtime Data]
    Root --> sys[sys: Hardware Info]
    Root --> tmp[tmp: Temporary Files]
    Root --> usr[usr: User Apps & Support Files]
    Root --> var[var: Variable Data - Logs/DBs]

2. Key Directories Explained

/etc - System Configuration

Think of this as the "Control Panel" of Linux. If a program has a setting, it's likely stored in a text file inside /etc.

Example: /etc/passwd (User info), /etc/hostname (Server name).

/var - Variable Data

This is for files that grow and change constantly over time.

Example: /var/log (System logs), /var/www (Website files), /var/lib/mysql (Databases).

/usr - User Applications

Historically meaning "User System Resources," this is where the majority of your software lives. It mimics the root structure!

/usr/bin: Executable programs (like python3 or git).
/usr/lib: Libraries needed by those programs.
/usr/share: Shared data like icons and wallpapers.

/home - The Users' Kingdom

This is the only place where regular users have "Write" permission. Every user gets a folder here (e.g., /home/sudeep).

Note: The Administrator's home folder is NOT in /home. It is in /root for security reasons.

/dev, /proc, and /sys - The Virtual Folders

These don't actually exist on your hard drive. They are "Virtual Filesystems" created by the kernel to show you hardware and process info.

/dev/sda: Represents your first hard drive.
/proc/cpuinfo: Represents your processor stats.

3. Binaries: /bin vs /sbin vs /usr/bin

This is a common source of confusion.

/bin: Essential commands that everyone uses (like ls or cp).
/sbin: System commands for the Administrator (like reboot or fdisk).
/usr/local/bin: Commands you installed manually (not via the package manager).

4. Path Expansion: How the Shell Finds your Files

When you type python3 in your terminal, how does Linux know it's in /usr/bin/python3? It uses an environment variable called $PATH.

$PATH is a list of directories the shell searches through every time you run a command.

# See your current search path
echo $PATH
# Output looks like: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

5. Practical: Exploring the Hierarchy

Let's use some "Search and Find" commands to see this hierarchy in action.

# Find where the 'ls' binary is actually located
which ls

# See the size of the /var/log directory (Variable data)
sudo du -sh /var/log

# See what's currently mounted (Disks attached to the tree)
lsblk

6. Example: A Filesystem Integrity Checker (Python)

If a system is compromised, a hacker might hide a file in a strange place (like /dev or /tmp). Here is a Python script that audits the filesystem hierarchy for "out of place" large files in sensitive system directories.

import os
import math

def audit_directory_sizes(root_paths):
    """
    Checks the size of essential FHS directories.
    """
    report = {}
    
    for path in root_paths:
        if not os.path.exists(path):
            continue
            
        total_size = 0
        try:
            # os.walk is a professional way to traverse the tree
            for dirpath, dirnames, filenames in os.walk(path):
                for f in filenames:
                    fp = os.path.join(dirpath, f)
                    # Skip if it's a broken symlink
                    if not os.path.islink(fp):
                        total_size += os.path.getsize(fp)
            
            # Convert bytes to MB
            report[path] = f"{total_size / (1024*1024):.2f} MB"
        except (PermissionError, OSError):
            report[path] = "Permission Denied"
            
    return report

if __name__ == "__main__":
    # We audit /etc (should be small) and /tmp (should be monitored)
    paths_to_audit = ["/etc", "/tmp", "/bin", "/sbin"]
    
    results = audit_directory_sizes(paths_to_audit)
    print("--- FHS Directory Size Audit ---")
    print(f"{'Directory':15} | {'Measured Size'}")
    print("-" * 35)
    
    for path, size in results.items():
        print(f"{path:15} | {size}")

7. Professional Tip: Use /opt for Big Third-Party Apps

If you download an app that isn't in your official package manager (like Google Chrome, Slack, or a custom internal tool), the professional place to put it is /opt. This stands for "Optional" and keeps your /usr directory clean and manageable.

8. Summary

The Linux Filesystem is a logical, standardized tree.

/ is the beginning of everything.
/etc is for config.
/var is for changing data (logs, DBs).
/home is for users.
/usr is for applications.
$PATH is how the shell finds your commands.

In the next lesson, we will perform our First Login and System Tour. We will finally step into the terminal and start interacting with these directories live.

Quiz Questions

In which directory would you look for the system log files?
If you want to change the IP address of your server, which directory would likely contain the configuration file?
What is the difference between /bin and /sbin?

Continue to Lesson 6: First Login and System Tour—Your First Steps in the Terminal.

The Linux Map: Understanding the Filesystem Hierarchy (FHS)