Understanding the Linux filesystem hierarchy

When you SSH into a Linux server for the first time, the directory structure can seem random. Why is there both /bin and /usr/bin? Where do config files go? Why is /tmp different from /var/tmp?

The Filesystem Hierarchy Standard (FHS) defines where things should go. Not every distribution follows it perfectly, but knowing the layout helps you find things and understand what the system is doing.

The root directories

/ is the top of the tree. Everything lives under it.

/bin — Essential user commands. ls, cp, mv, cat, grep. These need to be available even when other filesystems aren’t mounted (like in single-user mode).

/sbin — Essential system commands. fdisk, ifconfig, reboot. Mostly for root.

/etc — System configuration files. passwd, fstab, hostname, ssh/. When someone says “edit the config,” they usually mean something in /etc.

/home — User home directories. /home/upi, /home/otheruser. Each user gets a directory for their personal files and dotfiles.

/root — Root’s home directory. It’s at /root, not /home/root, so it’s available even when /home is on a separate filesystem that might not be mounted.

/var — Variable data. Logs (/var/log), mail (/var/mail), caches (/var/cache). Things that change during normal operation.

/tmp — Temporary files. Cleared on reboot on most systems. World-writable with the sticky bit set.

/usr — Secondary hierarchy for user programs. Contains /usr/bin, /usr/lib, /usr/share. On modern systems, /bin and /usr/bin are often the same (merged via symlinks).

/opt — Optional software packages. Third-party applications that don’t follow the standard layout often install here. /opt/company-name/app/.

/proc — Virtual filesystem for process and kernel information. cat /proc/cpuinfo shows CPU details. cat /proc/meminfo shows memory. These files don’t exist on disk — the kernel generates them on the fly.

/sys — Virtual filesystem for device and kernel information. Similar to /proc but more structured. Used by udev and system tools.

/dev — Device files. /dev/sda is the first disk. /dev/null eats everything you write to it. /dev/zero gives you zeros.

/boot — Kernel images and bootloader files. vmlinuz files, initramfs, GRUB config. Don’t mess with this unless you know what you’re doing.

/mnt and /media — Mount points. /mnt is for temporary mounts (like NFS shares). /media is for removable media (USB drives, CDs).

Where to put your stuff

System-wide application config: /etc/appname/ Application binaries you compiled yourself: /usr/local/bin/ Service data: /var/lib/appname/ Logs: /var/log/appname/ Scripts for automation: /usr/local/sbin/ or /opt/scripts/

For software not managed by the package manager, /opt is the conventional place. Each application gets its own subdirectory.

Symlinks and merges

On Ubuntu 16.04 and later, you’ll notice:

ls -la /bin
# lrwxrwxrwx 1 root root 7 Mar  1 10:00 /bin -> usr/bin

/bin, /sbin, and /lib are symlinks to their /usr counterparts. This “usrmerge” simplifies things but can be confusing when you see both paths referring to the same files.

/var/log layout

Logs are worth knowing:

• /var/log/syslog — main system log (Debian/Ubuntu)
• /var/log/auth.log — authentication attempts
• /var/log/kern.log — kernel messages
• /var/log/dmesg — boot hardware messages
• /var/log/apt/ — package manager history

Common mistakes

Putting application data in /home. Home directories are for users. Application data belongs in /var/lib/ or /opt/.

Storing logs in /tmp. /tmp gets cleaned on reboot. Use /var/log/ for anything you want to keep.

Ignoring /etc defaults. Many applications ship default configs in /usr/share/ and expect site-specific overrides in /etc/. Check both when troubleshooting.

Remarks

The Linux directory layout makes sense once you understand the purpose of each top-level directory. Configuration goes in /etc, variable data in /var, user programs in /usr, temporary stuff in /tmp. When you can’t find something, thinking about what category it belongs in usually points you to the right directory.