Understanding the Linux Directory Structure

The first time you log into a Linux server and run ls /, the row of cryptic short directory names is bound to be a little bewildering. This note walks through the responsibilities of the common directories under the root, sorting out what belongs where.

Why the Directories Look Like This

The Linux directory layout isn't arbitrary convention—it follows a specification called the FHS (Filesystem Hierarchy Standard). It defines which directory each category of files belongs in: executables, configuration, logs, and temporary files each have their place. The benefits are immediate—

• Package managers know where to install files, and can remove them cleanly on uninstall;
• When operators troubleshoot, there's no guessing where configs and logs live—/etc and /var/log almost never disappoint;
• Different distributions stay largely consistent, so experience transfers.

To see the root layout on your own machine, one command is enough:

# List the top-level directories under root
ls -l /

The Core Directories, One by One

1) Programs and Commands

/bin: holds commonly used commands and binary executables, such as ls, cp, and cat—the basic commands every user relies on.

/sbin: commands and programs meant for administrators, typically tools for network configuration, disk partitioning, and system shutdown/reboot. It's usually not in a regular user's PATH.

/usr: the directory for user applications and files. The name is easily misread as "user," but it actually stands for Unix System Resources. The vast majority of software installed by the system lives here, with /usr/bin, /usr/lib, and /usr/share holding programs, libraries, and shared data respectively. Many modern distributions have done the usr merge, so /bin is actually a symlink to /usr/bin:

# On distributions with the usr merge you can see the symlinks
ls -ld /bin /sbin

/opt: short for "optional," it's where third-party software gets installed. Unlike /usr, which is managed by the package manager, /opt is better suited to commercial software that ships its own complete directory tree, or large software installed by manually unpacking an archive—one subdirectory per application, which also makes removal easy.

2) Configuration and Devices

/etc: dedicated to system configuration files and their subdirectories. Changing system behavior almost always starts here—think /etc/fstab, /etc/hosts, /etc/ssh/. When backing up system configuration, this directory is the priority.

/dev: short for Device, containing the external devices currently connected to the Linux system. Linux follows the "everything is a file" design, so devices are accessed the same way as files—a disk is /dev/sda, a terminal is /dev/tty, and there are special devices like /dev/null.

/boot: holds the kernel files needed to boot Linux, including link files and images, and the bootloader (e.g. GRUB) configuration also lives here. Don't touch this directory lightly—deleting the wrong file can leave the system unable to boot.

3) User Data

/home: the users' directory. Each system account gets its own folder—user alice's home directory is /home/alice.

/root: the administrator's home directory. Note that it is not under /home—that way, even if the partition mounted at /home breaks, the root user can still log in to troubleshoot.

4) Runtime and Volatile Data

/var: holds files that change frequently, such as system logs. /var/log stores logs, /var/lib stores services' persistent data (database files often live here), and /var/cache stores caches. When a disk fills up, this is usually the first place to check:

# Find the subdirectories using the most space under /var
du -sh /var/* | sort -rh | head

/tmp: the temporary files directory, holding transient files produced by running programs; any user can write to it. Many distributions periodically clean out files that haven't been accessed, changed, or modified for a while (say, 10 days), so don't put anything you need to keep here.

/run: another temporary directory, storing transient information since the system booted, such as services' PID files and socket files. When the system reboots, files under this directory are cleared—it's typically mounted in memory and inherently volatile.

Commonly Confused Pairs

• /tmp vs /run: both are temporary directories, but /tmp serves applications and users, while /run serves system services' runtime state; /run is always cleared on reboot, whereas /tmp depends on the distribution's policy.
• /opt vs /usr/local: both hold software outside the package manager. Software compiled and installed by hand conventionally goes in /usr/local (with a structure parallel to /usr), while third-party software unpacked as a whole goes in /opt.
• /root vs /: the former is the root user's home directory, the latter is the root of the entire filesystem. The names look alike but they're entirely different things.

tip

When investigating a "disk full" problem, check /var/log and /tmp first; when hunting for some software's configuration, look for a directory of the same name under /etc first. Remembering directory responsibilities is more useful than remembering specific paths.

Wrap-up

The Linux directory structure is essentially classification by "the nature of the files": programs go in /bin and /usr, configuration in /etc, volatile data in /var, temporary files in /tmp and /run, and user data in /home. Once you internalize this classification logic, you can quickly find what you're looking for even on an unfamiliar machine.