Lesson: The Linux Directory Tree

What you'll learn

• Why Linux has one tree of directories starting at / instead of drive letters.
• What lives in the most important directories: /etc, /var, /home, /usr, /bin, /tmp.
• What the "virtual" directories /proc and /dev are and why they aren't real files on disk.
• The big idea that "everything is a file" in Linux.

Skill gained: the ability to guess where something lives on any Linux box, so you spend less time lost and more time fixing.

The lesson

On Windows you have C:\ and D:\. Linux has none of that. There is exactly one tree, and it starts at the root directory, written / (just a forward slash). Every file and every disk lives somewhere inside that single tree. This layout is standardized by the Filesystem Hierarchy Standard (FHS), which is why Ubuntu, Debian, Fedora, and the VMs in this lab all look broadly the same.

1. The single tree

/                         the root of everything
├── bin   -> usr/bin      essential user commands (ls, cp, cat)
├── boot                  the kernel + bootloader files
├── dev                   devices (disks, terminals) as files
├── etc                   system-wide configuration (text files)
├── home                  per-user home directories
│   └── ubuntu            your home on the Jumpbox
├── lib   -> usr/lib      shared libraries
├── proc                  live kernel/process info (virtual)
├── root                  the root user's home (NOT /)
├── run                   runtime state since last boot
├── sbin  -> usr/sbin     system admin commands
├── srv                   data served by this host
├── tmp                   temporary scratch space
├── usr                   installed programs & their files
└── var                   data that changes: logs, caches, spools

Notice some entries have ->. Those are symbolic links (shortcuts). On modern Ubuntu, /bin is just a link into /usr/bin; treat them as the same place.

2. Your starting point: navigating

Two commands anchor you:

ubuntu@Jumpbox:~$ pwd          # "print working directory" — where am I?
/home/ubuntu
ubuntu@Jumpbox:~$ cd /         # change directory to root
ubuntu@Jumpbox:/$ ls
bin  boot  dev  etc  home  lib  proc  root  run  srv  tmp  usr  var

The ~ in your prompt is shorthand for your home directory (/home/ubuntu). cd with no argument always takes you home.

A path starting with / is absolute (from the root). A path not starting with / is relative (from where you are now). . means "here" and .. means "one level up."

3. /etc — configuration

/etc (pronounced "et-cee") holds system-wide configuration files, almost all plain text. When you configure a service, you edit a file here.

ubuntu@Jumpbox:~$ cat /etc/hostname     # this machine's name
Jumpbox
ubuntu@Jumpbox:~$ cat /etc/os-release    # which distro & version
NAME="Ubuntu"
VERSION="24.04 LTS (Noble Numbat)"

Because it's all text, configuration is easy to read, edit, version-control, and automate — a core DevOps idea.

4. /var — data that varies

/var holds data that changes while the system runs. The most important sub-directory for you is /var/log, where programs write their logs.

ubuntu@Jumpbox:~$ ls /var/log
auth.log  syslog  journal  dpkg.log  ...

In this lab these local logs are also shipped to a central Loki log server at 10.100.100.5, so you can search every host's logs in one place. But knowing logs land in /var/log first is essential when you're on the box itself.

Other /var residents: /var/lib (application state, e.g. databases), /var/cache (caches), /var/spool (queues like mail/print).

5. /home — where you live

Each human user gets a directory under /home. Yours on the Jumpbox is /home/ubuntu. You own your files here and can do whatever you like. The special root user's home is not under /home — it is /root. Don't confuse /root (root's home) with / (the root of the tree).

6. /usr, /bin, /sbin — the programs

When you run ls, where does that program live?

ubuntu@Jumpbox:~$ which ls
/usr/bin/ls

• /usr/bin — programs for everyone (ls, grep, python3).
• /usr/sbin — programs mainly for administrators (useradd, systemctl).
• /usr/lib — shared libraries those programs depend on.

Think of /usr ("Unix System Resources") as "everything that got installed." It can be large and is generally read-only during normal operation.

7. /tmp — scratch space

/tmp is a place any program can write temporary files. It is usually wiped on reboot, so never store anything you want to keep there. It's perfect for a quick test:

ubuntu@Jumpbox:~$ echo "scratch" > /tmp/note.txt
ubuntu@Jumpbox:~$ cat /tmp/note.txt
scratch

8. /proc and /dev — files that aren't really files

Here's where Linux gets clever. Some directories don't hold real files on disk — they're virtual, generated by the kernel on the fly.

/proc exposes live kernel and process info as if it were files. Each running process has a directory /proc/<PID>:

ubuntu@Jumpbox:~$ cat /proc/cpuinfo     # details about the CPUs
ubuntu@Jumpbox:~$ cat /proc/uptime      # seconds since boot
123456.78 987654.32

/dev exposes hardware devices as files. Your disk might be /dev/sda, your terminal /dev/tty, and there are useful fake devices:

ubuntu@Jumpbox:~$ ls -l /dev/null /dev/zero
crw-rw-rw- 1 root root 1, 3 /dev/null    # discards anything written to it
crw-rw-rw- 1 root root 1, 5 /dev/zero    # produces endless zero bytes

/dev/null is the famous "black hole" — redirect output there to throw it away: command > /dev/null.

9. Everything is a file

The reason /proc and /dev work is the central Unix idea: almost everything is presented as a file. A document, a hard disk, a running process's memory, even a network connection — you read and write them with the same handful of operations (open, read, write, close). This is why the small toolkit of commands you're about to learn is so powerful: the same cat, grep, and > work on real files and on these virtual ones. Learn the tools once, use them everywhere.

10. Putting it to use

Suppose a teammate says "the web service config is broken." Your instincts should now be: configuration → /etc; if it logged an error → /var/log (or central Loki); the program itself → /usr/bin or /usr/sbin; live process info → /proc. You can navigate any Linux box without a map.

Dig deeper

• Filesystem Hierarchy Standard — hier(7) man page
• Filesystem Hierarchy Standard 3.0 — the official spec
• Everything is a file (Linux Handbook)
• proc(5) — the /proc filesystem
• null(4) — the /dev/null special file (man7.org)

Search terms

• linux filesystem hierarchy standard explained
• what is /etc /var /usr in linux
• everything is a file unix philosophy
• linux /proc filesystem beginner
• what is /dev/null used for

Check yourself

1. Why does Linux have no C:\ drive? What replaces it?
2. Where would you look first for a service's configuration? For its logs?
3. What is the difference between /root and /?
4. Why are /proc and /dev described as "virtual"?
5. Explain in one sentence what "everything is a file" buys you.