Linux's Directory Hierarchy

Preface

    So a few days ago I was there on my computer scrolling through twitter and saw this tweet that was particularly interesting to me.

The Linux filesystem and directory structure explained (detailed thread)🐧↓

— Linuxopsys (@linuxopsys) February 15, 2023

    Not really because of its contents, but rather because of memories. I remember stepping into Linux for the first time in my life and being slapped in the face by an operating that had nothing to do with, despite appearances, anything I experimented with before. Admittedly only Windows XP and 7.

    The fact that the terminal is actually more powerful and faster than the desktop environment is more than enough to deal with as a newcomer to the Linux world. Trying to also understand the directory hierarchy and figuring out what goes where is a steep learning curve that not everyone overcome.

    Because I'm a firm believer that any Linux Distribution is a far more solid choice than Windows or Mac as a daily operating system for many different reasons I'm not going to discuss here, I want to help people get to give Linux a fair try. 

    Maybe you've been years looking for alternatives to mainstream manipulation in order to finally ditch Windows and join the Rebellion. Or perhaps you just wanna flex your "computer nerd" abilities to your friends but don't know where to start.

    In all seriousness though, Linux is incredibly powerful and capable. Maybe not for the average user that just wants Word, Excel and to play video games but, for anyone more tech-savvy or just tech-curious overall it's a whole different thing.

Basics for newcomers

    Okay, so you just accessed a Linux machine. Where to start? Easy. Whether you have a desktop environment installed and running or not the first step is always open the terminal (for obvious reasons you don't need to open the terminal if you run a Command Line Interface).

    With the terminal open, type the following command:

    1) cd /

    2) ls

    That forward slash (/) symbolizes the "root" directory, which stores everything. It's just the start point of the file system.

    The output you get should yield something like this:

    Since I'm using Manjaro, a distro based in Arch Linux, some directories might vary a bit from yours, a likely user of a Debian-based distribution. Still, generally speaking, all have the same functionalities.

    So, what do you need to know? Well, the most important directories for you are:

    /home

    Here, the operating system will create several sub-directories containing files owned by the user accounts registered in the machine. This is meant for regular users with standard privileges over the operating system.

    Every time you create a new user, Linux will create a new sub-directory with the account's name in /home by default, unless you specify another path.

    /home/[username]

    This is the sub-directory you fully own in the machine, your personal workspace. Information stored here, such as videos, documents, pictures or configurations will only be read or modified by you (and root).

    By the way, configuration files you store here (to change how your terminal looks for instance) will only apply to you, and any other user that logs in will not be affected.

    As a side note, it's a good practice to store the /home in a different partition to the root directory (/). That way if anything breaks in the system, you can still recover user's data. 

    /root

    It's the equivalent of the /home directory for the root user.

    /etc

    This is a bit more technical, and until you're more advanced, probably you won't even touch it. It stores configuration files for applications and programs that apply throughout the entire system. 

    Also here you can find the files passwd and shadow that store information about users and groups in the system (and passwords, but hashed so no luck trying to hack someone's account).

    /mnt and /media

    These two serve a similar purpose, and often are used indistinctly. For the purposes of being accurate, /mnt is used to mount file systems temporarily. It can be used to back up the system, or more notoriously to install Arch through the command line.

    On the other hand, /media is exactly the same thing but for removable drives (USB, External Hard Disks, CDs...). For all I remember in Ubuntu and other Debian-based distros they use /mnt for that so yeah, not a big difference between these two. 

     Okay. With this information I think you're more or less ready to go and start investigating and breaking things until you get used to this, so if you don't want to read more, feel free to leave it here and come back for more later on.

    However, down below you have the rest of directories described, in case you want to know more.

Advanced directory wisdom

    From now on I'm going to explain those directories no regular user goes into, ever. Whether you're just curious or need this for an exam, it'll be useful.

    /bin

    This directory stores binaries. What are binaries? Executable programs. Many  commands you type in the terminal has a binary that has been compiled and ready to execute. Because of this, files located here are not humanly readable, however, can be accessed and used by users across the platform, given they have appropriated permissions to do so. 

    /sbin

    It's the same function /bin does but instead, here the system stores binaries that can only be executed by the super user (sbin means System Binaries).

    /usr

     Contains system-wide read only files, which in regular terms means "software you installed".

    If you go into /usr, you'll see folders like /usr/bin, /usr/sbin or /usr/lib, and if you noticed, those names already exist in the root directory so, is there any difference? Well, back in the day used to, nowadays it's become almost indistinguishable. 

    It used to be that binaries compiled in the /bin directory or libraries contained in /lib (more on that later) were required to boot up the system, and anything installed in /usr/lib or /usr/bin wasn't.

    /lib

    Here you'll find libraries, as the name kindly suggests. What are libraries? Binaries that binaries (in the /bin directory) use to add functionality or plainly to work at all.

    /dev

    The files in here are what we call device descritptors. These contain information relative to all devices connected to the computer: hard disks, partitions, mouse, USBs, CDs, keyboard, screens, everything. 

    The kind of data each file stores varies from device to device, but expressed in global terms is all kind of information the Operating System needs to operate them correctly.

     /tmp

    This directory saves files temporarily, meaning that once you shut down the computer everything here will vanish into thin air. Most likely is used by applications that need to store temporary information, for instance Firefox when downloading something. 

    You too can use this directory if you wish to do so, however, keep in mind that is not permanent storage. I would recommend to steer clear from that practice since it might lead you to having some mishaps.

    /var

     Here the system stores variable files, those containing information of a running program (process), meaning these files may alter their size or data over time. Cache, spool or log files for example are stored here.

    You might think that its the same as /tmp, but in this case, files stored here are not deleted on system's shutdown, or automatically in any other way unless the user specifically creates a script to do so (what can be sort of dangerous). 

    This behavior allows the system administrator to check what has happened in the computer in case any problems arise.

    /lost+found

     This is a directory that you particularly might not have. It's used by the fsck utility, which purpose is to check and validate the consistency and integrity of a file system (in most cases the hard drive Linux is installed on).

    This tool uses this directory to store information that has been lost or corrupted during a disk operation (backup, cloning, restoring RAID, etc.).

    As a beginner you won't even use it at all, but for sysadmins it's a way to partially (or totally if you're lucky) recover data that has been affected during certain operation.

    /boot

    It's a really important directory. Without it the system wouldn't boot (obviously) since it contains boot configurations, the kernel image, and paths to indicate where everything required to the system's boot is located.

    It's not the same, but I'd say deleting this directory is the equivalent of deleting Win32 folder in a Windows Operating System, but worse.

    If you happen to lose anything here, I'd advice you to copy everything you can from your /home directory so you still have your personal data, and install a fresh operating system. Of course there are ways to recover /boot, but the easiest solution for you is, probably, to start over again.

     /opt

    Opt stands for Optional. It stores files for optional software. The definition of this, traditionally, is "Add-on application software packages", meaning software that's not part of the software. Nevertheless, nowadays distros have a series of  repositories to get a great variety of packages already compiled and ready to use that, once downloaded, are stored either in /usr/bin or /bin. 

    So this directory is meant to write or obtain third-party applications that you compile from source code and store the binary in its corresponding directory so it's available to everyone.

    You can use it freely to store anything you want since there's no detriment to it other than a potential haphazard organization.

     /proc

    Contains information about currently running kernel processes and parameters. The contents here are used by several system utilities to show runtime information, such as the information relative to the CPU, memory, operating system, etc.

    There's an odd particularity about this directory and it's that technically it does not exist. Nearly everything contained here has a 0 byte length, but you can still read and display it. It's what we call a virtual directory. It has stored no information, but rather "pointers" to access it.

     /srv

     This directory is used to store information relative to services provided by the computer. By services I mean those a server would provide. You may not have this directory in your computer if you don't intend on using it as a server, but most likely you have it by default.

    Non sensitive information relative to an HTTP or FTP servers, for example, should be stored here, but for security reasons anything private or sensible should be stored in a directory with a different name.

 Epilogue

     Well, I think you have now information enough to process and get used to. Linux is a different universe compared to windows, but it's got its perks. I hope this post was helpful and you have a deeper understanding of how things work here.

    As a disclaimer, I'd like to add that, even though I have researched information about every single directory named here, I'm not a Linux expert so information might not be accurate on modern systems, or I might have overlooked an important aspect of some of them because of the briefness of each description. 

    Regardless, I'd say that if you came here as a beginner now you should know where everything is and the purpose of each "folder".