Complete Linux Filesystem Hierarchy
Standard FHS (Filesystem Hierarchy Standard) Directory Structure
..Immediatly after a baremetal install. Package installation and configuration will add files across this directory structure
This document describes the directory structure created during a standard Linux installation, following the Filesystem Hierarchy Standard (FHS). All paths are relative to the root directory /.
/ (Root Directory)
/
The root of the entire filesystem hierarchy. Every file and directory starts from here. Only root user has write privileges in this directory. Do not confuse with /root which is the root user's home directory.
/bin (Essential User Binaries)
/bin
Contains essential command binaries needed for system boot and repair, available to all users. In modern systems (systemd-based), this is typically a symlink to /usr/bin.
Common binaries: bash, cat, cp, ls, mv, rm, mkdir, chmod, ps, grep, sed, awk, tar, gzip
Purpose: Commands that must be available in single-user mode and when /usr is not mounted.
/boot (Boot Loader Files)
/boot
Contains static files required for the boot process. This includes the kernel, initial RAM disk (initrd/initramfs), and bootloader configuration.
/boot/grub2
GRUB2 bootloader configuration files and modules
/boot/efi
EFI System Partition mount point for UEFI systems (if separate partition)
/dev (Device Files)
/dev
Contains device files representing hardware and virtual devices. Modern systems use udev to dynamically create device files. This is a virtual filesystem (devtmpfs).
/dev/sda, /dev/sdb, /dev/nvme0n1
Block device files for hard drives and SSDs
/dev/tty*, /dev/pts/*
Terminal and pseudo-terminal devices
/dev/null, /dev/zero, /dev/random, /dev/urandom
Special character devices for null output, zero bytes, and random data
/etc (System Configuration Files)
/etc
Host-specific system configuration files. No binaries should be placed here. Configuration files are typically text-based and editable.
/etc/passwd
User account information
/etc/shadow
Encrypted password information (readable only by root)
/etc/group
Group information
/etc/fstab
Filesystem mount configuration table
/etc/hosts
Static hostname-to-IP address mappings
/etc/hostname
System hostname
/etc/resolv.conf
DNS resolver configuration
/etc/systemd/
Systemd system and service manager configuration files
/etc/sysconfig/
RHEL/CentOS-specific system configuration files (network, services, etc.)
/etc/ssh/
SSH server and client configuration files, host keys
/etc/sudoers, /etc/sudoers.d/
Sudo privilege configuration
/etc/cron.*, /etc/crontab
Scheduled task (cron) configuration
/etc/yum.repos.d/, /etc/apt/
Package manager repository configuration (RHEL/Debian respectively)
/home (User Home Directories)
/home
Contains home directories for regular users. Each user gets a subdirectory named after their username (e.g., /home/john). User-specific configuration files, documents, and personal data are stored here.
/home/username/
Individual user's home directory with personal files, configurations (dotfiles like .bashrc, .profile)
/lib and /lib64 (Essential Shared Libraries)
/lib, /lib64
Essential shared libraries and kernel modules needed by binaries in /bin and /sbin. On modern systems, these are typically symlinks to /usr/lib and /usr/lib64.
/lib: 32-bit libraries
/lib64: 64-bit libraries (on 64-bit systems)
/lib/modules/
Kernel modules organized by kernel version
/lib/systemd/
Systemd unit files and system manager components
/media (Removable Media Mount Points)
/media
Mount points for removable media such as USB drives, CD-ROMs, and external hard drives. Modern desktop environments automatically create subdirectories here when media is inserted.
/media/username/
User-specific automount points for removable media
/mnt (Temporary Mount Point)
/mnt
Generic temporary mount point for filesystems. System administrators manually mount filesystems here (e.g., NFS shares, additional partitions). Unlike /media, this is typically used for manual, temporary mounts.
/opt (Optional/Add-on Application Software)
/opt
Reserved for installation of add-on application software packages. Third-party applications that don't follow the standard /usr directory structure are installed here. Each package gets its own subdirectory (e.g., /opt/google, /opt/oracle).
/proc (Process Information Pseudo-Filesystem)
/proc
Virtual filesystem that provides process and kernel information as files. This is not real disk storage—it's generated dynamically by the kernel. Contains runtime system information.
/proc/[pid]/
Directories for each running process, containing process-specific information
/proc/cpuinfo
CPU information
/proc/meminfo
Memory usage information
/proc/version
Kernel version information
/proc/sys/
Kernel parameters that can be modified at runtime (sysctl)
/root (Root User Home Directory)
/root
Home directory for the root (superuser) account. Separate from / (root of filesystem) and from /home. Only accessible by root user. Contains root's personal files and configuration.
/run (Runtime Variable Data)
/run
Runtime variable data—information about the running system since last boot. This is a tmpfs filesystem (stored in RAM). Replaces various /var/run and /var/lock directories. Cleared on reboot.
/run/systemd/
Systemd runtime data
/run/lock/
Lock files to coordinate resource access
/run/user/[uid]/
Per-user runtime directories
/sbin (System Binaries)
/sbin
Essential system binaries for system administration, typically requiring root privileges. Used for system boot, restore, recovery, and repair. In modern systems, often a symlink to /usr/sbin.
Common binaries: fdisk, fsck, mkfs, shutdown, reboot, ifconfig, ip, iptables, init
/srv (Service Data)
/srv
Contains data for services provided by the system. For example, web server data, FTP server files, or repository data. Organization within /srv is left to the administrator.
/srv/www/, /srv/http/
Common location for web server document roots
/srv/ftp/
FTP server data
/sys (Kernel and System Information)
/sys
Virtual filesystem (sysfs) exposing kernel objects, their attributes, and relationships. Provides interface to kernel data structures. Used by udev for device management. Not real storage—generated by kernel.
/sys/block/
Block device information
/sys/class/
Device classes (network, input, etc.)
/sys/devices/
Device hierarchy representation
/tmp (Temporary Files)
/tmp
Temporary files created by system and users. Files may be deleted on reboot. All users have read/write access (with sticky bit set). Often mounted as tmpfs (RAM-based filesystem) for performance. Do not store important data here.
/usr (User System Resources)
/usr
Secondary hierarchy containing the majority of user utilities and applications. Should be shareable and read-only. Contains multi-user applications and utilities (not essential for system boot).
/usr/bin
Non-essential user command binaries. Most user programs are here (gcc, python, vim, etc.)
/usr/sbin
Non-essential system administration binaries
/usr/lib, /usr/lib64
Libraries for binaries in /usr/bin and /usr/sbin
/usr/local/
Tertiary hierarchy for locally compiled/installed software. Mirrors /usr structure (bin, sbin, lib, etc.). Safe from system updates.
/usr/share/
Architecture-independent data: documentation, icons, themes, man pages, wallpapers
/usr/share/man/
Manual pages
/usr/share/doc/
Documentation files
/usr/include/
C/C++ header files for development
/usr/src/
Source code, including kernel source
/var (Variable Data Files)
/var
Variable data files—files that are expected to grow and change during system operation. Includes logs, spool files, temporary files, cache data, and databases.
/var/log/
Log files from system and applications. Critical for troubleshooting.
Important files: messages, syslog, secure, auth.log, dmesg, boot.log
/var/log/journal/
Systemd journal logs (binary format, read with journalctl)
/var/cache/
Application cache data. Can be deleted without data loss (e.g., package manager cache)
/var/spool/
Spool files for tasks waiting to be processed (mail, print queues, cron jobs)
/var/spool/cron/
User crontab files
/var/mail/
User mailbox files
/var/tmp/
Temporary files preserved between reboots (unlike /tmp)
/var/lib/
Variable state information—persistent data modified by programs (databases, system state)
/var/lib/mysql/, /var/lib/pgsql/
Database files for MySQL/MariaDB and PostgreSQL
/var/www/
Common default location for web server document root (Apache/Nginx)
/var/run/
Usually symlinked to /run (runtime variable data)
/var/lock/
Usually symlinked to /run/lock (lock files)
Modern Linux Changes:
Many modern Linux distributions (using systemd) have merged several directories:
- /bin → /usr/bin (symlink)
- /sbin → /usr/sbin (symlink)
- /lib → /usr/lib (symlink)
- /lib64 → /usr/lib64 (symlink)
- /var/run → /run (symlink)
- /var/lock → /run/lock (symlink)
This simplifies the filesystem structure while maintaining backward compatibility.
Filesystem Permissions Note:
Most directories under / are owned by root:root with varying permissions. User home directories (/home/username) are owned by the respective users. The /tmp directory has the sticky bit set (drwxrwxrwt) allowing anyone to write but only file owners to delete their files.
← Back to Filesystem Index
↑ Back to EXPANDED