Linux Directory Structure/Filesystem Explained

Overview
Differences Between Linux and Windows File Organization
Understanding the Root Directory (/)
Common Linux Directories
1. Commands, libraries, and installed software
  - /bin - Essential user commands
  - /sbin - System administration commands
  - /lib, /lib32, /lib64 - Shared application library files
  - /usr - Installed programs and shared resources
  - /usr/local - Locally installed software
  - /opt - Add-on application software
2. System configuration
  - /etc - System-wide configuration files
3. Startup and boot files
  - /boot - Kernel and startup files
4. User home directories
  - /home - Users’ home directories
  - /root - Home directory for the root user
5. Service data and changing files
  - /srv - Data provided by services
  - /var - Logs, caches, and changing application data
6. Temporary files and runtime data
  - /tmp - Temporary storage
  - /run - Volatile runtime data
7. Devices and kernel information
  - /dev - Device files
  - /proc - Contains information about the system and running processes
  - /sys - Kernel, device, and driver information
8. Mount points and filesystem recovery
  - /media - Mount points for removable media
  - /mnt - Temporary manual mounting point for system administrators
  - /cdrom - Distribution-specific optical-disc mount point
  - /lost+found - Files recovered during filesystem repair
Which Files Stay After a Reboot?
Explore the Directory Structure on Your System
Troubleshooting: Why Is /var Full?
References and Further Reading

Terminal listing of directories in a Linux filesystem — Terminal listing of Linux directories.

Overview

If you are new to the Linux operating system, its file structure can be intimidating to navigate, even for a seasoned Windows administrator. Although each developer of a Linux operating system (distro) can customize their distribution’s folder structure, most follow the Filesystem Hierarchy Standard (FHS) maintained by the Linux Foundation. Based on the Unix file system, it establishes the convention for the folder structure used in Linux. The first version of the FHS was released on February 14, 1994 and has evolved ever since to version 3 released on May 18, 2015.

Tux, the Linux mascot — Courtesy of Larry Ewing
and The GIMP

Differences Between Linux and Windows File Organization

Before exploring the directories, it helps to understand a few differences in how Linux and Windows organize files. If you are familiar with Windows, the following points will help you find your way around Linux.

Forward Slash - Linux uses forward slashes to separate directories in a path, such as /var/www/. Windows commonly uses backslashes, as in C:\Windows\System32.
Folder versus Directory - Linux documentation commonly uses the term “directory” for what you may know as a folder. For the purpose of this article, the terms are used interchangeably.
Case-Sensitive Filenames - Linux filenames are normally case-sensitive. For example, the following names can identify separate files in the same directory:
- filename.txt
- FILENAME.txt
- fileNAME.txt
- FileName.txt
- fiLeNaMe.txt
Drive Letters - Windows uses drive letters (such as C: or D:) to identify storage volumes. In Linux, files are organized under a single directory tree that begins at the root directory (/). A storage partition may be identified by a device name such as /dev/sdb2 or /dev/nvme0n1p2, but you access its files through the directory where its filesystem is mounted, such as /mnt/data. Think of the device name as identifying the storage and the mount point as the location where you browse its files. For permanent mount settings, administrators commonly use a filesystem’s UUID, a unique identifier, because device names can change.
Administrator Account - In Linux, the root user is the superuser account and normally has full administrative privileges. However, multiple users can be given permission to perform administrative tasks through tools such as sudo. Depending on how permissions are configured, a user may be allowed to run only certain administrative commands or have broader access. This allows administrators to work from their own accounts and use elevated privileges when needed.

Understanding the Root Directory (/)

In Linux, all files and directories are organized under a single directory tree that begins at /, called the root directory. Directories such as /etc, /home, and /var sit beneath it. You can think of / as the starting point for locating any file on your system.

Although everything appears in one tree, the files may be stored on different drives or filesystems. For example, /home may be stored on a separate drive from the rest of the operating system. Linux makes that filesystem available by mounting it at /home. Once mounted, you access its files through /home just as you would any other directory. A directory where a filesystem is attached is called a mount point.

It’s worth noting that the root directory (/) and the root user’s home directory (/root) are different locations. The root directory is the top of the entire directory tree, while /root is normally where the root user keeps personal files and settings.

Common Linux Directories

The directories below are grouped by their main purpose to help you see how they fit together. Some serve more than one purpose, so these groups are a practical guide rather than strict categories.

Commands, libraries, and installed software

/bin - The /bin (binaries) directory traditionally contains essential commands that Linux users need, such as ls to list files and directories and cp to copy them. On many modern Linux distributions, /bin is a shortcut (symbolic link) to /usr/bin, so both paths lead to the same commands. Programs stored here can be compiled binaries or executable scripts. Some commands, such as cd to change directory, are built into the shell rather than stored here as separate programs.
/sbin - Like /bin, this directory traditionally contains essential system programs. However, these programs are primarily intended for system administration and maintenance, such as fsck to check and repair a filesystem. A typical user may be able to run a command stored here, but tasks that change protected system settings generally require root privileges or permission through sudo. On modern distributions, /sbin may be a symbolic link to a directory under /usr, and some distributions store administrative and general commands together.
/lib, /lib32, /lib64 - These contain kernel modules and shared library files your applications use to perform common or specific functions.
/usr - Despite its name, this directory is not the usual location for users' personal folders. Instead, it contains much of the system's installed software, including commands, libraries, documentation, and files shared by applications. Common locations include /usr/bin for commands, /usr/lib for libraries, and /usr/share for documentation and other shared files. On many modern distributions, directories such as /bin and /lib are symbolic links to locations under /usr. Most distribution-provided software here is managed through the package manager, while software installed and maintained locally by an administrator commonly goes under /usr/local.
/usr/local - This directory is a standard location for software installed and maintained locally by a system administrator, separate from software managed by the distribution. For example, a program you compile from source may install its commands in /usr/local/bin and its libraries in /usr/local/lib. Keeping locally maintained software here helps avoid conflicts with distribution-provided files under /usr. However, the actual location depends on the application’s installation settings. Include any software and configuration you maintain here in your backup and recovery planning.
/opt - This directory is a standard location for installing additional software, particularly third-party applications. An application or vendor will often have its own folder here, such as /opt/example-app. It can contain a complete application rather than just add-on components. Related configuration files may be stored under /etc/opt, while application data that changes over time may be stored under /var/opt. Whether an application uses these locations depends on how it is packaged.

System configuration

/etc - Pronounced et-see, this directory contains system-wide configuration files. As a Linux administrator, you will often work here to configure services, networking, and security settings. Examples include /etc/ssh/sshd_config for the SSH server and /etc/fstab for filesystem mount settings. You may also encounter /etc/hosts.allow and /etc/hosts.deny on older systems, but these only affect services that support TCP Wrappers and are not general firewall rules. Users' personal application settings are normally stored in their home directories instead.

Startup and boot files

/boot - This directory commonly contains files needed to start Linux, including the kernel, boot loader files, and an initramfs image. The initramfs provides an early startup environment that helps Linux load drivers and access the root filesystem. On systems using UEFI firmware, some startup files are stored on a separate EFI System Partition, which may be mounted at /boot/efi, /efi, or /boot itself. The exact arrangement depends on your distribution and installation. As an administrator, you should keep an eye on available space here, since accumulated kernel files can cause updates to fail. Use your distribution’s supported tools to remove older kernels rather than deleting unfamiliar files manually.

User home directories

/home - This directory is the usual location for users’ personal home folders, such as /home/alex. Each user’s home folder contains their personal files and application settings, often saved in hidden files or directories whose names begin with a dot. Many applications store settings in ~/.config, cached files in ~/.cache, and application data in ~/.local/share. The ~ represents the current user’s home directory, so ~/.config would normally mean /home/alex/.config for the user alex. These are common defaults, but applications and user settings may use other locations.
Whether another user can access these files depends on the permissions and security settings; a home folder is not automatically private. Some accounts have home folders elsewhere. For example, the root user’s home folder is normally /root, while accounts used to run system services may have a different home location or no usable home folder.
/root - This is the usual home directory of the root user. It is located directly under the root directory (/) rather than inside /home. Keeping it separate helps the root user access their personal files and settings when /home is stored on another filesystem that is unavailable, such as during system recovery or maintenance.

Service data and changing files

/srv - Short for service, this directory is a standard location for data your system provides through services. For example, a web server may serve website files from a directory beneath /srv, while an FTP server may use /srv/ftp. The exact layout depends on your distribution and how the service is configured; some web servers use /var/www instead. Think of /srv as a location for content provided by a service, rather than for its programs or configuration files.
/var - Short for variable, this directory contains data that changes as your system runs. Common examples include logs in /var/log, cached files in /var/cache, persistent application data in /var/lib, and queued work such as outgoing mail or print jobs in /var/spool. User mailboxes may be stored in /var/mail, depending on the mail system, and some web servers keep website files in /var/www. As an administrator, you should monitor space usage here because growing logs, databases, or queues can fill the filesystem and interrupt services.

Temporary files and runtime data

/tmp - This directory provides storage for short-lived temporary files created by applications and users. Depending on your distribution and system settings, its contents may be removed during a reboot or by scheduled cleanup. Some systems keep /tmp in memory using a tmpfs filesystem. You should not store important files here or assume they will remain available. Temporary files that need to survive a reboot generally belong in /var/tmp, although older files there may also be removed by cleanup policies.
/run - This directory stores temporary information that the system and its applications need while running. Examples include information about logged-in users, files recording a service’s process ID, and sockets that programs use to communicate. On many modern distributions, /run uses a memory-backed filesystem called tmpfs. Its contents do not survive a reboot and are recreated as needed. Unlike /proc, which provides information directly from the kernel, /run holds files created by services and other system programs.

Devices and kernel information

/dev - Short for devices, this directory contains special files that programs use to interact with devices, such as hard drives, keyboards, and webcams. Many of these device files are created automatically as devices are detected. However, not every device has a corresponding file here; network adapters, for example, are managed through other system interfaces. You will also find special files such as /dev/null, which discards data written to it, and /dev/zero, which provides a stream of zero bytes.
/proc - Short for process, this directory provides information about running processes and the system itself. It is a virtual filesystem, meaning its contents are provided by the kernel rather than stored as ordinary files on a drive. Each visible process has a numbered directory, such as /proc/1234, that appears when the process starts and disappears when it ends. Other files, such as /proc/cpuinfo and /proc/meminfo, provide CPU and memory information. As an administrator, you can use this information for monitoring and troubleshooting. Some files, particularly under /proc/sys, allow you to change kernel settings, so you should understand their purpose before modifying them.
/sys - This directory is the usual location of sysfs, a virtual filesystem that provides information about devices, drivers, and other parts of the running kernel. For example, /sys/class/net contains entries for network interfaces, while /sys/block contains entries for block devices such as storage drives. Unlike ordinary configuration files in /etc, these entries reflect the running system. As an administrator, you can use them to gather information and troubleshoot hardware or driver problems. Some entries also allow you to change device or kernel settings, so you should understand their purpose before writing to them.

Mount points and filesystem recovery

/media - This directory is a standard location for mounting removable storage, such as USB flash drives and optical discs. On desktop systems, software may automatically mount these devices in a folder beneath /media. Some distributions use /run/media followed by your username instead. The location depends on your system’s configuration and the software handling the mount.
/mnt - Short for mount, this directory is commonly used by system administrators to temporarily mount a filesystem. For example, you might mount a drive at /mnt/data to inspect its files or perform maintenance. It remains useful on modern Linux systems. Storage that needs to remain available permanently may use a different mounting point chosen for its purpose.
/cdrom - Some Linux distributions use, or previously used, this directory as a mounting point for CDs and DVDs. It is not present on every system. Depending on your distribution and the software handling the mount, an optical disc may instead appear under /media, /run/media, or another configured location.
/lost+found - On ext2, ext3, and ext4 filesystems, this directory is used to hold files and directories recovered during a filesystem repair when their original location cannot be determined. You may find a lost+found directory at the top of each of these filesystems. For example, if /home is on a separate filesystem, it may have its own /home/lost+found directory. This directory is not used by every Linux filesystem and is not a general location for recovering deleted files.

Which Files Stay After a Reboot?

As a Linux administrator, it helps to know which directories hold long-term data and which contain temporary files. This matters when planning backups, troubleshooting disk space, or deciding where an application should save its information.

The following table summarizes the usual behavior. Your distribution, application settings, and cleanup policies may affect how long files are kept.

Directory	What's In Here?	Survives a Reboot?	What You Should Know
/etc	System-wide configuration files	Normally, yes	Back up configuration changes so you can restore services and system settings.
/usr	Installed programs, libraries, and shared resources	Normally, yes	Manage distribution-provided files through the package manager. Include locally maintained software under /usr/local in your backup planning.
/var/lib	Persistent application data, such as databases and service state	Normally, yes	Often essential to recovery. Databases may require application-specific backup procedures to produce a usable backup.
/var/cache	Cached data that applications can recreate	Normally, yes, but applications or cleanup tools may remove it	Use the application’s supported cleanup method rather than deleting unfamiliar files.
/run	Runtime files, such as service sockets and process ID files	No	Services recreate these files as needed. Do not use this directory for data that must survive a reboot.
/tmp	Short-lived temporary files	Not guaranteed	Files may be removed at boot or by periodic cleanup. Do not keep important files here.
/var/tmp	Temporary files that need to remain available across reboots	Normally, yes	Cleanup policies may still remove older files. This is not a location for permanent storage.

A useful distinction is that persistent does not mean permanent. Files in /var/cache and /var/tmp may survive a reboot but still be removed later. Important files should be stored in an appropriate long-term location and included in your backup plan.

Explore the Directory Structure on Your System

The directory layout can vary between Linux distributions. The following commands let you explore your own system without changing files or settings. You can normally run them without sudo.

Check for directory shortcuts

ls -ld /bin /sbin /lib*

This lists the directories themselves rather than their contents. A line beginning with l identifies a symbolic link, and the arrow (->) shows its destination. For example, you may see /bin -> usr/bin, meaning /bin points to /usr/bin. Your system may have different links or library directories.

To see the full destination of /bin, run:

readlink -f /bin

On a system where /bin links to /usr/bin, the output will be /usr/bin.

Identify storage devices and filesystems

lsblk -f

This shows block storage devices and information about their filesystems, including filesystem types, UUIDs, and mount points where available. Look for / in the mount-point column to identify the filesystem used for the root directory. You may also see separate filesystems mounted at /home or /boot.

It’s worth noting that this is a view of block storage, not every mounted filesystem. Virtual filesystems and network shares may not appear here.

Check where a directory is stored

findmnt --target /home

This shows the mounted filesystem that contains /home. If /home is on a separate filesystem, the target will normally be /home. If it is an ordinary directory within the root filesystem, the target will normally be /. Some layouts, such as those using Btrfs subvolumes, may show additional details.

You can also compare several locations:

df -h / /home /var

This displays filesystem capacity and available space in a readable format. If these directories share a filesystem, you may see the same filesystem listed more than once. The figures describe the containing filesystem—not how much space each directory’s files use.

Troubleshooting: Why Is /var Full?

The /var directory holds data that changes as your system runs, such as logs, cached files, and application databases. If the filesystem containing /var fills up, services may fail to save data or operate normally. The following checks can help you find where the space is being used.

Check the available space

df -h /var

This shows the capacity and available space of the filesystem containing /var. If /var is not mounted separately, the figures describe the filesystem it shares with other directories, often the root filesystem.

Find the larger directories

sudo du -x -h --max-depth=1 /var

This summarizes the space used by /var and each directory immediately beneath it. The -h option displays readable sizes, while -x keeps the scan within the filesystem where it starts. The command reads files without changing them, although it may take time on a busy server.

If /var/log stands out, you can look one level deeper:

sudo du -x -h --max-depth=1 /var/log

It’s worth noting that -x skips separately mounted filesystems beneath the directory you are checking. Check those mount points separately if needed.

Choose the right cleanup approach

What you do next depends on the type of data using the space:

Logs in /var/log - Check whether a service is repeatedly reporting an error and whether log rotation is working. Removing old logs without addressing the cause may only provide temporary relief.
Cached files in /var/cache - Use the application’s or package manager’s supported cleanup command. Do not assume every file can be safely removed while its application is running.
Application data in /var/lib - Treat this as important service data. Database files, container storage, and other application files should be managed through the application’s supported tools.

On systems using the systemd journal, you can also check its disk usage:

sudo journalctl --disk-usage

This reports the space used by journal files. The journal may be stored under /var/log/journal or /run/log/journal, so its reported size does not always represent space used in /var.

If df reports much more used space than du can account for, a running program may still have a deleted file open. Filesystem snapshots and other storage details can also affect the figures. Investigate the difference before removing more files.

References and Further Reading

If you would like to learn more about Linux directories or the commands used in this article, the following references are useful starting points. Keep in mind that your distribution may follow different conventions or provide additional guidance.

Filesystem Hierarchy Standard (FHS) 3.0 - Explains the standard purposes of Linux directories and the types of files that belong in each location.
Modern Linux File System Hierarchy - Describes modern layout conventions, including symbolic links into /usr and the separation of configuration, persistent data, and runtime files.
Linux Kernel Documentation: sysfs - Provides a more technical explanation of how /sys exposes information about kernel objects and their attributes.
GNU Coreutils Manual - Covers commands used in this article, including ls, readlink, df, and du, with explanations of their available options.
journalctl Manual - Explains how to inspect the systemd journal, check its disk usage, and work with its other options.

You can also read the manual pages installed on your system. For example, run man lsblk or man findmnt to learn more about the storage commands used above. Your locally installed manuals normally describe the command versions available on your system.