Linux Directories: A Map of the Filesystem
Every important directory on a Linux server, what lives there, and why it lives there.
How to Read This Index
Linux follows the Filesystem Hierarchy Standard — a convention going back to the early '90s that says where things go on every Unix system. Once you know the map, the box stops feeling like a maze: you can guess where a config lives before you find for it, and you can read a df output and know which mount is going to fill up first. This index walks the tree top-down, the way you'd explore it on a fresh server. The full alphabetical list at the bottom is for direct lookup.
1. The Root Directory
/ is the top of everything. Unlike Windows there are no drive letters — every disk, every USB stick, every network mount hangs off this single tree at some chosen point. That single namespace is one of the quietly perfect ideas Unix gave us.
/— the root of the filesystem; everything else is a subdirectory of this
2. Binaries — Where Commands Live
When you type ls, the shell searches your PATH for an executable called ls. These are the directories that show up in that path. The split between bin and sbin is "everyone uses this" vs "admin uses this"; the split between /bin and /usr/bin is a historical accident from the days when /usr was on a separate, slower disk and only the boot-critical binaries lived in /bin. On modern distros (Debian, Fedora, Arch) the two have been merged via symlinks — /bin is just a pointer to /usr/bin — but the directories are still there and still mean what they always meant.
/bin— essential user binaries needed at boot (ls,cp,bash)/sbin— essential system binaries for admin and recovery (fsck,mount)/usr/bin— the vast majority of user commands installed by the distro/usr/local/bin— binaries you installed yourself, not from the package manager
3. Configuration
/etc is the answer to "where do I change this?" — almost every system-wide setting on the box lives here, in plain text, editable with vim and trackable in git. The convention is one file or one subdirectory per service. Cron splits its jobs across five directories so you can drop a script in without editing the main crontab; sysctl reads every file under /etc/sysctl.d; init scripts hide in /etc/rc.d on older systems.
/etc— system-wide configuration files for the OS and installed services/etc/default— per-package default environment variables read at startup/etc/cron.d— drop-in cron job files (one per package or admin)/etc/cron.hourly— scripts run every hour by cron/etc/cron.daily— scripts run once a day (logrotate, mlocate, apt)/etc/cron.weekly— scripts run once a week/etc/cron.monthly— scripts run once a month/etc/rc.d— legacy SysV init scripts, still around on older boxes/etc/sysctl.d— drop-in kernel tuning files applied at boot
4. The Live Kernel View
Here's where Unix's "everything is a file" idea gets beautiful. /proc and /sys aren't real directories on disk — nothing is stored there. They're windows the kernel opens into its own running state. cat /proc/loadavg and you've just read the same numbers uptime reports. cat /proc/<pid>/status and you've inspected a live process. Every shiny monitoring tool you'll ever use, including top, is a face over these files.
/proc— virtual filesystem exposing every process and most kernel state as files/proc/bus— bus devices the kernel knows about/proc/bus/pci— PCI bus enumeration, one file per device/proc/pressure— PSI: how stalled the system is on CPU, memory, IO/proc/sys— tunable kernel parameters; the live counterpart to/etc/sysctl.d/sys— sysfs: hardware topology, drivers, devices as a tree
5. Variable Data — Logs, Databases, Spool
/var is "stuff that grows." Logs from every service, databases, mail spools, package manager state, cron's records of what it's run. When df tells you the root filesystem is full at 3am, this is the first place you du into. Most of the time the culprit is /var/log — an Apache error log that's been growing unbounded since log rotation broke six weeks ago, or a journald binary that nobody capped.
/var— variable data: anything that grows or changes during normal operation/var/log— system and service logs; the first place to look when something broke/var/log/apache2— Apache's access and error logs
6. Temporary Files
The classic newcomer surprise: /tmp is wiped on every reboot (and on many distros it's a tmpfs living in RAM), while /var/tmp survives. The intent is "ephemeral working space" vs "scratch I might still need tomorrow." If your service writes its state under /tmp you'll find out the hard way after the next kernel update.
/tmp— temporary files; wiped on reboot, often a RAM-backed tmpfs
7. User Homes
One directory per human, plus the special one for root. Your shell starts here, your dotfiles live here, your SSH keys live here in ~/.ssh. The convention that a tilde expands to your home directory is so deep into shell muscle memory you forget it's a convention at all.
/home— each regular user gets/home/<username>as their home/root— the home directory of the root user, kept separate from/homeso it's reachable even when/homeis a separate mount that didn't come up
8. Devices
/dev is the other "everything is a file" classic. Every disk, every serial port, every random-number source the kernel exposes shows up as a file you can read or write. cat the disk and you get its raw bytes (don't); read from /dev/random and the kernel hands you entropy; write to /dev/null and your bytes vanish. The character/block-device split and the major/minor number system underneath are forty years old and still in use.
/dev— device files: disks, terminals, random, null, and every other piece of hardware the kernel exposes
9. Mounts and External Filesystems
Where you hang external things off the tree. /media is for things the system auto-mounts (USB sticks, optical disks); /mnt is the polite "I, the admin, am mounting something here for a moment." A modern Linux box also has /run — a tmpfs holding PID files and sockets for running services — though it doesn't have its own page yet.
/media— mount points for removable media (USB drives, optical disks)/mnt— temporary mount point for admin use (NFS shares, loop devices)/srv— data served by this machine: web roots, FTP roots, by-service convention
10. The Boot Loader
The handful of files the system needs to come up. The kernel image (vmlinuz-*), the initial RAM disk (initrd.img-*), and GRUB's config and stage files. If you've ever had to rescue a box from a botched kernel upgrade, you've spent quality time here.
/boot— kernel image, initrd, and bootloader config
11. Libraries
Shared object files (.so — Linux's equivalent of Windows DLLs) and kernel modules. When a binary in /bin needs libc, this is where the dynamic linker finds it. Almost every binary on a modern system links against /lib or /usr/lib; static binaries are the exception.
/lib— shared libraries for binaries in/binand/sbin/lib/modules— kernel modules, one subdirectory per installed kernel version/usr/lib— shared libraries for everything in/usr/binand/usr/sbin
12. Userland — Programs, Sources, Shared Data
/usr started life meaning "user" but quickly came to mean "Unix System Resources" — it's where the bulk of the distribution lives. Binaries, libraries, headers, man pages, icons, fonts. On modern distros most of / is symlinks into /usr. The split with /usr/local is the important one: /usr is what your package manager owns, /usr/local is what you own. Putting your custom binaries in /usr/local/bin keeps them safe from apt upgrades.
/usr— the main hierarchy for read-only user programs and data/usr/include— C/C++ header files needed when compiling against system libraries/usr/share— architecture-independent shared data: man pages, icons, locales
13. Optional Software
/opt is where third-party self-contained applications land — vendors who don't want to spread themselves across /usr/bin, /usr/lib, /usr/share. Chrome installs to /opt/google/chrome. The convention is /opt/<vendor>/<product> with the whole application living under that one tree, easy to wipe with rm -rf.
/opt— self-contained third-party application packages
Full Alphabetical List
Every directory in the knowledge base, A to Z. Jump straight here if you know the path you're looking for.
/: the top of the filesystem hierarchy; the starting point for every other directory/bin: essential user binaries needed at boot/boot: kernel image, initrd, and bootloader files/dev: device files for disks, terminals, and every piece of hardware the kernel exposes/etc: system-wide configuration files for the OS and installed services/etc/cron.d: drop-in cron job files, one per package or admin/etc/cron.daily: scripts run once a day by cron/etc/cron.hourly: scripts run every hour by cron/etc/cron.monthly: scripts run once a month by cron/etc/cron.weekly: scripts run once a week by cron/etc/default: per-package default environment variables read at startup/etc/rc.d: legacy SysV init scripts/etc/sysctl.d: drop-in kernel tuning files applied at boot/home: user home directories, one per regular user/lib: shared libraries for binaries in/binand/sbin/lib/modules: kernel modules, one subdirectory per installed kernel version/media: mount points for removable media such as USB drives and optical disks/mnt: temporary mount point for admin use/opt: self-contained third-party application packages/proc: virtual filesystem exposing process and kernel state as files/proc/bus: bus devices the kernel knows about/proc/bus/pci: PCI bus enumeration, one file per device/proc/pressure: pressure stall information for CPU, memory, and IO/proc/sys: tunable kernel parameters; the live counterpart to/etc/sysctl.d/root: home directory of the root user/sbin: essential system binaries for admin and recovery/srv: data served by this machine: web roots, FTP roots/sys: sysfs: hardware topology, drivers, and devices as a tree/tmp: temporary files; wiped on reboot, often a RAM-backed tmpfs/usr: the main hierarchy for read-only user programs and data/usr/bin: the vast majority of user commands installed by the distro/usr/include: C/C++ header files for compiling against system libraries/usr/lib: shared libraries for everything in/usr/binand/usr/sbin/usr/local/bin: binaries you installed yourself, outside the package manager/usr/share: architecture-independent shared data such as man pages and icons/var: variable data: anything that grows or changes during normal operation/var/log: system and service logs/var/log/apache2: Apache's access and error logs
Not sure which directories on your own server are quietly filling up right now?
CleverUptime watches the mounts that matter —
/varfor log and database growth,/tmpfor runaway scratch files,/procfor live pressure — and tells you in plain language which directory is the problem before the disk hits 100%.Want to see your own server's health right now? One command, no signup, no install.