Linux Directory Structure Explained: What Every Folder Does

Quick Answer: /etc = config files, /var = logs and data, /home = user files, /usr = installed programs, /tmp = temporary files, /opt = optional/third-party software, /dev = devices, /proc = process info. Everything starts from / (root).

The Filesystem Tree

In Linux, everything is organized in a single tree starting from / (root). There are no drive letters (C:, D:) like Windows — everything is a path under /.

/
├── bin/        Essential commands (ls, cp, cat)
├── boot/       Boot loader and kernel
├── dev/        Device files (disks, USB, etc.)
├── etc/        System configuration files
├── home/       User home directories
├── lib/        Shared libraries
├── media/      Mounted removable media
├── mnt/        Temporary mount points
├── opt/        Optional/third-party software
├── proc/       Process and kernel info (virtual)
├── root/       Root user's home directory
├── run/        Runtime data (PIDs, sockets)
├── sbin/       System admin commands
├── srv/        Service data (web, FTP)
├── sys/        Kernel and hardware info (virtual)
├── tmp/        Temporary files (cleared on reboot)
├── usr/        User programs and data
└── var/        Variable data (logs, databases, mail)

Every Directory Explained

/ (Root)

The top of everything. Every file on the system is under /. Only the root user has write access here.

ls /

/home — Your Files

Each user gets a directory here. Your documents, downloads, configs, and SSH keys live here.

/home/sam/              # Sam's home directory
/home/sam/Documents/
/home/sam/Downloads/
/home/sam/.ssh/          # SSH keys
/home/sam/.bashrc        # Shell config

The ~ shortcut always refers to your home directory:

cd ~            # Go home
ls ~/.ssh/      # Same as /home/sam/.ssh/

Dotfiles (files starting with .) are hidden by default. View them with ls -a.

/etc — Configuration Files

Every system-wide configuration lives here. If you've ever edited a config file, it was probably in /etc.

/etc/nginx/nginx.conf          # Nginx web server config
/etc/ssh/sshd_config           # SSH server config
/etc/fstab                     # Disk mount table
/etc/hosts                     # Static hostname mappings
/etc/hostname                  # This machine's hostname
/etc/passwd                    # User account info
/etc/shadow                    # Encrypted passwords
/etc/group                     # Group definitions
/etc/resolv.conf               # DNS resolver config
/etc/crontab                   # System-wide cron jobs
/etc/apt/sources.list          # APT package repositories
/etc/systemd/system/           # Custom systemd services
/etc/ufw/                      # Firewall rules
/etc/letsencrypt/              # SSL certificates

Key rule: System-wide settings go in /etc. Per-user settings go in ~/.config/ or dotfiles in your home directory.

/var — Variable Data

Data that changes during normal operation: logs, databases, mail queues, cache.

/var/log/                      # System logs
/var/log/syslog                # General system log
/var/log/auth.log              # Authentication log (SSH, sudo)
/var/log/nginx/access.log      # Web server access log
/var/log/nginx/error.log       # Web server errors

/var/www/html/                 # Default web server root
/var/lib/docker/               # Docker data (images, containers, volumes)
/var/lib/mysql/                # MySQL/MariaDB databases
/var/lib/postgresql/           # PostgreSQL databases
/var/mail/                     # User mailboxes
/var/cache/                    # Application caches
/var/spool/cron/               # User crontabs
/var/backups/                  # System backups

This is the directory that grows over time. Monitor it with df -h and du -sh /var/*.

/usr — User Programs

Installed programs, libraries, and documentation. Most of the software you install via apt or dnf ends up here.

/usr/bin/                      # User commands (python3, git, curl, node)
/usr/sbin/                     # Admin commands (nginx, sshd, ufw)
/usr/lib/                      # Libraries for /usr/bin and /usr/sbin
/usr/local/bin/                # Manually installed programs (not from apt)
/usr/local/lib/                # Libraries for manually installed programs
/usr/share/                    # Architecture-independent data (docs, icons, man pages)
/usr/share/man/                # Manual pages (read with `man` command)
/usr/include/                  # C/C++ header files

/usr/local/ is where you put things you install manually (from source, curl scripts, etc.) so they don't conflict with system packages.

/bin and /sbin — Essential Commands

Essential system commands needed for booting and basic operation.

/bin/ls          # List files
/bin/cp          # Copy files
/bin/mv          # Move/rename files
/bin/rm          # Remove files
/bin/cat         # View file contents
/bin/bash        # The Bash shell
/bin/mount       # Mount filesystems

/sbin/fdisk      # Partition disks
/sbin/iptables   # Firewall
/sbin/reboot     # Reboot system
/sbin/shutdown   # Shutdown system

On modern systems (Ubuntu 20.04+, Debian 12+), /bin and /sbin are actually symlinks to /usr/bin and /usr/sbin. They're the same directory.

/tmp — Temporary Files

A scratch space. Any user can write here. Files are automatically deleted on reboot (or sooner, depending on configuration).

# Create temp files for scripts
mktemp                    # Creates a unique temp file
mktemp -d                 # Creates a unique temp directory

# Common uses
/tmp/apt-dpkg-install-*/  # Package installation temp files
/tmp/systemd-private-*/   # Service-specific temp directories

Security note: /tmp is world-writable. Never store sensitive data here. On many systems, /tmp is mounted with noexec to prevent running scripts from temp.

/opt — Optional Software

Third-party software that doesn't follow the standard /usr layout goes here. Things installed by vendors, custom scripts, or self-contained applications.

/opt/samnet-cms/               # Custom CMS installation
/opt/google/chrome/            # Google Chrome
/opt/containerd/               # Container runtime
/opt/scripts/                  # Custom admin scripts

When to use /opt: When you're deploying your own application or installing something that ships as a complete directory (not individual files spread across /usr).

/dev — Devices

Everything in Linux is a file — including hardware devices. This directory contains special files that represent hardware.

/dev/sda                  # First hard drive
/dev/sda1                 # First partition of first drive
/dev/sdb                  # Second drive (USB stick, etc.)
/dev/nvme0n1              # NVMe SSD
/dev/tty                  # Current terminal
/dev/null                 # Black hole (discard output)
/dev/zero                 # Infinite stream of zeros
/dev/urandom              # Random data (for keys, passwords)

Common uses:

# Discard command output
command > /dev/null 2>&1

# Generate random data
head -c 32 /dev/urandom | base64    # Random 32-byte key

# Create a test file of specific size
dd if=/dev/zero of=testfile bs=1M count=100    # 100MB file

# Check disk partitions
ls /dev/sd*
ls /dev/nvme*

/proc — Process Information (Virtual)

Not a real directory on disk — the kernel generates it on the fly. Contains information about running processes and the system.

/proc/cpuinfo             # CPU details
/proc/meminfo             # Memory stats
/proc/uptime              # System uptime
/proc/loadavg             # System load
/proc/version             # Kernel version
/proc/1/                  # Information about process ID 1 (init/systemd)
/proc/self/               # Current process

cat /proc/cpuinfo | grep "model name"    # What CPU?
cat /proc/meminfo | grep MemTotal        # How much RAM?
cat /proc/uptime                          # How long since boot?

/sys — System and Hardware (Virtual)

Like /proc but organized by subsystem (block devices, network, firmware, etc.). Used by the kernel to expose hardware information.

/sys/class/net/            # Network interfaces
/sys/class/block/          # Block devices (disks)
/sys/devices/              # All hardware devices

# Check network interface speed
cat /sys/class/net/eth0/speed    # e.g., 1000 (Mbps)

# Check disk scheduler
cat /sys/block/sda/queue/scheduler

/boot — Boot Files

Kernel, initramfs, and bootloader files. Don't touch these unless you know what you're doing.

/boot/vmlinuz-*            # Linux kernel
/boot/initrd.img-*         # Initial RAM disk
/boot/grub/                # GRUB bootloader config
/boot/firmware/            # Raspberry Pi firmware/config

/root — Root's Home

The home directory for the root user. Not the same as / (the filesystem root).

/root/.bashrc              # Root's shell config
/root/.ssh/                # Root's SSH keys

/media and /mnt — Mount Points

/media/sam/USB_DRIVE/      # Auto-mounted USB drives
/media/sam/CDROM/          # Auto-mounted optical drives

/mnt/                      # Manual mount point
/mnt/backup/               # Manually mounted backup drive
/mnt/nfs/                  # Manually mounted NFS share

/media is for auto-mounted removable media (by the desktop environment). /mnt is for temporary manual mounts.

/run — Runtime Data

Temporary runtime files created since the last boot. PID files, sockets, lock files.

/run/sshd.pid              # SSH daemon process ID
/run/docker.sock           # Docker socket
/run/nginx.pid             # Nginx process ID
/run/systemd/              # Systemd runtime data

Cleared on every reboot.

/srv — Service Data

Data served by the system. In practice, most people use /var/www for web content instead of /srv, but /srv is the "correct" place according to the Filesystem Hierarchy Standard.

/srv/http/                 # Web server files
/srv/ftp/                  # FTP server files

Quick Reference

Need To	Look In
Edit a config file	`/etc/`
Find log files	`/var/log/`
User files	`/home/username/`
Web server root	`/var/www/html/`
Install custom software	`/opt/` or `/usr/local/`
Docker data	`/var/lib/docker/`
Temporary files	`/tmp/`
SSL certificates	`/etc/letsencrypt/`
SSH keys	`~/.ssh/`
System commands	`/usr/bin/`
Check CPU/RAM	`/proc/cpuinfo`, `/proc/meminfo`

Useful Commands

# See what's using the most space
du -sh /* 2>/dev/null | sort -rh | head -10

# Find a file by name
find / -name "nginx.conf" 2>/dev/null

# Find where a command lives
which nginx          # /usr/sbin/nginx
type ls              # ls is /usr/bin/ls

# Check filesystem usage
df -h

# Check a specific directory's size
du -sh /var/log

Related Guides

Linux Commands Cheat Sheet — essential commands
Linux File Permissions — chmod, chown, umask
chmod Cheat Sheet — permission reference
Linux Log Files — what's in /var/log
Bash Cheat Sheet — shell scripting
How to Mount a Drive — adding storage
VPS Setup Guide — first server setup