Learning Linux — II

This blog explains what the main Linux directories are for, with a real example for each. It's a reference, not a story — read it once, then come back to it whenever you're unsure where something belongs.

The commands used below (cat, ls, which) aren't explained here. If you don't know them yet, that's fine — a separate post covers basic commands. For now, just focus on what each directory holds.

Everything starts from a single root: /. Every directory lives somewhere under it. Quick reference first, then each one explained with something real inside it.

/bin and /sbin — the commands you use without thinking

Every basic command lives here as an actual file. /bin/ls is the ls command. Try it:

ls -l /bin/ls
which ls

/sbin holds the same idea but for admin-only commands — things like fdisk or reboot, which normal users don't run day to day. On most modern systems /bin and /sbin are actually just symlinks into /usr/bin and /usr/sbin now — a historical split that's mostly been merged away, but the names stuck around.

/usr — almost everything installed lives here

Despite the name, this has nothing to do with "user" in the personal-files sense. It's where installed software actually lands: programs, their libraries, their documentation. When you apt install something, most of it ends up somewhere under /usr.

which python3
# usually /usr/bin/python3
ls /usr/share/doc | head

/usr/local is the one exception worth remembering: it's for software you install yourself, outside the package manager — things you build from source. Package-manager software and your own hand-built software are kept apart on purpose, so upgrading one never clobbers the other.

/etc — every config file, system-wide

Short for "et cetera," though nobody really uses it that way anymore — it's config files, full stop. If a program has system-wide settings, they're a plain text file in here somewhere.

cat /etc/hostname
cat /etc/os-release
ls /etc/apt/

This is also where you'll end up if you ever configure networking, users, or services by hand — /etc/fstab for mounted drives, /etc/passwd for user accounts, and so on.

/var — the stuff that changes constantly

"Variable" data: logs, caches, anything that grows or changes while the system runs, as opposed to /usr's mostly-static installed programs.

ls /var/log
tail /var/log/syslog

If a machine is running out of disk space for no obvious reason, /var/log is usually the first place to check — logs that were never rotated or cleaned up can quietly eat gigabytes.

/opt — software that keeps to itself

For third-party applications that come as a single self-contained bundle rather than being broken up and scattered across /usr the normal package-manager way. Think commercial software, or anything installed from a vendor's own installer rather than apt.

ls /opt

If you ever install something like MATLAB or a vendor SDK by hand, this is often exactly where it wants to live — its own folder, everything it needs in one place, nothing smeared across the rest of the filesystem.

/home and /root — where people actually live

/home/yourname is your personal space — documents, downloads, your own config files (the hidden .bashrc, .config, and so on). /root is the same idea but specifically for the root user, kept separate from regular /home so the system's most privileged account isn't mixed in with everyone else's.

echo $HOME
ls -la ~

/tmp — genuinely temporary

Anything here can vanish on reboot, sometimes even sooner. Programs use it for scratch files mid-task. Never store anything here you actually want to keep.

/dev, /proc, /sys — not real files at all

These look like ordinary files and folders. They are not stored on disk. The kernel generates their content automatically, on demand.

cat /proc/cpuinfo
cat /proc/meminfo
ls /dev

/dev represents your actual hardware as files — /dev/sda is a disk, /dev/null is a black hole that discards anything written to it. /proc and /sys are windows into the running kernel and processes — read /proc/cpuinfo and you're not reading a file that exists anywhere on disk, you're asking the kernel to describe your CPU right now.

/mnt and /media — where other drives show up

/media is where removable stuff auto-mounts — USB sticks, external drives, usually under a folder named after the device or label. /mnt is the equivalent for things you mount by hand, temporarily, as an admin. Functionally similar; the difference is mostly about who's doing the mounting and how permanent it's meant to be.

/boot — what gets the machine running at all

The kernel image and the bootloader configuration live here — the small set of files needed before the rest of the system is even available. This is the same partition we set up as /boot/efi back in the partitioning post — it has to exist and be reachable before anything else on this list means anything.

You don't need to memorize this. Use it as a reference: if a program's config and its logs are in different folders, it's because configs and logs are never meant to hold the same kind of thing.