The directory tree

Why this matters

Every command you run takes file names, and every script reads or writes files somewhere. On Windows you may be used to drive letters (C:\, D:\); Unix has none. Instead there is one single tree of directories, and disks, USB sticks, network shares and even the kernel's own status information are attached to branches of it. Once you know the layout, you can find your way around any Linux machine, server or container, because they all follow the same plan.

One tree, starting at /

The top of the tree is the root directory, written as a single slash: /. Every file and directory on the system is somewhere below it. A path names a location by listing the directories you pass through, separated by slashes:

/                         the root directory
├── bin -> usr/bin        programs (on modern systems a link to /usr/bin)
├── dev                   device files: disks, terminals, /dev/null
├── etc                   system configuration (text files)
│   ├── apt
│   ├── hostname
│   └── passwd
├── home                  users' home directories
│   └── learner           your home directory, also written ~
├── proc                  live information about processes and the kernel
├── root                  the administrator's home directory
├── tmp                   temporary files, writable by everyone
├── usr                   installed software (read-only in normal use)
│   ├── bin               most programs: ls, grep, bash ...
│   ├── lib               libraries
│   └── share             architecture-independent data: man pages, docs
├── var                   variable data: logs, caches, spools
│   └── log
└── work                  this sandbox only: your lesson workspace

Open the shell for this lesson and look:

$ ls /
bin   dev  home  lib64  mnt  proc  run   srv  tmp  var
boot  etc  lib   media  opt  root  sbin  sys  usr  work

This layout is described by the Filesystem Hierarchy Standard and, on your system, by man 7 hier. The details vary a little between distributions, but /etc, /home, /tmp, /usr and /var mean the same thing everywhere.

Note the two different meanings of the word "root": the root directory /, and the root user (the administrator, whose home is /root). Module 4 covers the user.

Absolute and relative paths

A path that starts with / is absolute: it is followed from the root, and means the same thing wherever you are. /etc/hostname is always the same file.

A path that does not start with / is relative: it is followed from the current directory of the process. If your current directory is /etc, then apt/sources.list.d means /etc/apt/sources.list.d. If you are in /work, the same relative path means /work/apt/sources.list.d, which probably does not exist.

$ pwd
/work
$ ls /etc/apt
apt.conf.d  auth.conf.d  keyrings  preferences.d  sources.list.d  trusted.gpg.d
$ ls etc/apt
ls: cannot access 'etc/apt': No such file or directory

The second ls looked for /work/etc/apt. The error message tells you the path it tried; when a file "is not there", the first question is always "relative to what?".

Every directory contains two special entries: . (the directory itself) and .. (its parent). So .. from /work is /, and /usr/bin/.. is /usr. The root's parent is the root itself. You will use these constantly in the next lesson.

What happens underneath: path resolution

When a program opens /etc/apt/sources.list, it hands the whole string to the kernel. The kernel resolves it one component at a time:

"/etc/apt/sources.list"
 start at the root directory
 look up "etc" in it        → a directory
 look up "apt" in that      → a directory
 look up "sources.list"     → a file: open it

For a relative path, the kernel starts at the process's current directory instead of the root. That is the whole difference, and it is why each process having its own current directory matters. At each step the kernel also checks permissions (module 4): you need permission to pass through every directory on the way.

Directories are really just lists of names, each pointing at the actual file. You will see in module 3 that the name and the file are different things.

Many disks, one tree

A second disk or a USB stick is not a new letter: it is mounted onto an existing directory, called a mount point, and its contents appear there. The mount command (or cat /proc/mounts) shows what is attached where. In this container, /work is actually a directory on the host computer mounted into the container, and /tmp is a tmpfs, a filesystem that lives entirely in memory and disappears when the container stops.

$ df -h /work /tmp
Filesystem      Size  Used Avail Use% Mounted on
/dev/nvme0n1p3  930G  410G  519G  45% /work
tmpfs           128M     0  128M   0% /tmp

(Your numbers will differ.) df (disk free) shows which filesystem each path is on.

"Everything is a file"

Unix presents many things through the same file interface: open, read, write, close.

• /dev/null is a device that swallows everything written to it.
• /dev/tty is your terminal.
• /proc is a virtual filesystem: nothing in it is stored on a disk. When you read /proc/uptime, the kernel generates the text on the spot.

$ cat /proc/uptime
5321.47 5280.12
$ cat /proc/sys/kernel/hostname
sandbox
$ ls /proc
1  12  acpi  cmdline  cpuinfo  meminfo  mounts  self  sys  uptime  version ...

The numbered directories in /proc are running processes, by PID. /proc/self is always the process that is reading it. Module 13 explores this.

Because the same tools work on all of these, cat, grep and the rest can inspect hardware and kernel state without special programs.

Text configuration

Most of /etc is human-readable. Try:

$ cat /etc/hostname
sandbox
$ cat /etc/os-release
PRETTY_NAME="Debian GNU/Linux 13 (trixie)"
NAME="Debian GNU/Linux"
VERSION_ID="13"
...
$ head -3 /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin

This is a big part of why the shell is so powerful for administration: the configuration of the whole system is text, and the shell is a text tool.

Common mistakes

• Confusing /etc and etc. The leading slash is the difference between "from the root" and "from where I am".
• Writing Windows-style paths. Unix uses forward slashes /. A backslash \ means something else entirely in the shell (it quotes the next character).
• Assuming case does not matter. /etc/Hostname and /etc/hostname are different names; Linux filesystems are case-sensitive.
• Expecting to write anywhere. As an ordinary user you can write in your home directory, in /tmp and (here) in /work. touch /etc/test gives Permission denied; that is correct behavior, not a fault.

Recap

• There is one tree rooted at /; other disks are mounted onto directories in it.
• Absolute paths start with /; relative paths start from the current directory.
• Every directory has . (itself) and .. (its parent).
• /etc configuration, /home users, /tmp temporary, /usr software, /var changing data, /dev devices, /proc live kernel information.
• The kernel resolves paths one component at a time, from the root or the current directory.

Going further: read man 7 hier. Then run cat /proc/self/status | head twice and notice the Pid: line changes: each cat is a new process.