Blog

On Linux, everything begins at /, known as the root directory. This is different from the root user account: the slash is the top of the filesystem tree, while root is the administrator account. Every file, application, device entry, and mounted drive appears somewhere below that single slash.

This can feel unfamiliar if you are used to Windows, where storage is often split into drive letters such as C: and D:. Linux combines available storage into one directory tree. A separate disk, USB drive, or network share is attached—or mounted—at a chosen directory, such as /mnt/projects or /media/user/USB.

The map starts at root

Most Linux distributions follow a shared filesystem hierarchy. Ubuntu, Debian, Fedora, and many server distributions differ in a few details, but the main idea remains the same: system files, user data, temporary files, configuration, logs, and installed software each have expected locations.

To inspect the top level safely, open a terminal and run:

ls /

You may see directories such as bin, etc, home, usr, and var. Some names are historical, so their current purpose is not always obvious at first glance.

Directories new users encounter first

/home: personal workspace

/home contains home directories for regular users. If the account name is alex, the usual home directory is /home/alex. Personal documents, downloads, source code, browser profiles, and per-user settings normally live here.

The tilde character, ~, is shorthand for the current user’s home directory. For example:

cd ~
pwd

For user alex, the second command normally prints /home/alex. Keeping programming projects in your home directory is usually safer than placing them in system locations, since regular users can write there without administrator privileges.

Home directories also contain hidden configuration files and folders. In Linux, names beginning with a dot do not appear in a plain ls listing:

ls -la ~

Examples include .bashrc, which may configure an interactive Bash shell, and .config, where many desktop applications store settings. Hidden does not mean protected or unimportant; it is only a display convention. Avoid deleting unfamiliar dotfiles, especially while troubleshooting an application.

/root: the administrator’s home directory

/root is the home directory for the administrator account named root. It is intentionally separate from /home, and on many desktop systems a normal account cannot open it without elevated privileges.

Do not use /root as general storage for projects or downloads. Files created there may later be inaccessible to your regular account, and working as root routinely increases the damage a mistaken command can cause.

/tmp: short-lived working files

/tmp is meant for temporary data created by applications and scripts. Its contents may be cleared at reboot or by scheduled cleanup, depending on the distribution and its configuration. Do not keep code, notes, archives, credentials, or anything else important there.

Multiple users and programs may use /tmp, so secure programs need to handle files in it carefully. For beginners, the practical rule is simple: do not place sensitive material in a broadly accessible temporary directory unless the application is designed to protect it.

/mnt and /media: mounted storage

/mnt is traditionally used for manually mounted filesystems. Desktop environments often use /media for removable devices such as USB drives. The exact mount location depends on the distribution and desktop software.

Mounting a disk does not replace the root tree. Its files simply become visible below the mount point. If a drive is mounted at /mnt/archive, then /mnt/archive/report.txt refers to a file stored on that drive.

Where Linux keeps the operating system

System directories are usually best inspected rather than edited. Most changes in these locations require administrator access through tools such as sudo. Use elevation for deliberate system administration; adding sudo blindly can create ownership problems or overwrite important files.

/etc: configuration, not executable programs

The name /etc has a historical origin that is not especially intuitive, but its role is straightforward: it holds configuration used across the machine. You may find hostname settings, user and group information, service configuration, and package repository definitions there.

Before editing a text configuration file, make a backup somewhere you control and note what you changed. If you edit as an administrator, use a clear backup name instead of copying the file into an unrelated folder. Check the program documentation as well: many modern services load configuration from subdirectories such as /etc/ssh/ or /etc/systemd/.

/usr, /bin, and /sbin: programs and commands

/usr contains a large portion of installed software. Common command-line programs often live in /usr/bin, while shared libraries may be stored in /usr/lib or a distribution-specific equivalent.

Older Unix layouts separated /bin for essential commands and /sbin for system-administration commands. On many current distributions, /bin, /sbin, and sometimes /lib are symbolic links to matching locations under /usr. A symbolic link is a filesystem reference to another path—similar in concept to a shortcut, but handled directly by the filesystem.

Run ls -l /bin to check whether it is a symbolic link on your machine. Filesystem layouts are not identical across every Linux distribution.

/var: logs and changing service data

/var holds files that grow or change during normal operation. /var/log commonly stores logs, while package managers may save downloaded package data under /var/cache. Web servers, databases, print queues, and other services may keep their runtime data in their own directories under /var.

If disk space disappears unexpectedly, checking the size of /var is a sensible first step:

du -sh /var/* 2>/dev/null

This shows approximate sizes for accessible immediate subdirectories and hides permission-error messages. Be cautious about deleting anything under /var: removing logs, caches, or service data manually can disrupt software that expects those files.

Special virtual directories: /dev, /proc, and /sys

Not every visible path represents ordinary data stored on disk. Linux exposes kernel and hardware information through virtual filesystems.

• /dev contains device files. A storage device, for example, may appear as /dev/sda or /dev/nvme0n1. These are interfaces to devices, not ordinary documents.
• /proc provides live information about running processes and kernel state. Files such as /proc/cpuinfo are generated by the kernel when accessed.
• /sys exposes information about devices, drivers, and kernel subsystems.

These directories are useful for observation and diagnostics, not for routine cleanup. Writing to certain kernel-controlled entries can change system behavior, so use trusted distribution documentation for administrative work.

Paths, navigation, and safe inspection

An absolute path starts with /, such as /home/alex/projects/app. A relative path starts from the current directory. If you are in /home/alex, then projects/app refers to the same location.

Three symbols appear constantly:

• . means the current directory.
• .. means the parent directory.
• ~ means the current user’s home directory in shell contexts.

These commands provide a safe starting toolkit for exploring the filesystem:

pwd                 # show current location
ls -lah             # list files with details and human-readable sizes
cd /etc             # move to an absolute path
cd ..               # move up one directory
findmnt             # show mounted filesystems

Quote paths that contain spaces or special characters. For example, cd "~/My Projects" does not expand ~ because it is inside quotes. Use cd "$HOME/My Projects" instead. The quotes prevent the shell from splitting the directory name into separate arguments.

A practical way to recognize what belongs where

When deciding where to create or look for a file, classify it by purpose:

1. Personal work: put it in a suitable directory under ~/, such as ~/Documents or ~/projects.
2. Shared system configuration: expect it under /etc, but change it only for a documented reason and with appropriate privileges.
3. Installed application files: look under /usr or sometimes /opt; use the package manager instead of editing them directly.
4. Logs and service state: check /var.
5. Removable or additional storage: look for a mount point under /media or /mnt.

For a practical check, run which python3 to find the command executable, then run readlink -f "$(which python3)" to resolve symbolic links. On many systems, the result leads to a path under /usr/bin, showing how a command name, a symbolic link, and the filesystem hierarchy connect.