The Filesystem Hierarchy Standard (FHS), maintained by the Linux Foundation, defines the directory tree used by Linux and most Unix-like operating systems — making it possible to write software, scripts, and tools that work consistently across distributions. Understanding this hierarchy is foundational to system administration, debugging, and security: when something goes wrong on a Linux system, knowing exactly where logs live, where binaries are found, and how virtual filesystems expose kernel state can mean the difference between a quick fix and hours of confusion. A key mental model: the Linux filesystem is a single tree rooted at /, and every device, network share, or virtual interface is mounted as a subtree within it — nothing is outside the tree.
What This Cheat Sheet Covers
This topic spans 15 focused tables and 141 indexed concepts. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.
Table 1: Root Filesystem Top-Level Directories
The root directory / is the anchor point for every path on a Linux system. Each immediate child of / has a carefully defined role under FHS 3.0, and understanding what belongs where prevents both misconfiguration and unnecessary confusion when navigating an unfamiliar machine.
| Directory | Example | Description |
|---|---|---|
/bin/ls, /bin/bash | Essential user command binaries needed in single-user mode and before /usr is mounted; on modern distros a symlink to /usr/bin via usrmerge. | |
/etc/passwd, /etc/fstab | Host-specific system configuration files; must be static text — no binaries; the central nerve centre for system behaviour. | |
/var/log/syslog, /var/spool/mail | Variable data that changes during normal operation: logs, spools, caches, and runtime state. | |
/usr/bin/python3, /usr/lib/ | Shareable, read-only user data; the second major section; contains the bulk of installed programs and libraries. | |
/home/alice/.bashrc | User home directories; each user's personal data, configuration dotfiles, and settings live here. | |
mktemp /tmp/tmpXXXXXX | Temporary files; deleted on reboot (often tmpfs); writable by all users; sticky bit set so users cannot delete each other's files. | |
/dev/sda, /dev/null | Device files — character and block devices; managed at runtime by udev on devtmpfs. | |
/proc/cpuinfo, /proc/1234/ | Virtual filesystem (procfs) exposing kernel data structures and per-process information; nothing is stored on disk. | |
/sys/class/net/eth0/ | sysfs virtual filesystem exporting the kernel device model; organised by buses, classes, and devices; mounted on /sys. | |
/run/sshd.pid, /run/docker.sock | Runtime variable data (tmpfs); PID files, Unix sockets, and lock files valid only for the current boot — lost on reboot. |