On Linux, everything lives under a single root directory, /: there are no drive letters. The layout follows the Filesystem Hierarchy Standard (FHS), so once you learn it, you know where to find configs, logs and data on almost any distribution. Here’s a practical tour for server admins.

The top-level directories

Directory Contains Example
/ The root of everything —
/etc System and application configuration /etc/nginx/, /etc/ssh/sshd_config
/var Variable data: logs, caches, databases, mail, websites /var/log/, /var/lib/mysql/, /var/www/
/home Users’ home directories /home/alice/
/root The root user’s home /root/.ssh/
/usr Installed software (read-only in normal use) /usr/bin/, /usr/lib/, /usr/share/
/usr/local Software you install manually (not from packages) /usr/local/bin/
/opt Self-contained third-party apps /opt/app/, Docker Compose projects
/bin, /sbin, /lib Essential programs and libraries (now usually symlinks into /usr) /bin/bash
/tmp Temporary files, often cleared at reboot —
/boot Kernel and bootloader files vmlinuz-*, grub/
/dev Device files /dev/vda, /dev/null
/proc, /sys Virtual filesystems exposing kernel and process info /proc/cpuinfo, /proc/meminfo
/run Runtime data since boot (PID files, sockets) /run/php/php8.3-fpm.sock
/mnt, /media Mount points for extra disks and removable media /mnt/backup
/srv Data served by the system (optional convention) /srv/ftp, /srv/data
/lost+found Recovered file fragments after filesystem checks —

Where things live on a typical server

You’re looking for… Look in
Nginx/Apache config /etc/nginx/, /etc/apache2/ (Debian/Ubuntu), /etc/httpd/ (RHEL)
Website files /var/www/
Logs /var/log/ (plus journalctl). See journalctl
MySQL/PostgreSQL data /var/lib/mysql/, /var/lib/postgresql/
Docker data /var/lib/docker/
systemd unit files /etc/systemd/system/ (yours), /lib/systemd/system/ (packages). See systemd unit files
Cron jobs /etc/crontab, /etc/cron.d/, /var/spool/cron/. See crontab
SSL certificates (Let’s Encrypt) /etc/letsencrypt/
Users and groups /etc/passwd, /etc/group, /etc/shadow
Network config /etc/netplan/ (Ubuntu), /etc/network/ (Debian)

Why it matters

Disk space: /var grows (logs, databases, Docker images). When the disk fills, check there first:

sudo du -xh /var --max-depth=1 | sort -h

See disk full troubleshooting.

Backups: in most cases, back up /etc (configuration), /var/www, /home, /opt (your apps), database dumps, and /var/lib/docker/volumes if you use Docker volumes. Programs in /usr can be reinstalled from packages. See backup strategy and Docker volume backups.

Permissions: system directories belong to root. Your apps and data should live in directories owned by the app’s own user. See Linux file permissions explained.

Explore it yourself

ls /
tree -L 1 /                     # sudo apt install tree
cat /proc/meminfo | head
df -h                           # which filesystems are mounted where
findmnt                         # mount tree
man hier                        # the hierarchy manual page

Paths: absolute vs relative

  • Absolute paths start at /: /etc/nginx/nginx.conf.
  • Relative paths start from the current directory: logs/app.log.
  • ~ is your home directory, . the current directory, and .. the parent.
pwd
cd /var/log && ls
cd ~        # home
cd -        # previous directory

Quick reference

Need Directory
Config /etc
Logs /var/log
Web roots /var/www
App data /var/lib
Your own apps /opt or /srv
Temporary /tmp
System info /proc, /sys

Related: Linux hidden files and Linux find command.

  • Linux
  • Beginners
  • Filesystem