Navigating the Filesystem
Navigating the Filesystem
Every action a DevOps engineer takes — deploying an app, tailing a log, auditing a config — starts with knowing exactly where you are on disk and how to move deliberately. Linux uses a single unified tree rooted at /. There is no C:\ or D:\; every device, network share, and virtual filesystem is mounted somewhere inside that one tree. Understanding the layout is not optional background knowledge — it is the map you navigate every day in production.
The Filesystem Hierarchy Standard (FHS)
The Filesystem Hierarchy Standard (FHS) defines what belongs where. Every major Linux distribution follows it. When you SSH into an unfamiliar Ubuntu, RHEL, or Alpine server you have never touched, you already know where to look for config files, logs, and binaries because FHS is consistent.
The directories you will interact with most in DevOps work:
/etc— System-wide configuration files./etc/nginx/nginx.conf,/etc/ssh/sshd_config,/etc/cron.d/. Nothing executable lives here — only text config. When you change something in/etcyou are changing behavior for the entire machine./var— Variable data that grows at runtime: logs (/var/log/), spool files, package databases (/var/lib/), web roots (/var/www/). Disk fills here first in production. Monitor it./usr— User-space programs installed by the package manager./usr/bin/holds most commands (python3,git,curl)./usr/local/bin/is the conventional place for software you compile or install outside the package manager./usr/share/holds architecture-independent data (man pages, locale files)./proc— A virtual filesystem that exposes the kernel's view of running processes and hardware. Nothing is stored on disk; the kernel generates it on demand./proc/[PID]/contains the entire state of a running process./proc/cpuinfoand/proc/meminfoare how tools liketopwork under the hood./binand/sbin— On modern systems these are symlinks to/usr/binand/usr/sbin(the "merged /usr" layout). They hold the essential binaries needed to boot and recover a system./home— User home directories. In production, application service accounts typically live under/home/deployor in/srv./tmp— Cleared on reboot (and sometimes by a systemd timer). Never store anything you need to keep here.
Absolute vs Relative Paths
An absolute path starts from / and is unambiguous regardless of where you are: /etc/nginx/nginx.conf. A relative path starts from the current working directory: ../log/nginx/error.log. In scripts and cron jobs always use absolute paths — relative paths depend on the working directory when the script runs, which is often not what you expect.
cron runs with a minimal environment and a different working directory. Use absolute paths everywhere in scripts called by cron or systemd.
Navigating with ls and cd
ls lists directory contents. cd changes the current directory. The special tokens . (current dir), .. (parent dir), ~ (your home dir), and - (previous dir) make navigation fast.
ls -lahrt sorts by modification time, most recent last — ideal for finding which config or log file just changed. Add | tail -20 to see only the most recent entries in a busy directory.
Searching with find
find is one of the most powerful filesystem tools in Linux. It traverses a directory tree and applies tests — name, type, permissions, size, modification time — letting you locate exactly what you need or act on it directly.
find is not just for searching — it is a filter pipeline that can exec arbitrary commands. At Google-scale the same mental model applies: you find candidates by metadata criteria, then act on them. The -exec flag runs a command per match; -execdir runs it from the file's own directory, which is safer against path injection.
Exploring /proc in Practice
Because /proc is just files, you can inspect live kernel state with nothing but standard text tools. This is how monitoring agents, container runtimes, and observability tools work internally.
Quick Reference: Navigation Shortcuts
pwd— print working directory (always know where you are)cd /— go to rootcd ~orcd— go to your home directorycd -— toggle to the previous directoryls -lahrt— long listing, all files, human sizes, sorted newest-lastfind . -name "*.log" -mmin -60— files changed in the last hourstat /path/to/file— full inode metadata: size, permissions, timestamps
find /var -xdev -size +50M -type f 2>/dev/null | sort -k5 -n (using ls -s output) or du -sh /var/log/* | sort -rh | head -20 are the first commands you run when df -h shows a filesystem at 95%. Know these cold.