Introduction

In this blog I am going to share discoveries i found while learning with Linux File System. Let's get started.

Linux File System

How does Linux File System looks like ?

/
├── bin/            # Essential user binaries (ls, cp, mv, etc.)
├── boot/           # Bootloader files, kernel images
│   ├── vmlinuz
│   └── grub/
├── dev/            # Device files (disks, terminals, etc.)
│   ├── sda
│   ├── null
│   └── random
├── etc/            # System-wide configuration
│   ├── passwd
│   ├── shadow
│   ├── hosts
│   ├── resolv.conf
│   └── systemd/
├── home/           # User directories
│   ├── user1/
│   └── user2/
├── lib/            # Shared libraries for binaries
├── lib64/          # 64-bit libraries
├── media/          # Mounted external devices (USB, CD)
├── mnt/            # Temporary mount points
├── opt/            # Optional third-party software
├── proc/           # Virtual filesystem (process & kernel info)
│   ├── cpuinfo
│   ├── meminfo
│   └── [pid]/
├── root/           # Root user's home directory
├── run/            # Runtime system data
├── sbin/           # System binaries (admin tools)
├── srv/            # Service-specific data
├── sys/            # Kernel and hardware interface
│   └── class/
├── tmp/            # Temporary files
├── usr/            # User utilities and applications
│   ├── bin/
│   ├── lib/
│   └── share/
├── var/            # Variable data (logs, cache, etc.)
│   ├── log/
│   ├── cache/
│   └── spool/
└── lost+found/     # Recovered files after filesystem errors

/etc

/etc is a system-wide configuration directory in Linux that contains static, host-specific configuration files.

It stores all the important configuration files that tell your system:

• how to behave

• how services should run

• who is allowed to do what

/etc = “Where Linux keeps its instructions and rules”

Key Discoveries:

• /etc/passwd → Stores user account metadata

• /etc/shadow → Stores hashed passwords (restricted access)

• /etc/hosts → Local DNS overrides (manual hostname → IP mapping)

• /etc/resolv.conf → Defines DNS servers

DNS Resolution

DNS resolution is the process of translating a domain name → IP address using a distributed, hierarchical system.

DNS is basically the internet’s phonebook. You type: google.com , your system needs: 142.250.x.x (IP address)

When you type a domain like google.com, Linux does not immediately query a DNS server. Instead, it follows a strict, configurable resolution pipeline defined entirely by system files.

This process is not hardcoded but driven by a set of key files that determine where to look, in what order, and how to resolve the query.

/etc/nsswitch.conf

• Defines resolution order and sources for hostname lookup

• Tells the system where to look first (e.g., local files vs DNS)

• Acts as the control policy for name resolution behavior

---

/etc/hosts

• Stores static hostname → IP mappings

• Provides local overrides for domain resolution

• If a match is found here, no DNS query is performed

---

/etc/resolv.conf

• Specifies DNS servers to query

• Contains resolver settings like search domains, timeout, retries

• Used only if resolution falls through to DNS lookup

Networking Internals

Linux networking is also exposed via the filesystem.

Key Locations:

• /proc/net/route → Routing table

• /proc/net/dev → Network interface stats

• /sys/class/net/ → Network interfaces

Each file has its own function, let us see what are they.

/proc/net/route

It is a virtual file that shows the system’s kernel routing table. Defines where packets should go. Just like google maps giving route

/var/log

It is a Virtual file showing real-time network statistics per interface

/sys/class/net/

It is a Directory exposing network interfaces as devices. Part of sysfs (kernel device model)

/var/log

Think of /var/log as a black box recorder (like in airplanes).

• Everything your system does → gets recorded

• If something goes wrong → you rewind logs to see what happened

/var/log contains persistent log files generated by:

• kernel

• system services

• applications

Managed by logging systems like:

• rsyslog

• systemd-journald

Insight:

Logs reveal:

• Failed login attempts

• Service crashes

• Hardware issues

This file is very useful for dev ops and backend engineers to see where their application gets crash. This is one of the most important file I have discovered.

User Management

As Linux is multi user operating system there must be a user management.

How does User management operates, how does it stores data of different user of different roles?

User data is stored in plain text files.

Files:

• /etc/passwd → user info

• /etc/shadow → encrypted passwords

• /etc/group → group memberships

/etc/passwd

What it stores

• Public user metadata (world-readable)

• One line per user

/etc/shadow

What it stores

• Hashed passwords + password policy

• Restricted: readable only by root

/etc/group

What it stores

• Group definitions and supplementary memberships

Permissions

As we now know Linux is Multi User Operating system. To ensure security and privacy, files in Linux can controlled through permissions.

Linux uses a simple but powerful permission model:

• Read (r), Write (w), Execute (x)

• Applied to owner, group, others

So some users or group may have only read permission of a speci

What I Noticed:

Permissions are attached to every file, not just programs.

/proc

This was one of the most fascinating discoveries.

/proc is not a real directory—it’s a virtual filesystem.

Examples:

• /proc/cpuinfo → CPU details

• /proc/meminfo → Memory usage

• /proc/<pid>/ → Process-specific data

You’re not reading stored files—you’re querying the kernel in real time.

/dev

You have definitely heard about everything in Linux is a file, including hardware.

Examples:

• /dev/sda → Disk

• /dev/null → Discards input

• /dev/random → Random data generator

/boot

This directory contains everything needed to boot the system.

Includes:

• Kernel images

• Bootloader configs (GRUB)

Why It Matters:

If /boot is corrupted → system won’t start.
This is the foundation of the OS lifecycle.

Systemd & Services

Modern Linux systems rely on systemd as the init system and service manager.
But the key insight is this: Services in Linux are not “programs running somewhere” they are declared, configured, and controlled through unit files.

Where systemd Lives

• /etc/systemd/ → User-defined / overridden configurations

• /lib/systemd/system/ → Default service definitions installed by packages

What a Service Actually Is

Each service is defined as a unit file (e.g., nginx.service, ssh.service).

These files describe:

• What executable to run

• When to start (boot, manual, dependency-based)

• Restart policies

• Dependencies on other services

Environment Behavior

Environment variables define the execution context of processes.

They influence:

• Command behavior

• Paths to binaries

• Application configuration

• Shell behavior

Where Environment Variables Are Defined

1. /etc/environment

• System-wide variables

• Applied to all users and processes

• No shell logic (pure key-value)

2. ~/.bashrc

• User-specific

• Executed for interactive non-login shells

3. ~/.profile

• Executed for login shells

• Runs once at session start

Environment variables are the hidden layer controlling runtime behavior across the system