Linux Directory Structure and File Systems in RHEL 10

If you have ever gotten lost navigating a Linux server or wondered why files are stored where they are, this guide is for you. Understanding the Linux directory structure is one of the most fundamental skills for any sysadmin — and in Red Hat Enterprise Linux 10, it follows a well-defined standard that makes administration predictable and consistent across systems.

What is the Linux File System Structure?

Linux uses a hierarchical file structure that simplifies both administration and file management. This structure is made up of directories organized within larger containers called file systems.

Red Hat Enterprise Linux follows the Filesystem Hierarchy Standard (FHS) — a specification that defines names, locations, and permissions for file types and directories across Linux distributions. Following FHS means that whether you are on RHEL 10, Rocky Linux, or any other Red Hat-compatible system, the structure is consistent and predictable.

The Inverted Tree Model

The Linux directory structure resembles an inverted tree:

• The root (/) is at the top — the trunk of the tree
• Subdirectories are the branches
• Files are the leaves at the end of each branch

The root directory is represented by the forward slash character /, and this is where the entire directory structure connects. Every single file and directory on a Linux system lives under /.

The forward slash also serves as a directory separator in pathnames. For example:

/etc/rc.d/init.d/README

Breaking this down:

/           → root (parent of everything)
└── etc     → child of /
    └── rc.d    → child of etc
        └── init.d  → child of rc.d
            └── README  → file (leaf)

Lab output — navigating this path on a RHEL 10 system:

[root@rhel10 ~]# ls /etc/rc.d/
init.d  rc0.d  rc1.d  rc2.d  rc3.d  rc4.d  rc5.d  rc6.d

Parent and Child Directories

Every directory in Linux has a relationship with the directories around it:

• Every directory has a parent directory above it
• Every directory can have child directories below it
• The only exception is the root directory (/) which has no parent
• The lowest-level subdirectories have no children — only files

You can always confirm the parent of your current location using:

[root@rhel10 ~]# pwd
/home/abernal/projects
 
[root@rhel10 ~]# ls ..
abernal  guest

The .. always refers to the parent directory.

Static vs Dynamic Data

Before looking at the top-level directories, it helps to understand the two types of data they contain:

Static data — content that remains unchanged unless explicitly modified by an administrator or package manager. Examples include:

• System binaries and commands
• Configuration files
• Library routines
• Kernel files

Dynamic (variable) data — content that is modified and updated automatically by system processes during normal operation. Examples include:

• Log files
• Process status files
• Temporary files
• Lock files

This distinction matters because static directories can be mounted read-only for security, while dynamic directories must always be writable.

Top-Level Directories Under `/`

Here are the key top-level directories in a RHEL 10 system:

[root@rhel10 ~]# ls /
afs  boot  etc   lib    media  opt   root  srv  tmp  var
bin  dev   home  lib64  mnt    proc  run   sys  usr

`/bin` and `/sbin` → `/usr/bin` and `/usr/sbin`

In RHEL 10 (following modern FHS), /bin and /sbin are symbolic links to /usr/bin and /usr/sbin:

[root@rhel10 ~]# ls -la / | grep bin
lrwxrwxrwx.   1 root root    7 Jan  1 00:00 bin -> usr/bin
lrwxrwxrwx.   1 root root    8 Jan  1 00:00 sbin -> usr/sbin

These contain essential user and system administration commands available to all users.

`/etc` — Configuration Files

The most important directory for sysadmins. Contains system-wide configuration files:

[root@rhel10 ~]# ls /etc | head -20
adjtime
aliases
alternatives
anacrontab
at.deny
audit
bash_completion.d
bashrc
cron.d
cron.daily

Static data — configuration files are only changed by admins or package installs.

`/var` — Variable Data

Contains data that changes constantly during system operation:

[root@rhel10 ~]# ls /var
account  cache  db  empty  games  lib  local  lock  log  mail  opt  run  spool  tmp  yp

Key subdirectories:

• /var/log — system and application logs
• /var/spool — print and mail queues
• /var/tmp — temporary files that persist across reboots
• /var/cache — application cache data

Dynamic data — this directory must always be writable.

`/home` — User Home Directories

Each regular user gets a home directory here:

[root@rhel10 ~]# ls /home
abernal  guest  testuser

`/root` — Root User Home

The home directory for the root user — separate from /home to ensure root can always log in even if /home is unmounted:

[root@rhel10 ~]# ls /root
anaconda-ks.cfg  original-ks.cfg

`/tmp` — Temporary Files

For temporary files created by applications. Files here are cleared on reboot:

[root@rhel10 ~]# ls /tmp
systemd-private-abc123  tmpfiles-xyz

`/usr` — User Programs and Data

The largest directory on most systems. Contains installed software, libraries and documentation:

[root@rhel10 ~]# ls /usr
bin  games  include  lib  lib64  libexec  local  sbin  share  src  tmp

`/boot` — Boot Files

Contains the Linux kernel, initial RAM disk, and bootloader configuration:

[root@rhel10 ~]# ls /boot
config-5.14.0-427.el10.x86_64
efi
grub2
initramfs-5.14.0-427.el10.x86_64.img
symvers-5.14.0-427.el10.x86_64.gz
System.map-5.14.0-427.el10.x86_64
vmlinuz-5.14.0-427.el10.x86_64

`/dev` — Device Files

Contains special files representing hardware devices:

[root@rhel10 ~]# ls /dev | head -10
autofs  block  bsg  bus  cdrom  char  console  cpu  cpu_dma_latency  disk

`/proc` and `/sys` — Virtual File Systems

These are not real directories on disk — they are virtual file systems that expose kernel and hardware information:

# CPU information
[root@rhel10 ~]# cat /proc/cpuinfo | head -5
processor       : 0
vendor_id       : GenuineIntel
cpu family      : 6
model           : 85
model name      : Intel(R) Xeon(R) Gold 6148 CPU @ 2.40GHz
 
# Memory information
[root@rhel10 ~]# cat /proc/meminfo | head -5
MemTotal:       16384000 kB
MemFree:         8192000 kB
MemAvailable:   10240000 kB
Buffers:          204800 kB
Cached:          1638400 kB

`/mnt` and `/media` — Mount Points

• /mnt — temporary manual mount points used by administrators
• /media — automatic mount points for removable media (USB, CD)

# Mounting a disk manually
[root@rhel10 ~]# mount /dev/sdb1 /mnt
[root@rhel10 ~]# ls /mnt
data  backups

`/opt` — Optional Software

Third-party software that is not part of the standard RHEL distribution installs here:

[root@rhel10 ~]# ls /opt
rh  splunk  custom-app

Quick Reference Table

| Directory | Type | Purpose |

|-----------|------|---------|

| / | Static | Root of the entire filesystem |

| /bin, /sbin | Static | Essential commands |

| /etc | Static | System configuration files |

| /home | Dynamic | User home directories |

| /var | Dynamic | Variable data — logs, spools |

| /tmp | Dynamic | Temporary files (cleared on reboot) |

| /usr | Static | Installed programs and libraries |

| /boot | Static | Kernel and bootloader files |

| /dev | Dynamic | Device files |

| /proc | Dynamic | Virtual — kernel runtime info |

| /sys | Dynamic | Virtual — hardware and kernel info |

| /mnt | Dynamic | Temporary mount points |

| /opt | Static | Optional third-party software |

| /root | Dynamic | Root user home directory |

Key Takeaways

Understanding the Linux directory structure is essential for every sysadmin task — from troubleshooting to security hardening. In RHEL 10 following FHS means:

• Configuration changes go in /etc
• Logs are always in /var/log
• Kernel files live in /boot
• /bin and /sbin are now symlinks to /usr/bin and /usr/sbin
• Virtual filesystems /proc and /sys expose live kernel data

In the next article we will cover file permissions and ownership in RHEL 10 — understanding who can read, write, and execute every file in this directory tree.

*Questions? Find me on X as @stackdeploy