Prasanta Kumar Behera
Linux — Level by Level›02 · Files & directories
Learning Hub / Linux & Scripting / Linux — Level by Level

Lesson 02 of 19 · Level 1 — Beginner: everyday commands

Files & directories

Move around the Linux filesystem with confidence: the directory tree and what lives where, absolute and relative paths, creating, copying, moving and deleting safely, and finding anything with find.

Beginner
Key wordsfilesystem treeabsolute pathrelative pathlscdcpmvrmfindlinks

One tree, starting at /

Linux has one directory tree. Disks, USB sticks and network shares are all mounted somewhere inside it. There's no C: or D:.

Think of a giant filing cabinet. The top drawer is / (the root). Inside are folders with fixed jobs: one for settings (/etc), one for diaries of what happened (/var/log), one for everyone's personal stuff (/home). A path is directions to a file: "top drawer → home → asha → notes.txt" is written /home/asha/notes.txt.

Directory What lives there
/etc System configuration
/home/<user> Users' personal files (~ is a shortcut for yours)
/root The root user's home
/var/log Log files
/var/lib Application state (databases, container images: /var/lib/containerd)
/usr/bin, /usr/sbin Installed programs
/tmp Temporary files (often cleared on reboot)
/opt Optional, self-contained software
/proc, /sys Live kernel information (not real files on disk)
/dev Devices (disks, terminals)

Absolute and relative paths

  • Absolute: starts with /, e.g. /var/log/syslog. Works from anywhere.
  • Relative: starts from where you are. . = here, .. = one level up, ~ = your home.
$ pwd
/home/asha
$ cd projects/web      # relative
$ cd ../..             # up two levels → /home
$ cd /var/log          # absolute
$ cd -                 # back to the previous directory
/home
$ cd                   # home

Listing: ls in detail

$ ls -lah /etc/ssh
total 604K
drwxr-xr-x   4 root root 4.0K Sep 20 10:12 .
drwxr-xr-x 110 root root 4.0K Sep 26 08:01 ..
-rw-r--r--   1 root root 620K Jun  5 14:02 moduli
-rw-r--r--   1 root root 1.6K Jun  5 14:02 ssh_config
drwxr-xr-x   2 root root 4.0K Sep 20 10:12 ssh_config.d
-rw-r--r--   1 root root 3.2K Sep 20 10:12 sshd_config

-l long format, -a includes hidden files (names starting with .), -h human sizes. The first column (drwxr-xr-x) is the type and permissions, covered in lesson 04.

Create, copy, move, delete

$ mkdir -p demo/config/dev        # -p creates parents and doesn't fail if they exist
$ touch demo/config/dev/app.env
$ cp demo/config/dev/app.env demo/config/dev/app.env.bak
$ cp -r demo demo-copy            # -r for directories
$ mv demo-copy demo-old           # rename
$ rm -r demo-old                  # delete a directory tree

There is no recycle bin

rm deletes immediately. Before a recursive delete, run ls on the same path to see exactly what you're about to remove. Be extra careful with variables and wildcards: rm -r "$DIR"/ with an empty $DIR means rm -r / (see Bash Scripting, safe scripts).

Wildcards (globs)

The shell expands patterns before the command runs:

Pattern Matches
*.log Any name ending in .log
app-?.txt app-1.txt, app-a.txt (exactly one character)
file[1-3] file1, file2, file3

echo *.log shows what a pattern expands to. It's a safe preview before rm *.log.

Finding things with find

$ find /etc -name '*.conf' -type f | head
$ find /var/log -type f -size +100M          # big files
$ find /home -mtime -1                         # changed in the last day
$ find /tmp -name '*.tmp' -mtime +7 -delete    # delete week-old temp files (careful!)

Quote patterns ('*.conf') so the shell passes them to find instead of expanding them itself.

A symbolic link is a signpost to another path:

$ ln -s /opt/app/releases/2026-09-27 /opt/app/current
$ ls -l /opt/app/current
lrwxrwxrwx 1 root root 28 Sep 27 09:00 /opt/app/current -> /opt/app/releases/2026-09-27

Deployments often switch versions by pointing a current symlink at a new release directory. It's instant and easy to roll back.

Try it: build and tidy a project tree

  1. Create ~/lab/app/{config,logs,releases} in one command: mkdir -p ~/lab/app/{config,logs,releases} (the braces expand to three names).
  2. Create five files ~/lab/app/logs/day{1..5}.log, then list them with ls -l.
  3. Copy config to config.bak, then rename config.bak to config.old.
  4. Use find ~/lab -name '*.log' to list the logs, then delete only day1.log and day2.log with a single glob (preview it with echo first).
  5. Create two release folders and a current symlink; switch it from one to the other with ln -sfn.

Going deeper: files are inodes

  • A file's data and metadata live in an inode; a name is just a directory entry pointing at it (ls -i shows inode numbers). Hard links are extra names for the same inode; symlinks are separate files containing a path.
  • That's why deleting a log file that a process still has open doesn't free the space: the inode lives on until the process closes it (lesson 08, "the disk is full but du says it isn't").
  • stat file shows every timestamp and the inode. du -sh dir (space used) and df -h (space free per filesystem) answer different questions.

Recap

  • One tree from /; learn the landmarks: /etc, /var/log, /var/lib, /home, /usr/bin, /tmp, /proc.
  • Absolute paths start with /; relative paths use ., .., ~.
  • ls -lah, cd, mkdir -p, cp -r, mv, rm -r (carefully), and find for everything else.
  • No undo: preview globs with echo and paths with ls before deleting.

This site is a public version of my personal engineering knowledge hub. It intentionally excludes confidential company information and internal operational details.