When you SSH into a server to fix a broken application or install a new tool, the absolute worst thing you can do is guess where files belong. Linux does not put files in random places; it follows a strict, predictable map.
Understanding this map means you know exactly where to look when an application crashes, when a disk fills up, or when you need to configure a container.
If you run ls / on your server, you'll see a massive wall of folders.
As a DevOps engineer, you don't need to memorize every single one. Here are the crucial directories you will actually use, what they do, and the proof of why you should care about them.
/etc — The Control Room (Configurations)
You need to change the port your web server listens on, block a user from SSHing into the server, or configure a systemd service.
Historically, /etc stood for "et cetera," but today it is best understood as Editable Text Configurations. Every server, daemon, and background service stores its settings here.
Real scenario: Change the port Nginx listens on
Your app is running on port 80 but you need it on 8080 for a staging environment.
# Step 1: Find the config
cat /etc/nginx/nginx.conf
# Step 2: Edit it
nano /etc/nginx/nginx.conf
# Change: listen 80 → listen 8080
# Step 3: Reload (no downtime!)
systemctl reload nginx
/var — The Growing Data Hub
This directory stands for "variable." It is designed to hold data that actively grows and changes while the system is running. If your server suddenly triggers a "Disk Space 100%" alert, /var is almost always the culprit.
We split this into two critical sub-directories:
/var/log (System and Application Logs): Your web application returned a 500 Error, or a database failed to start. This is the very first place you check.
# Watch errors as they happen, live
tail -f /var/log/nginx/error.log
# Search last 100 lines for "error" keyword
tail -n 100 /var/log/syslog | grep -i error
# See how much log data has accumulated
du -sh /var/log/
/var/lib (State Information and Databases): This is where applications save their actual heavy data. It is where PostgreSQL stores its database files, and where Docker stores its images and containers.
# "Why is my disk 80% full after installing Docker?"
du -sh /var/lib/docker
# Prune unused Docker images to reclaim space
docker system prune -a
# Where PostgreSQL stores its actual database files
ls /var/lib/postgresql/
NOTE: On modern Linux (Ubuntu 20.04+, Debian 10+), /lib is not a real directory anymore. You can see /lib and /usr/lib has common files
/home and /root — User Territories
You need to grant a new developer SSH access to a server, or you need to authenticate your server to pull code from a private Git repository.
These directories hold user-specific files. /home contains folders for standard users (e.g., /home/saeed), while /root is the isolated home directory for the superuser.
The DevOps importance: configuration files starting with a dot that control how tools behave per-user. Your .bashrc (shell settings), .kube/config (Kubernetes cluster access credentials), and .ssh/ (SSH keys) are all stored here.
# Grant a new developer SSH access
# They send you their public key. You do this:
cat dev-alice-key.pub >> ~/.ssh/authorized_keys
# Verify it was added
tail -n 3 ~/.ssh/authorized_keys
# Alice can now SSH in — no password needed
/proc — The Matrix (A Window Into the Kernel)
You are running a Docker container and need to know exactly how much memory the kernel is allowing it to use, or you need to see the exact environment variables a running process received. Every running process gets a numbered folder here (its Process ID, or PID) containing its live runtime data.
/proc The files aren't stored on disk — they don't exist until you read them. It is a "virtual filesystem" created in memory by the Linux kernel. . The moment you open /proc/1234/status, the kernel generates the content on the fly. It's a live feed into what's actually happening right now.
# Find the PID of your container's main process
docker inspect --format='{{.State.Pid}}' my-container
# See every env variable it received at startup
cat /proc/1234/environ | tr '\0' '\n'
# See what files/sockets it has open right now
ls -la /proc/1234/fd
# See exact memory usage the kernel is tracking
cat /proc/1234/status | grep VmRSS
# How long has this server been running?
cat /proc/uptime
# CPU info — useful in CI/CD pipelines
cat /proc/cpuinfo | grep "model name" | head -1
# Current memory usage
cat /proc/meminfo
/dev — Everything is a File
Linux's philosophy is: "if it can be read from or written to, it's a file." Your hard drive? A file. A USB drive? A file. Even nothingness and randomness are files. /dev is where all these hardware-and-virtual devices live as file objects. Your hard drives show up here (like /dev/sda or /dev/nvme0n1). But it also holds special virtual devices that are incredibly useful for scripting.
You are writing a cron job and want to completely hide its output so it doesn't spam your logs, or you are attaching a new block storage volume to your cloud instance.
#/dev/null — The Black Hole
# This cron job spams your mail. Make it silent:
# The "2>&1" part also redirects error output to null
./noisy-backup-script.sh > /dev/null 2>&1
# Useful breakdown:
# > redirects stdout
# /dev/null the black hole
# 2>&1 also send stderr to wherever stdout goes
/usr — The Real Home of Installed Software
You downloaded a pre-compiled binary (like terraform or helm) and want to install it so that anyone on the server can use it.
/usr (Unix System Resources) is where the vast majority of your installed applications, libraries, and tools actually live.
The DevOps importance: When you manually download and install a binary, you should place it in /usr/local/bin. This specific folder is meant for tools managed by the system administrator, ensuring they don't get overwritten when the system package manager (like apt or yum) runs its automated updates.
# Move a downloaded binary to the standard location for user-installed tools
mv terraform /usr/local/bin/terraform
/opt — Third-Party Add-ons
You are installing a heavy monitoring agent like Datadog, or a proprietary vendor application.
Linux reserves /opt (Optional software) for self-contained, third-party applications. Instead of scattering files across /usr and /etc, these monolithic tools keep everything neatly sandboxed inside their own dedicated folder here.
/tmp — The Throwaway Folder
You need to download a zip file, extract a shell script, run it, and never think about it again.
The /tmp directory is for temporary files. It is completely wiped clean every time the server reboots, so you should never put persistent or important data here. It also usually has open write permissions, making it the perfect staging ground for quick tasks.
Blog Summary
This guide breaks down the essential directories every DevOps engineer needs to know—like /etc for configurations, /var for logs, and /proc for live system processes. Complete with real-world use cases and simulated terminal outputs, this post serves as a practical map for quickly troubleshooting crashes, managing servers, and finding exactly what you need without getting lost.