The shell: moving around the file system

The problem: a shell with no map

When you open a shell on a server, you get a prompt and a blinking cursor. Nothing tells you where you are, what's around you, or where anything is kept.

Every Linux system arranges its files the same way, though. Settings are in one place, logs in another, programs in a third. Once you know the layout, you can find your way around any server you're dropped into, even one you've never seen.

This lesson has two halves. First, moving around and handling files. Then a tour of every folder at the top of the file system.

Everything runs in one Ubuntu container, so the files you make stay there until you exit:

docker run -it --rm --name lesson2 ubuntu:24.04 bash

Where am I?

Look at the prompt first. It already tells you a lot:

root@124e0a19cbf9:/#

• root is the user you are.
• 124e0a19cbf9 is the machine's name, here the container's ID.
• / is the folder you're in.
• # means you're the administrator. An ordinary user gets $ instead.

pwd (print working directory) says where you are in full, and ls (list) shows what's there:

pwd
ls

/
bin  boot  dev  etc  home  lib  media  mnt  opt  proc  root  run  sbin  srv  sys  tmp  usr  var

You're at /, the root of the file system: the top folder that every other folder sits inside. Linux has no drive letters like Windows' C:. Every file, on every disk, lives somewhere under /.

(Linux uses "root" for two different things: the top folder, /, and the administrator user. Context tells you which.)

Moving around

cd (change directory) moves you:

cd /etc
pwd
ls | head
cd ..
pwd
cd ~
pwd

/etc
alternatives
apt
bash.bashrc
bindresvport.blacklist
cloud
cron.d
cron.daily
debconf.conf
debian_version
default
/
/root

ls | head sends the list to head, which shows only the first ten lines. The | is a pipe, and Lesson 4 is all about them.

There are two ways to say where a file is:

• An absolute path starts with / and works from anywhere: /etc/hostname always means the same file.
• A relative path starts from where you are now: notes/two.txt means "the notes folder in this folder".

A few shortcuts work in any path:

Type one dot too many and Linux takes you literally:

bash: cd: ...: No such file or directory

... isn't a shortcut, so it looked for a folder actually called .... There isn't one.

Two habits that save a lot of typing: press Tab to finish a file or folder name (press it twice to see the choices), and press the up arrow to bring back earlier commands.

Hidden files

Files whose names start with a dot are hidden: plain ls skips them. -a (all) shows them:

ls -a ~

.  ..  .bashrc  .profile

There are . and .., the two shortcuts, appearing as real entries, plus two settings files for your shell. Programs often keep their settings in hidden files in your home folder, out of the way.

Reading ls -l

-l (long) shows details about each file. It's the view you'll use most:

ls -l /etc/hostname /etc/passwd
ls -ld /tmp /root /etc
ls -lh /usr/bin/bash

-rw-r--r-- 1 root root  13 Oct 29 02:05 /etc/hostname
-rw-r--r-- 1 root root 888 Oct 24 14:12 /etc/passwd
drwxr-xr-x 1 root root 4096 Oct 29 02:05 /etc
drwx------ 2 root root 4096 Oct 24 14:12 /root
drwxrwxrwt 2 root root 4096 Oct 24 14:12 /tmp
-rwxr-xr-x 1 root root 1.5M Mar 31  2024 /usr/bin/bash

Take the last line apart:

Two more options from that block:

• -d shows a folder itself, instead of what's inside it.
• -h turns a size in bytes into something easier to read, like 1.5M.

Notice /root: drwx------. Only its owner can get in. And /tmp: drwxrwxrwt. Everyone can write there, and the t at the end stops people deleting each other's files. Lesson 5 explains both.

Making, copying, moving, deleting

mkdir -p ~/practice/notes
cd ~/practice
touch notes/one.txt
echo "hello from the shell" > notes/two.txt
ls -l notes
cp notes/two.txt notes/three.txt
mv notes/one.txt notes/renamed.txt
ls notes
rm notes/three.txt
ls notes

total 4
-rw-r--r-- 1 root root  0 Oct 29 02:09 one.txt
-rw-r--r-- 1 root root 21 Oct 29 02:09 two.txt
renamed.txt  three.txt  two.txt
renamed.txt  two.txt

What each one did:

• mkdir -p made a folder. -p makes any missing folders on the way, and doesn't complain if they already exist.
• touch made an empty file: one.txt is 0 bytes.
• echo "..." > file wrote a line into a file. The > sends a command's output into a file instead of the screen, replacing what was there. Lesson 4 covers this properly.
• cp copied a file.
• mv moved a file. Moving it to a new name in the same folder is how Linux renames things; there's no separate rename command.
• rm removed a file.

rm has no undo. There's no trash or recycle bin. The file is gone the moment you press Enter. Read an rm command twice before you run it, especially with -r, which deletes a folder and everything inside it.

Break it on purpose

Five mistakes, and the error each one gives:

cd /etc/hostname
ls /nowhere
rm ~/practice/notes
rmdir ~/practice/notes
cat notes/three.txt

bash: cd: /etc/hostname: Not a directory
ls: cannot access '/nowhere': No such file or directory
rm: cannot remove '/root/practice/notes': Is a directory
rmdir: failed to remove '/root/practice/notes': Directory not empty
cat: notes/three.txt: No such file or directory

• Not a directory: /etc/hostname is a file, and you can only cd into folders.
• No such file or directory: nothing exists at that path. It's the most common error in Linux. Check for a typo, then check where you are with pwd, because a relative path depends on it.
• Is a directory: plain rm only removes files. That's a safety feature, not a bug.
• Directory not empty: rmdir only removes empty folders. Another safety feature. To remove a folder and everything in it, it's rm -r, and there's no undo.
• cat: ... No such file: you deleted three.txt a moment ago. It's really gone.

Most of the errors you'll meet in Linux are one of these, and every one names the path it tried. Read the path in the error first.

A tour of the top folders

Now look inside each folder in /. This layout follows a standard, the FHS (Filesystem Hierarchy Standard), which is why it's nearly the same on Ubuntu, Debian, Red Hat and every other distribution.

ls /etc | wc -l
cat /etc/hostname
ls /var/log
ls -l /bin /sbin /lib
which ls bash

74
124e0a19cbf9
alternatives.log  apt  bootstrap.log  btmp  dpkg.log  faillog  lastlog  wtmp
lrwxrwxrwx 1 root root 7 Apr 22  2024 /bin -> usr/bin
lrwxrwxrwx 1 root root 7 Apr 22  2024 /lib -> usr/lib
lrwxrwxrwx 1 root root 8 Apr 22  2024 /sbin -> usr/sbin
/usr/bin/ls
/usr/bin/bash

• /etc has 74 entries, and /etc/hostname is simply a text file holding the machine's name. Most of Linux's settings are plain text like that, which is why the next two lessons are about reading and editing text.
• /var/log holds the logs, here only the ones from installing the image. On a working server, this folder is where troubleshooting starts.
• /bin, /sbin and /lib are links (the l at the start, and the ->) pointing into /usr. Older systems kept the essential commands separately; modern distributions merged them into /usr and left the old names as shortcuts, so old scripts still work.
• which tells you where a command really lives: /usr/bin.

ls /home /root /opt /srv /mnt /media
ls /tmp
cat /proc/uptime
ls /proc | head
ls /dev | head
ls /boot

/home:
ubuntu

/media:

/mnt:

/opt:

/root:
practice

/srv:
5524.11 88236.75
1
47
48
buddyinfo
bus
cgroups
cmdline
config.gz
consoles
cpuinfo
console
core
fd
full
mqueue
null
ptmx
pts
random
shm

(/srv, /tmp and /boot were empty, so they printed nothing.)

• /home has one folder, ubuntu. The image comes with an ordinary user of that name, which is also the user you log in as on Ubuntu cloud servers.
• /root holds your practice folder, because you're root and that's your home.
• /proc isn't real files. It's a live window into the kernel. The numbered folders are running processes, one per process ID, and /proc/uptime says how many seconds the kernel has been running: 5,524, about an hour and a half. That's Docker Desktop's hidden machine from Lesson 1, not the container.
• /dev shows devices as files. /dev/null is a famous one: anything written to it disappears, which is handy for throwing output away.
• /boot is empty. It normally holds the kernel. A container has no kernel of its own, as Lesson 1 found, so there's nothing to boot.

Every folder, with what it's for and what was in it here:

Why it's laid out like this

The layout follows one idea: keep different kinds of things apart.

• Settings are in /etc. Back up /etc and you've saved how the machine is set up.
• Changing data is in /var. Logs and databases grow, so on big servers /var often gets a disk of its own, and a runaway log can fill it without filling everything else.
• Programs are in /usr, put there by the package manager. You rarely change anything in it by hand.
• Your own work is in /home.
• Live kernel information is in /proc and /sys, made up on the spot each time you look.

Knowing that, you can usually guess where something is before you look. A program's settings? /etc, probably in a folder named after it. Its logs? /var/log. The program itself? /usr/bin, or /opt if a vendor installed it.

Spot the problem

Three situations. Work out what's wrong before you read the explanation.

The cleanup that went too far. Someone wants to delete a folder of old logs and types rm -r / var/log/old. What happened? There's a space after the /. So rm was told to remove two things: /, the whole file system, and var/log/old. GNU rm, the one on Linux, refuses to remove / without an extra option, which is the only reason this isn't a disaster. Read every rm -r twice before pressing Enter.

It works in my folder. A script says cat settings.txt, and works when you run it from the script's folder. Run from anywhere else, it fails with "No such file or directory". Why? settings.txt is a relative path, so it depends on where you are when the script runs. Use an absolute path, like /opt/myapp/settings.txt, in anything that runs on its own. Lesson 12 comes back to this for scheduled jobs.

The file that vanished. An app saves its uploaded files in /tmp. Everything works until the server restarts, and then the files are gone. What went wrong? /tmp is for temporary files, and many systems clear it on restart. Data you want to keep belongs in /var, under a folder for that app, or in /home or /srv.

Where you are now

You can tell where you are from the prompt and pwd, move anywhere with cd using absolute or relative paths, and read every column of ls -l. You can make, copy, move and delete files, and you know rm has no undo. You've seen inside every top-level folder: settings in /etc, logs in /var/log, programs in /usr, and live kernel information in /proc, which isn't really files at all. Lesson 3 goes from finding folders to finding things inside them: reading files with less, searching inside them with grep, and finding files anywhere with find.

Check yourself

Key terms

• Shell: the program that reads what you type and runs it. Here, bash.
• Root (folder): /, the top of the file system, which every other folder sits inside.
• Root (user): the administrator account, which can do anything.
• Home folder: each user's own folder; ~ for short.
• Absolute path: a path starting with /, the same from anywhere.
• Relative path: a path starting from the folder you're in.
• Hidden file: a file whose name starts with a dot.
• Link: a name that points to another file or folder, shown with -> in ls -l.
• FHS (Filesystem Hierarchy Standard): the standard layout of folders on Linux.

Go deeper

• Type man ls to read the manual for ls. Press space to page down and q to quit. Every command has one.
• Try ls -lt (sorted by time, newest first) and ls -lS (sorted by size). Which files in /etc changed most recently?
• explainshell (opens in a new tab): paste any command and see what every part means.
• Lesson 1, What Linux is, for why /boot and /proc look the way they do in a container.