Filesystem Hierarchy

A hard link is an extra name for the same inode, so every name is equal and the data survives until the last one is removed. A symbolic link is a separate small file holding a path string, resolved at every access.

Kernel names like /dev/sdb1 depend on device discovery order, so a new disk or a slow controller can renumber them and mount the wrong filesystem. Prefer UUID= from the filesystem superblock, or PARTUUID= from the partition table.

/usr is owned by the distribution's package manager, so an upgrade can overwrite or conflict with anything you drop there. /usr/local is reserved for software the administrator installs and packages never touch. /opt holds self-contained third-party bundles in their own subtree.

ext4's journal protects filesystem metadata consistency, not file contents. The default data=ordered flushes data blocks before committing the metadata that points at them; data=writeback drops that ordering and can expose stale bytes; data=journal journals data too, more slowly.

A process still holds the file open. Deleting removed the directory entry and dropped the link count to zero, but the kernel frees an inode and its blocks only when no open file descriptor references it either, so the space stays allocated until that process closes it.

A filesystem is busy while anything still references it: open file descriptors, a process whose working directory or root is inside it, memory-mapped files, an active swap file, or a submount. umount -l (MNT_DETACH) only detaches the subtree from the path namespace — the filesystem stays alive until the last reference goes away.

Pick XFS or ext4 for the database — both journal metadata and overwrite in place, and XFS grows online but can never shrink. Btrfs suits the disposable build cache, where cheap snapshots, compression and checksums outweigh its copy-on-write fragmentation.

tmpfs is a memory-backed filesystem: its files live in the kernel's page cache, may be pushed out to swap under pressure, and disappear on unmount or reboot. The reported size is a ceiling, not a reservation.

The sbin directories hold system-administration programs, a convention about intended audience rather than a permission boundary. A normal user's default PATH usually omits them, so the shell never looks there — the file is executable, just not on the search path. Invoking it by absolute path works.

An inode number identifies a file within one filesystem, not across the machine. Renaming rewrites only a directory entry, so the inode is untouched; copying allocates a fresh inode and new data blocks, producing a different file that merely holds the same bytes.

A bind mount makes an existing directory (or file) appear at a second path as a real mount entry, with both paths referring to the same underlying data. Unlike a symlink it is a genuine mount, not a link the caller can detect or refuse; --rbind also replicates any submounts.

nosuid makes the kernel ignore setuid and setgid bits (and file capabilities) on that mount; nodev makes device special files there non-functional; noexec makes execve fail for files under it. noexec is weak because an interpreter can still read and run a script as data.

Both replay their journal at mount, which is why recovery is fast — that is not a full check. XFS really does ship a do-nothing fsck.xfs; genuine repair uses xfs_repair on an unmounted filesystem, with -n to inspect and -L as a data-losing last resort.

/run holds runtime state valid only since the current boot — PID files, Unix sockets, lock files. It is a memory-backed filesystem mounted early and empty at every boot, so a directory created once at install time is gone after a restart and must be recreated during startup instead.

/tmp is volatile: it may be cleared at boot, is aged out by a periodic cleanup, and on many distributions is a memory-backed filesystem with its own size limit. /var/tmp is temporary storage that must survive reboots. Multi-day scratch data belongs in /var/tmp or the service's own directory.

The filesystem has most likely run out of inodes. Blocks and inodes are separate budgets: an ext4 filesystem fixes its inode count at format time, so a hoard of tiny files can exhaust it while gigabytes of block space remain free. Confirm with df in inode mode.

Every fstab entry becomes a boot-time dependency: on a systemd machine the fstab generator turns each line into a mount unit that local-fs.target requires, so a missing device or failed mount fails the target and drops you to emergency mode. Mark optional filesystems nofail.

The /usr merge turns /bin, /sbin, /lib and /lib64 into symbolic links into /usr, so every program and library has exactly one real location. It removes a split that only existed so a tiny root filesystem could mount a separate /usr, a job the initramfs now does.

The dentry cache stores the results of name-to-inode lookups so path resolution does not re-read directories. A negative dentry caches the fact that a name does not exist. It lives in reclaimable slab memory, so the kernel shrinks it automatically under pressure.

Propagation controls whether mount and unmount events on one mount are replicated to its peers. Shared mounts propagate both ways, private mounts propagate nothing, and slave mounts receive events from their master but send none back — which is why a mount made in an isolated tree may or may not become visible elsewhere.

A snapshot is a second reference to the same on-disk blocks at a moment in time, created instantly with no data copied. Space is consumed later, as the live copy diverges, which is why deleting files frees nothing while a snapshot still references them.