Linux Filesystem

VFS layer, inodes, hard vs soft links, ext4 and XFS, mount points, and filesystem capacity diagnosis.

Overview

Everything in Linux is a file — devices, processes, network sockets, even hardware. This mental model is the foundation. Before memorizing commands, understand where things live and why the filesystem is organised that way.

The Filesystem Hierarchy Standard (FHS)

Linux follows the FHS so every distribution puts things in predictable places: - /bin, /sbin — essential binaries needed before /usr mounts (boot recovery) - /usr/bin, /usr/sbin — most user programs; this is where grep, ssh, python3 live - /etc — all configuration files, always text, always editable - /var — variable data: logs in /var/log, databases, mail queues, runtime state - /proc, /sys — virtual filesystems exposing kernel state as files (read /proc/cpuinfo, write /sys/... to tune the kernel live) - /home — user home directories; ~ expands to yours - /tmp — temporary files cleared on reboot; world-writable with sticky bit - /opt — optional third-party packages installed outside the distro package manager

The 'everything is a file' principle means: disk devices are files (/dev/sda), processes expose state as files (/proc/1/status), and network connections appear as files when using socketpair. This is why Unix tools that work on files compose so well.

Linux uses the Virtual Filesystem Switch (VFS) as an abstraction layer between system calls (open, read, write) and specific filesystem implementations. Every filesystem presents the same VFS interface, so userspace code is filesystem-agnostic.

Inodes

The inode stores file metadata: type, permissions, owner/group, size, timestamps (atime, mtime, ctime), and pointers to data blocks. Critically, the inode does not contain the filename — filenames live in directory entries that map names to inode numbers.

Hard Links vs Symbolic Links

Hard links are directory entries pointing to the same inode. The inode and data are freed only when link count reaches zero and no process has the file open. This is why you can delete a file that a running process holds open — the data is still accessible via /proc/PID/fd/.

Symbolic links are special files containing a path string. They can cross filesystem boundaries. Dangling symlinks point to a non-existent target.

Common Production Problems

Disk full (df -h) vs inode exhaustion (df -i) — a filesystem can run out of inodes even when blocks are available, typically caused by millions of tiny files.

Key concepts

Inode: Metadata structure for a file: type, permissions, owner, size, timestamps, block pointers. Does not contain the filename. Check with ls -i.
Hard link: Additional directory entry pointing to the same inode. The file is deleted only when link count reaches 0 and no open file descriptors remain.
Symbolic link: A file containing a path string. Can cross filesystems. Becomes a dangling symlink if the target is moved or deleted.
VFS: Virtual Filesystem Switch — kernel abstraction routing system calls to the correct filesystem driver.
Inode exhaustion: Can run out of inodes before running out of blocks. Check with df -i. XFS uses dynamic inode allocation and rarely hits this.

When to use it

"Disk is full but df shows space available" — inode exhaustion, check df -i
Explaining why a deleted file still uses disk space — process holding open fd
Understanding why mv is atomic within a filesystem but cp is not

Interview questions

What is an inode and what happens when inodes are exhausted?
A file is deleted but disk usage does not decrease. Why and how do you fix it?