Files & Directories

What Is a File, Really?

On Linux, a filename is just a pointer (a directory entry) to an inode — a data structure holding the file’s metadata (size, permissions, owner, timestamps, and pointers to the actual data blocks on disk). The name itself is not stored in the inode.

This is why multiple filenames can point to the same content (hard links), and why renaming a file is instant regardless of size — you’re just updating a directory entry, not moving data.

ls -li file.txt     # shows the inode number
stat file.txt       # full inode metadata

Hard Links vs Symbolic (Soft) Links

ln original.txt hardlink.txt        # hard link — same inode
ln -s original.txt softlink.txt     # symbolic link — a pointer to a path

ls -li original.txt hardlink.txt    # same inode number
readlink softlink.txt               # shows what the symlink points to

Essential File & Directory Commands

ls -la                 # list, including hidden files, with permissions
cp -r src/ dst/         # copy recursively
mv old.txt new.txt      # move/rename (metadata-only if same filesystem)
rm -rf dir/             # remove recursively, force (dangerous — no undo)
mkdir -p a/b/c          # create nested directories
find /var/log -name "*.log" -mtime +7   # files older than 7 days
find . -type f -size +100M              # files larger than 100MB
touch newfile.txt       # create empty file / update timestamp

File Descriptors: Files Aren’t Just on Disk

Every open file, socket, or pipe a process holds is tracked as a file descriptor (a small integer). By convention:

0  # stdin
1  # stdout
2  # stderr

command > out.txt 2>&1     # redirect stdout to file, then stderr to same place as stdout
command 2>/dev/null         # discard errors
ls -l /proc/<pid>/fd/       # see every open file descriptor for a running process

Production Considerations

• rm -rf has no undo — always double-check the path (pwd first) before running it on production hosts, and never run it as root against a variable you haven’t verified.
• A process holding a deleted file open (e.g., a log file rotated but the process still has the old inode open) keeps consuming disk space until the process restarts — check with lsof | grep deleted.
• Symlinks pointing outside a container’s mounted volume can silently break when a container restarts on a different node.

Quick Interview Answer

“A file is really an inode holding metadata and data-block pointers; the filename is just a directory entry pointing at that inode. A hard link creates another name for the same inode, so it survives the original’s deletion; a symbolic link is a separate file containing a path, which breaks if the target is removed.”

Common Mistakes

• Confusing hard links and symlinks in an interview — remember: hard links share the inode, symlinks store a path.
• Deleting a file and assuming disk space was freed immediately, when a running process still has it open (lsof +L1 to find these).
• Running rm -rf $VAR/ where $VAR is unset — expands to rm -rf /.