Practice: directories, sizes, disk space

In the lesson "Linux filesystem" you learned which folder does what. Now for the four commands you start with on any server: what system it is, what's in a folder, how big it is, and how much space is left on disk. You need to type them by hand, so this lesson is short and the real work is in the labs.

Where to practice

macOS has its own directory tree, and there is no /etc/os-release file there. WSL2 and Linux have it, but every machine has its own system and its own sizes. So everyone sees the same output, the examples below use an ubuntu:24.04 container. You can bring up the same one and repeat everything step by step:

docker run --rm -it ubuntu:24.04 bash

--rm removes the container after exit, so no leftovers remain.

What system this is

The distribution's description lives in /etc/os-release. The file exists in almost every modern distribution, and both people and scripts read it.

cat /etc/os-release

PRETTY_NAME="Ubuntu 24.04.5 LTS"
NAME="Ubuntu"
VERSION_ID="24.04"
VERSION="24.04.5 LTS (Noble Numbat)"
VERSION_CODENAME=noble
ID=ubuntu
ID_LIKE=debian
...

Two lines matter for scripts. ID is the distribution's short name (ubuntu, debian, alpine), VERSION_ID is the version number. ID_LIKE says which distribution this one resembles: here it's debian, so packages install through apt.

ls: hidden files and permissions

A file whose name starts with a dot counts as hidden. Plain ls doesn't show it. Settings are hidden this way: .bashrc, .profile, .env.

ls -la /root

total 16
drwx------ 2 root root 4096 Sep 17 02:17 .
drwxr-xr-x 1 root root 4096 Oct  9 07:15 ..
-rw-r--r-- 1 root root 3106 Apr 22  2024 .bashrc
-rw-r--r-- 1 root root  161 Apr 22  2024 .profile

The -a flag adds hidden files, -l turns on the long format: permissions, owner, size and date. The flag order doesn't matter, ls -al is the same thing. . and .. are the folder itself and the one above it. If they're in the way, there's -A: it shows hidden files but not . and ...

du and df

Both commands are about disk, but they answer different questions.

du (disk usage) counts how much space the files in a folder take up. Without flags it prints a line for every nested folder. The -s flag collapses the output into one total line, -h converts bytes to K, M, G:

du -sh /var/log

16M	/var/log

To see which file inside is the heaviest, you need a line per item, not a total: du -sh /var/log/*.

df (disk free) shows whole partitions: size, how much is used, how much is free, and where the partition is mounted.

df -h

Filesystem      Size  Used Avail Use% Mounted on
overlay          59G   24G   33G  43% /
tmpfs            64M     0   64M   0% /dev
shm              64M     0   64M   0% /dev/shm
...

Look for free space in the Avail column, and the partition you need in the Mounted on column. If you pass a path (df -h /var), df shows only the partition that path lives on.

-h rounds up. A folder with two files of 12 MB and 3 MB takes up 15364 KB (4 KB goes to the folder itself), and du -sh shows 16M, not 15M. That doesn't matter for reading by eye, but in scripts use exact numbers: du -sk and df -P -k give kilobytes.

Why du and df disagree

du walks folders and adds up the sizes of files that have a name. df asks the partition how many blocks are used on it. Usually the numbers are close, but sometimes df shows the disk as full while du can't find what it's full of.

A common reason is that rm only removes the file's name. The kernel frees the data once a file has no names left and no process is holding it open. You delete a log that had grown huge, but the service keeps writing to it, so the space doesn't come back. A file like that is visible under /proc/<PID>/fd: it holds links to all the files a process has open, and a deleted file's link ends with (deleted).

The space comes back once the process closes the file. Usually that means restarting the service itself, not the whole server.

Common mistakes

• du -h /var/log without -s: you get dozens of lines instead of one total.
• du -sh /var/log when you need the biggest file: the total doesn't say what's inside. You need du -sh /var/log/*.
• Reading free space off the / line when the question is about a different partition. /data, /var or /home can have their own partition with its own size.
• Mixing up df columns: Size is the partition's size, Avail is what you can still write.
• Looking for /etc/os-release on macOS. It's not there; sw_vers shows the macOS version.
• Deleting a large log and expecting the space back while the service still holds the file open.

Questions to check yourself

Answer to yourself, then check against the lesson "Linux filesystem".

1. What lives in /etc, /dev, /proc, /sys, /var, /lib? Which of them are not stored on disk?
2. Why do you need a filesystem at all, and which ones do you know (ext4, xfs, tmpfs)? How is tmpfs different from the rest?

What you'll need for the tasks

• Enter a container with docker exec -it <name> bash and exit with exit.
• cat /etc/os-release, ls -la, du -sh, df -h from this lesson.
• In lab 2, the section "Why du and df disagree" and ps aux to look at processes.