Partitions and swap

Why split a disk into partitions

A partition is a dedicated chunk of a physical disk that the system sees as a separate block device. One disk can be split into several partitions, and each one lives its own life.

The main reason for splitting is isolating overflow. If logs fill up the partition under /var/log, they take up all the space only inside their own partition. The root partition, where the system lives, stays free, and the machine keeps running.

$ df -h /var/log /
Filesystem      Size  Used Avail Use% Mounted on
/dev/sda3        20G   20G     0 100% /var/log
/dev/sda2        30G   12G   16G  43% /

Here /var/log is at 100%, but the root / is fine. If it were one shared partition, logs overflowing would have taken down the whole system at once.

Second reason: different data needs different parameters. You can set the noexec mount option on a partition with user files, so programs can't be run from there. One partition can stay on ext4, another on XFS, if that works better for the load.

How partitions land in the directory tree

A partition by itself is just an area on disk. For its data to become visible, it gets mounted at some point in the directory tree.

$ lsblk
NAME   MAJ:MIN RM  SIZE RO TYPE MOUNTPOINTS
sda      8:0    0  100G  0 disk
├─sda1   8:1    0    1G  0 part /boot
├─sda2   8:2    0   30G  0 part /
├─sda3   8:3    0   20G  0 part /var/log
└─sda4   8:4    0    4G  0 part [SWAP]

lsblk draws disks and partitions as a tree. The column listing mount points shows where each partition is mounted. Starting with util-linux 2.37 it's called MOUNTPOINTS, plural: one device can be mounted at several places at once, and now you can see all of them. In older output, MOUNTPOINT sits in that spot instead.

/etc/fstab: what to mount at boot

A manual mount lasts until the next reboot. Permanent mounts are described in the /etc/fstab file, one line per filesystem. A line has six fields: device, mount point, filesystem type, options, the dump field, and the fsck check order.

$ cat /etc/fstab
# device                                     mountpoint fstype options  dump pass
UUID=8f3a1c2e-4b7d-4a19-9c30-5e6f2a1b7c84    /          ext4   defaults 0    1
UUID=b21d7e40-9c58-4f6a-8e11-3d0c7a94f2b5    /var/log   ext4   noexec   0    2
UUID=c9e04a13-77f2-4b8c-a6d5-1f2e83b04d97    none       swap   sw       0    0

The last field sets the check order at boot: the root gets 1, other filesystems get 2, and 0 means "don't check". Swap has no mount point, so the second field says none.

The device here isn't given as /dev/sda2, but through the filesystem's UUID. The kernel hands out names like sda and nvme0n1 in the order it finds disks. Add a disk or move a VM, and the names can swap places: yesterday's sdb becomes today's sdc. A UUID is written into the filesystem itself and survives such reshuffles. Besides UUID=, fstab also understands LABEL=, and for GPT partitions also PARTUUID= and PARTLABEL=.

You can look up the UUID with two commands:

lsblk -o NAME,SIZE,FSTYPE,UUID,MOUNTPOINTS

blkid

blkid prints one line per device: the filesystem's UUID, its type (TYPE), and the partition's PARTUUID. Don't confuse them: UUID belongs to the filesystem and changes after mkfs, PARTUUID belongs to the entry in the partition table.

At startup the system reads /etc/fstab and mounts everything listed automatically. If a device from a line is missing, boot can get stuck on that mount. The nofail option says not to treat a missing device as an error, and it's set on disks the system can boot without.

swap: a safety net for low memory

swap is a partition or file where the kernel offloads inactive memory pages once RAM starts running low. A memory page nobody has touched in a while gets sent to disk, and the freed RAM goes to whatever is working right now.

$ free -h
               total        used        free      shared  buff/cache   available
Mem:           3.8Gi       2.9Gi       180Mi        64Mi       780Mi       620Mi
Swap:          4.0Gi       1.1Gi       2.9Gi

The Swap line shows: out of 4 gigabytes, 1.1 is offloaded. Those are exactly the long-unused pages the kernel moved out of RAM.

$ swapon --show
NAME      TYPE      SIZE USED PRIO
/dev/sda4 partition   4G 1.1G   -2

swapon --show lists the active swap areas: device, type (partition or file), size, how much is used, and priority. The kernel sets a negative priority by itself when it wasn't given in the options.

A swap file instead of a partition

You don't have to repartition a disk just for swap. A plain file does the same job, and on cloud VMs that's usually how it's done. For example, 1 GB of swap:

dd if=/dev/zero of=/swapfile bs=1M count=1024
chmod 600 /swapfile
mkswap /swapfile
swapon /swapfile

dd writes zeros into every block of the file. That matters: a file with holes (which is what truncate and cp create) gets rejected by swapon, and fallocate ends up the same way on some filesystems. chmod 600 keeps other users out of the file, since swap holds the memory contents of any process. With wider permissions, swapon warns about insecure permissions. mkswap writes a swap header at the start of the file, and swapon turns it on. Only root with the CAP_SYS_ADMIN capability can turn swap on, so swapon won't work inside a regular container.

Holes in a file show up if you compare two sizes. ls -lh shows the file's length, du -h shows how much space it actually takes on disk. For a file after truncate -s 1G, the first will be 1.0G, the second 0.

For swap to come up after a reboot, you need a line in /etc/fstab:

/swapfile  none  swap  defaults  0  0

On Btrfs, a swap file only works with the nocow attribute (since Linux 5.0); there it's better to follow your distribution's documentation.

Two traps about swap

First: "swap is slow RAM for programs". No. A program doesn't run straight out of swap. The kernel offloads inactive pages there, and when they're accessed again, moves them back into RAM. Disk is thousands of times slower than memory, so if active data keeps moving in and out of swap (this is called thrashing), the system slows down to the point of being unusable.

Second: "the more swap, the faster". Also no. The size of swap doesn't make the system faster. It only sets a cushion that lets the machine survive a memory spike instead of the kernel killing a process through the OOM killer. A huge swap on a slow disk is more likely to drag out the agony than help.

Common mistakes

/dev/sdb1 in fstab. Works right up until the day a disk gets added to the server. After that, the line points at someone else's partition or at nothing. Write UUID=.

Took the UUID of the wrong filesystem. blkid prints all devices one after another. Check size and type against lsblk, don't just grab the first line with ext4.

A swap file made with truncate. The file has the right size, mkswap even runs fine, but swapon refuses: the file has holes. Create it with dd.

Forgot about fstab. swapon and a manual mount last until the next reboot. If there's no line in /etc/fstab, swap and the partition disappear after a reboot.

What you'll need for the tasks

• lsblk and df -h: what partitions exist, their size, and where they're mounted.
• blkid: the UUID, TYPE, and PARTUUID of each device.
• The /etc/fstab line format: six fields, UUID= instead of /dev/sdX, swap has mount point none and type swap.
• Creating a swap file: dd, chmod 600, mkswap, a line in fstab.
• ls -lh versus du -h: whether the file has holes.
• free -h and swapon --show: whether swap is on and how much of it is in use.

Next lesson: RAID, how disks get combined into arrays for speed and fault tolerance.