Windows into the Kernel
We said "everything is a file." Linux takes this literally with virtual filesystems (also called pseudo-filesystems).
Directories like /proc and /sys do not contain real files sitting on your hard drive. They consume no disk space. Instead, they are interfaces created by the kernel on the fly, presenting live system information as if it were files. When you read from these "files," the kernel generates the content at that exact moment. When you write to certain files in /sys, you're directly modifying kernel behavior.
The /proc Filesystem: Process and System Information
The /proc directory provides information about running processes and kernel state. It grew organically over decades, so its structure is somewhat inconsistent — but it's universally available on every Linux system.
Process information:
Every running process gets a directory named by its PID, exposing everything from its command line and environment to its memory maps and open file descriptors as readable files underneath.
Key files in /proc/[pid]/:
| File | Contents |
|---|---|
cmdline |
Null-separated command line arguments used to start the process |
environ |
Null-separated environment variables |
fd/ |
Directory of symlinks, one per open file descriptor |
status |
Human-readable process status (state, memory, UID, etc.) |
maps |
Memory mappings (which libraries and files are mapped into memory) |
net/tcp |
TCP socket table for this process's network namespace |
System-wide information:
The same pattern extends to system-wide state: /proc/cpuinfo reports CPU model, core count, and feature flags; /proc/meminfo holds memory statistics; /proc/version has kernel build info; /proc/mounts gives a live view of currently mounted filesystems; /proc/loadavg exposes the 1/5/15-minute load averages; and /proc/net/dev provides per-interface network statistics.
The /sys Filesystem: Hardware and Driver Interface
While /proc evolved organically, /sys (the sysfs filesystem) was designed with structure in mind. Introduced in Linux 2.6, it provides a hierarchical view of devices, drivers, and kernel subsystems organized by the kernel's internal object model. /sys/block/ lists the block devices the kernel knows about, and each device's directory exposes tunables like its active I/O scheduler (reported as a bracketed choice among several available schedulers). Similarly, each network interface under /sys/class/net/ exposes details like its MAC address and link state.
The power of /sys — it's writable:
Unlike /proc (mostly read-only), many /sys files accept writes to change live system behavior without rebooting — swapping a disk's I/O scheduler, adjusting its read-ahead buffer size for sequential workloads, or tuning any number of other driver and subsystem parameters, simply by writing the new value to the corresponding file.
Note: changes to /sys are not persistent across reboots. To make them permanent, use udev rules or systemd service units that apply the settings at boot.
Practical Uses for Engineers
Because these are just files, standard text tools work directly against them. Memory pressure can be summarized straight from /proc/meminfo without the free command ever being installed. Kernel-tunable parameters live under /proc/sys/ and can be read directly from their individual files or listed in bulk via sysctl. And the raw TCP connection table in /proc/net/tcp lets you see what's listening on a port even on a minimal system that lacks netstat or ss.
When asked "How would you check system resource usage without installing any tools?" — demonstrate knowledge of /proc. Commands like cat /proc/loadavg, cat /proc/meminfo, and cat /proc/cpuinfo work on any Linux system, including minimal containers and rescue environments. This shows you understand the system at a fundamental level, not just the tools layered on top. Follow up by noting that top, free, ps, and lscpu are all just user-friendly wrappers that read from these same files.
Key Point: Every standard monitoring tool — top, ps, free, lscpu, lsblk, ss — is ultimately a reader of /proc and /sys. Understanding the raw source means you can extract information on any Linux system regardless of what's installed. In a container debugging scenario where you have only a shell and no utilities, /proc is your lifeline.