Linux exposes its hardware and low-level system interfaces in a surprisingly transparent way. Two directories—/dev and /sys—stand at the center of this architecture, yet many users interact with them daily without fully understanding what they represent.

This article goes under the surface, explaining how Linux exposes devices, how the kernel structures them, and why /dev and /sys are foundational for system administration, storage management, and low-level debugging.

/dev is not a typical directory. It is the kernel’s device interface, containing special files that represent hardware or virtual devices.

These files:

• are not drivers

• do not store data

• act as endpoints through which processes communicate with device drivers inside the kernel

Examples:

• Disks (/dev/sda, /dev/nvme0n1)

• Partitions (/dev/sda1)

• Terminals (/dev/tty*)

• Random generators (/dev/random, /dev/urandom)

• Null sink (/dev/null)

Whenever you write or read from a file in /dev, the kernel routes that operation directly to the corresponding driver.

Running:

ls -l /dev

produces output like:

brw-rw---- 1 root disk 8, 1 Feb 10 10:15 sdb1
crw-rw-rw- 1 root root 1, 3 Feb 10 10:15 random
prw-r--r-- 1 root root 0 Feb 10 10:15 pipe_data
srw-rw-rw- 1 root root 0 Feb 10 10:15 sock_comm

The first character identifies the device type:

Let’s walk through these.

Block devices move data in chunks (blocks).

Examples:

• HDD / SSD

• USB drives

• SD cards

• Disk partitions

They support random access and use filesystems on top of them.

Character devices represent streams.

Examples:

• /dev/input/event* — keyboard, mouse

• /dev/ttyS0 — serial interface

• /dev/null — write-discard sink

• /dev/zero — endless stream of zero bytes

• /dev/random — entropy generator

Writing to /dev/null:

echo "Hello" > /dev/null

— deletes data instantly. No storage, no persistence, just a black hole.

Named pipes provide file-backed IPC:

mkfifo /tmp/mypipe
echo "test" > /tmp/mypipe & cat /tmp/mypipe

Two unrelated processes can exchange data through the pipe.

Unix domain sockets allow high-performance interprocess communication:

• /dev/log — system logging

• Custom sockets /dev/socket/my_app

They work like TCP/UDP sockets but stay inside the kernel.

Each device file comes with identifiers:

• Major number (8) — device driver ID

• Minor number (1) — specific device instance within that driver

All partitions of /dev/sdb share the same major number but different minor numbers.

This mapping is how the kernel routes read/write operations to the correct device.

/dev is populated dynamically at boot or when devices appear.

Managers:

• udevd (systemd-udevd)

• mdevd (in lightweight distros)

Their responsibilities:

• Detect new hardware events

• Match rules

• Load drivers

• Create proper device files inside /dev, applying permissions and groups

Nothing in /dev is permanent—remove the directory completely, reboot, and it will be rebuilt.

/sys exposes the kernel’s internal device tree and configuration through the sysfs virtual filesystem.

It is not used for I/O.

Instead, /sys provides:

• hierarchical hardware representation

• device metadata

• driver binding

• tunable kernel interfaces

Examples:

/sys/class/net/eth0/address
/sys/block/sda/size
/sys/devices/system/cpu/cpu0/cpufreq/scaling_governor

Each of these is a window into kernel state.

echo "Hello" > /dev/null

head -c 10 /dev/random

cat /sys/class/net/eth0/address

mkfifo /tmp/mypipe
echo "msg" > /tmp/mypipe & cat /tmp/mypipe

/dev and /sys form the foundation of how Linux represents hardware and kernel structures:

• /dev gives interfaces to devices

• /sys gives introspection and configuration

• together they allow transparent, UNIX-style simplicity for hardware abstraction

Understanding them gives you precise control over disks, terminals, input streams, drivers, and the kernel itself.