Inodes¶
25 cards — 🟢 3 easy | 🟡 5 medium | 🔴 2 hard
🟢 Easy (3)¶
1. What is an inode?
Show answer
An inode is a data structure on a Linux filesystem that stores metadata about a file — permissions, owner, group, size, timestamps, and pointers to data blocks. Everything except the filename. The filename is stored in the directory entry, which maps the name to an inode number. Each file has exactly one inode.2. How do you check inode usage on a filesystem?
Show answer
df -i shows inode usage per filesystem (total, used, free, percentage). ls -i' | sort | uniq -c | sort -rn | head finds directories with the most files (inode consumers).
3. How do inodes differ for symlinks vs hard links?
Show answer
A symlink is a separate file with its own inode — its data block contains the path to the target. A hard link shares the same inode as the original file. Symlinks can cross filesystem boundaries and point to directories; hard links cannot. Deleting the symlink target leaves a dangling symlink; deleting one hard link leaves others intact.🟡 Medium (5)¶
1. What happens when a filesystem runs out of inodes?
Show answer
You cannot create new files, directories, symlinks, or sockets even if disk space is available. The error is "No space left on device" which is misleading — df shows free space but df -i shows 100% inode usage. Common cause: millions of tiny files (mail queues, session files, container layers, package caches).2. How do inodes relate to hard links?
Show answer
A hard link is an additional directory entry pointing to the same inode. The inode's link count tracks how many names reference it. The file's data is only freed when the link count drops to zero and no process has it open. This is why you can delete a file that a process is using — the data persists until the process closes it.3. How do you recover from inode exhaustion?
Show answer
1) Find directories with the most files: find / -xdev -printf '%h' | sort | uniq -c | sort -rn | head -20. 2) Delete unnecessary small files (old logs, temp files, cached sessions). 3) For container hosts, prune unused images/layers: docker system prune. 4) Long-term: use XFS (dynamic inode allocation) instead of ext4 (fixed at mkfs time).
4. Why are inodes important in containerized environments?
Show answer
Each container layer adds files with their own inodes on the host filesystem. Dense container hosts (running hundreds of containers) can exhaust inodes even with ample disk space. Docker's overlay2 storage driver is better than aufs for inode efficiency. Monitor inode usage alongside disk space on container hosts.5. What are the three inode timestamps and when do they update?
Show answer
atime (access time): updated when file data is read (often disabled via noatime mount for performance). mtime (modification time): updated when file data is written. ctime (change time): updated when inode metadata changes (permissions, ownership, link count). ctime cannot be set manually — it always reflects the last metadata change.🔴 Hard (2)¶
1. What does an inode contain internally?
Show answer
An inode stores: file type (regular, directory, symlink, socket, device), permissions (mode bits), owner UID, group GID, size in bytes, timestamps (atime, mtime, ctime), link count, and pointers to data blocks (direct pointers + indirect/double-indirect/triple-indirect pointers for large files). On ext4, inodes are 256 bytes by default.2. How are inodes allocated on ext4 vs XFS?