Inodes — Trivia & Interesting Facts¶
Surprising, historical, and little-known facts about inodes and Unix filesystem internals.
The "i" in inode probably stands for "index" — but nobody is sure¶
Dennis Ritchie, when asked about the etymology of "inode," said: "In truth, I don't know either. It was just a term that we started to use." The most accepted theory is that "i" stands for "index," since the inode table is an indexed array. Other theories suggest "information" or that it was simply an arbitrary label from the PDP-7 filesystem.
Running out of inodes is possible even with disk space available¶
A filesystem can have gigabytes of free space but zero free inodes, making it impossible to create new files. This happens when millions of tiny files are created (common with mail servers, news spools, or container layers). The default ext4 ratio is one inode per 16 KB of disk, but this can only be set at filesystem creation time with mkfs.ext4 -i.
Inode numbers are recycled¶
When a file is deleted, its inode number goes back into the free pool and can be reassigned to a new file. This means inode numbers are not globally unique over time — only unique at any given moment. Forensic tools must track inode allocation history to avoid confusing deleted and newly created files.
Filenames are NOT stored in the inode¶
This surprises most people: the inode contains the file's metadata (permissions, timestamps, size, block pointers) but NOT its name. Filenames are stored in directory entries, which are just tables mapping names to inode numbers. This is why hard links work — multiple directory entries can point to the same inode.
Hard links cannot cross filesystem boundaries because of inode numbering¶
Each filesystem has its own independent inode table, numbered starting from 1. Inode 42 on /dev/sda1 is a completely different entity from inode 42 on /dev/sda2. Hard links are just directory entries pointing to an inode number, so they cannot reference an inode on a different filesystem. Symbolic links solve this by storing a path string instead.
Inode 2 is always the root directory¶
On ext2/3/4 filesystems, inode 1 is reserved for tracking bad blocks, and inode 2 is always the root directory (/). Inodes 3-10 are reserved for special purposes (the journal, ACLs, etc.). User files start at inode 11. This convention dates back to the original ext filesystem in 1992.
The stat command reveals the hidden inode world¶
Running stat filename shows the inode number, link count, block count, and all three timestamps (access, modify, change). The "change" timestamp (ctime) records when the inode metadata was last modified, not when the file content changed — a distinction that trips up even experienced administrators.
Deleting a file does not immediately free its inode¶
When you rm a file, the link count in its inode decreases by one. The inode and its data blocks are only freed when the link count reaches zero AND no process has the file open. This is why you can delete a log file that a running process is writing to, and the disk space is not reclaimed until the process exits or closes the file.
ext4 can hold about 4 billion inodes¶
The ext4 filesystem uses 32-bit inode numbers, supporting up to 2^32 (approximately 4.3 billion) inodes. In practice, the actual limit depends on the inode ratio chosen at format time. A 1 TB ext4 filesystem with default settings gets about 65 million inodes. XFS uses 64-bit inode numbers, supporting vastly more.
The three Unix timestamps have a fourth sibling¶
Beyond atime (access), mtime (modification), and ctime (inode change), ext4 added crtime — the creation (birth) timestamp. For decades, Unix had no way to know when a file was originally created. The stat command shows it as "Birth" on supported filesystems, and statx() (added in Linux 4.11, 2017) is the system call that exposes it.
Watching for inode exhaustion is a lost art¶
Monitoring tools typically alert on disk space percentage but ignore inode usage. df -i shows inode utilization, and a filesystem at 100% inode usage produces the same "No space left on device" error as full disk — making it extremely confusing to diagnose. Container orchestration platforms like Kubernetes added inode eviction thresholds after learning this lesson the hard way.