Virtual File Systems
A virtual file system isn't tied to a physical storage device. These files live in memory, not on a disk. And the content of these files is dynamic.
The VFS layer routes the open, read, write, and close calls to the right file system. For virtual file systems, the kernel implements these functions. It returns data from internal structures or writes back to its internal objects.
The directories and files are created as and when the system needs them. Only the content is dynamic and comes from internal data structures of the kernel.
Important virtual file systems
/proc
The /proc file system is a virtual file system that provides an interface to kernel data structures. It contains information about each process - such as how it's started, its memory usage, and other details.
The filesystem type is procfs.
It's mostly read only. Some files allow writing to change kernel parameters. For example, you can change the maximum number of open files by writing to /proc/sys/fs/file-max. or IP forwarding by writing to /proc/sys/net/ipv4/ip_forward.
Tools like top, btop read data from /proc file system
/run
This is also a virtual file system but backed by RAM. Such filesystems are of type tmpfs.
This file system is used as a temporary storage for runtime data. It's also used for communication between processes and services.
/proc isn't a real writable file system. It only exposes kernel data structures. /run is a real writable file system that stores runtime data.
Any userspace programs that need to store temporary data can use /run.
/sys
The /sys file system is a virtual file system that provides an interface to kernel device data structures. It contains information about devices, their attributes, and configuration options.
The filesystem type is sysfs.
A write to the /sys file system changes the device's configuration. Updating a value here is the same as using a command line tool like sysctl.
/dev
The /dev file system is a virtual file system that provides an interface to hardware devices. It contains device files that represent hardware devices, such as disks, network interfaces, and USB devices.
This is also of type tmpfs.
/dev is used to interact with devices, while /sys is used to query and modify device properties.
/dev/random
This is one of the kernel's implementations. It's a character device. On read(), the kernel function behind it returns random characters. The client must wait and read as many characters as it needs.