You ever delete a file on Linux, only to find the disk space didn't free up? Or run ls -l and see two files with the same inode number and wonder what kind of sorcery that is? That's a hardlink doing its quiet, confusing thing.
Most people meet hardlinks by accident. They copy something, they move something, they run a command they half-read on Stack Overflow — and suddenly there are two names pointing at the same data. And here's the thing — it's not a copy. Consider this: it's not a shortcut. It's weirder than both Less friction, more output..
If you've ever asked how does a linux hardlink link to another file, you're asking a better question than most tutorials answer. And because the real answer isn't "it points to the file. " There is no "the file" to point to Small thing, real impact. Turns out it matters..
What Is a Linux Hardlink
A hardlink is just another name for the same chunk of data on your disk. Also, not a pointer to a path. Because of that, not a reference to a name. It's a second (or third, or tenth) directory entry that sits in the same inode as the original.
In Linux, the filesystem doesn't really think in "files" the way you do. Still, an inode is a data structure that holds the metadata — permissions, owner, timestamps, and the actual block addresses where your bytes live. It thinks in inodes. A directory, meanwhile, is just a list that maps names to inode numbers.
So when you create a hardlink, you're adding a new row in some directory that says: "this name? On the flip side, it goes to inode 482913. And " And if that inode already has another name somewhere else, congrats — you now have two names for one inode. That's the whole trick.
The Inode Is the File
Look, this is the part most guides get wrong. Neither is the target. In real terms, the original name and the hardlink are equals. In real terms, they say a hardlink "links to another file. Neither is the source. That's why " But there is no "another file" in the sense of a separate object. They're just two directory entries resolved to the same inode And it works..
Delete one? The other keeps working. So the data isn't gone until every name pointing to that inode is removed and no program has it open. That's why your disk space didn't free up earlier — something still had a name (or a handle) on that inode.
It sounds simple, but the gap is usually here.
Same Inode, Same Everything
Because they share an inode, hardlinks share all metadata. Change the permissions on one, and the other reflects it instantly. Edit the contents through one name, open the other — you see the edit. There's no sync happening. There's just one thing with many doors.
Why It Matters
Why should you care? Because hardlinks show up in places you didn't invite them, and they quietly break assumptions.
Say you're backing up a server with rsync and you don't use the right flags. Consider this: rsync might preserve hardlinks — or it might not — and suddenly your backup takes triple the space because what was one inode is now three separate copies. Or you're writing a cleanup script that deletes "old" log files by name, not realizing two names point at the same inode, and your "safe" delete just orphaned live data another process needed Most people skip this — try not to..
This changes depending on context. Keep that in mind.
And on the flip side, hardlinks are genuinely useful. Worth adding: package managers like dpkg use them to save space when shipping identical files across packages. Some backup tools (like Borg or restic, in different ways) lean on link-like structures to dedupe data. Understanding them means you stop being surprised by your own filesystem Nothing fancy..
Turns out, the people who get burned by hardlinks are usually the ones who thought a "file" was a single solid object. On top of that, it isn't. In real terms, it's a name, then an inode, then blocks. Hardlinks just make that layering visible But it adds up..
How It Works
Let's get into the mechanics. Not the ln command alone — the actual chain from typing a command to two names sharing data Simple, but easy to overlook..
Creating One
You run something like:
ln original.txt link.txt
The kernel checks that original.On the flip side, no data copied. Practically speaking, txt exists and grabs its inode number. That's it. On top of that, then it adds a directory entry in the current directory: name link. In real terms, the link count on the inode goes from 1 to 2. txt, inode same-as-original. You can see it with ls -l — the number after permissions is the link count.
Not obvious, but once you see it — you'll see it everywhere.
What the Filesystem Actually Does
Under the hood, the directory is a file too (everything is, on Linux). Now, txt, the system reads the directory, finds the inode, reads the inode, gets the block list, reads your bytes. Open original.When you open link.So it contains entries: name → inode number. txt and it's the exact same walk, just a different first step in a different directory And it works..
This is where a lot of people lose the thread.
There's no "which one is real" flag anywhere. If you rm original.Both names are valid entries. txt, the directory entry vanishes, link count drops to 1, data stays. Even so, the filesystem doesn't track birth order. The inode only gets recycled when link count hits 0 and no process has it open That's the whole idea..
Hardlinks Can't Cross Filesystems
Here's a limit worth knowing. " That's not a bug. Inode 500 on one is unrelated to inode 500 on the other. On the flip side, /dev/sda1 and /dev/sdb1 have their own inode tables. Try ln /home/file /mnt/usb/file and you'll get "Invalid cross-device link.So because a hardlink is just "name → inode number," and inode numbers only mean something within one filesystem, you can't hardlink across a mount boundary. That's the design Small thing, real impact..
Counterintuitive, but true.
Directories and Hardlinks
You also can't hardlink directories (normally). Consider this: why? Because it'd let you create loops in the directory tree, and the tools that walk filesystems — find, fsck, your backup script — would fall into infinite circles. Which means the kernel blocks it for non-root, and even root usually shouldn't. Practically speaking, the . That said, and .. entries you see? Those are hardlinks the system maintains carefully to keep the tree acyclic.
Common Mistakes
This is where people trip. I've done most of these myself Most people skip this — try not to..
One: thinking a hardlink is a separate copy. It isn't. Edit one, you edit both — because there's no "both," there's one inode. Even so, i once confused a teammate by "duplicating" a config and watching the original change when I edited the "copy. " Embarrassing And that's really what it comes down to..
Two: using find -type f -name x | xargs rm and assuming space frees. If ten names point at that inode and you only deleted one, you removed one door. Data's still there under nine others.
Three: expecting a hardlink to "break" when you delete the original. Symlinks break. Hardlinks don't — they were never linked to the name. They shared the inode. So the surviving name just keeps working like nothing happened Still holds up..
Four: trying to hardlink across disks and blaming the command. Still, it's not ln being weird. It's the filesystem boundary. Use a symlink or copy if you need cross-device Worth knowing..
Five: forgetting link counts in backups. If your archive tool flattens hardlinks into copies, your "efficient" snapshot isn't. Check the docs. Real talk, most people find this out when the backup drive fills up halfway through.
Practical Tips
Okay, what actually works when you're dealing with these?
First, always check inode numbers when something feels off. ls -li shows the inode column. Same number, same data — no debate. That one command has saved me more times than I can count No workaround needed..
Second, if you want to find all names pointing at a specific inode, find /path -samefile name does it. Or find / -inum 12345 if you're patient and have root. Worth knowing when cleaning up mystery links.
Third, when backing up, use rsync -aH (or -aHAX if you want ACLs and extended attrs too). The -H tells rsync to preserve hardlinks instead of duplicating. Without it, you might balloon your backup size on systems that use hardlinks heavily — like a lot of distro installs do.
Not the most exciting part, but easily the most useful.
Fourth, don't reach for hardlinks when a symlink is clearer. If you want "
a pointer to a file that might move or live on another filesystem, symlinks are the right tool — they're explicit, they cross devices, and their failure mode (a dangling link) is obvious at a glance. Hardlinks are for when you genuinely want multiple names for the same immutable-on-disk data and you control the lifetime of all those names.
Easier said than done, but still worth knowing.
Fifth, if you're building a system that creates hardlinks programmatically, track the link count from stat() and only treat the file as fully removed when st_nlink hits zero after your unlink call. Relying on filename existence alone will mislead you about whether disk space is actually reclaimed Practical, not theoretical..
Conclusion
Hardlinks aren't a fancy trick — they're the filesystem's native way of saying "this data has more than one name." Once you internalize that there is no copy, no original, and no link in the symlink sense, the rules stop feeling arbitrary. Cross-device failures, undeletable directories, and "why didn't my rm free space" moments all trace back to that one idea: names are cheap, inodes are the truth. Worth adding: use ls -li to confirm, rsync -H to preserve, and symlinks when clarity matters more than sharing. Do that, and hardlinks go from a gotcha to just another boring, reliable part of the toolbox.
Most guides skip this. Don't.
