What Actually Happens When You Open a File?

We open files hundreds of times without ever thinking about what is happening underneath.

Double-click a photograph. Open a PDF. Run a script. Read a configuration file.

To us, the action feels almost instantaneous.

But beneath that simple click, the operating system, filesystem, storage protocol and storage platform may perform a surprisingly sophisticated sequence of operations.

Understanding that sequence is also one of the easiest ways to understand the difference between metadata operations and data I/O.

First, what does “opening a file” actually mean?

Suppose I have a file:

/projects/ai/model/data/image01.jpg

When an application asks the operating system to open this file, it does not immediately begin reading the photograph.

The first task is more basic:

Find the file and determine whether the application is allowed to access it.

That means the system initially works mainly with metadata.

Metadata is information about the file rather than the actual contents of the file.

It can include:

  • File name

  • File type

  • File size

  • Owner

  • Group

  • Permissions

  • Access Control Lists (ACLs)

  • Timestamps

  • Directory location

  • File identifier or inode

  • Information that helps locate the file’s data

The photograph itself — the JPEG bytes — is the data.

That distinction is fundamental.

Step 1: The application asks to open the file

An application may eventually make a system call such as:

open()

Conceptually, it is asking:

“Operating system, please give me access to this file.”

The application provides the pathname:

/projects/ai/model/data/image01.jpg

The filesystem now has to resolve that path.

Step 2: The filesystem resolves the pathname

The filesystem cannot simply jump directly to image01.jpg.

It usually has to work through the directory hierarchy:

/

then:

projects

then:

ai

then:

model

then:

data

and finally:

image01.jpg

Each directory lookup is fundamentally a metadata operation.

The system is repeatedly answering questions such as:

Does this directory entry exist?

What object does this name refer to?

Where is the next directory?

Where is the target file?

This is why workloads involving millions or billions of small files can become extremely metadata-intensive.

The amount of actual file data may not even be very large.

The challenge may instead be the enormous number of operations such as:

lookup

stat

open

create

delete

rename

and

readdir

Step 3: Permissions are checked

Once the filesystem has identified the file, it needs to determine whether the requesting user or process is allowed to access it.

On a typical POSIX-style filesystem, this may involve checking:

  • User ID

  • Group ID

  • UNIX permissions

  • ACLs

  • Other security policies

For example:

-rw-r-----

might mean that the owner can read and write the file, members of the associated group can read it, and everyone else has no access.

Notice something important here:

We still have not read the photograph.

We are still dealing mainly with metadata.

Step 4: The file is opened

If the file exists and the permission checks succeed, the operating system creates the necessary internal state and returns a file descriptor to the application.

A file descriptor is essentially the application’s handle to that open file.

For example:

fd = 5

The application can now use that handle for later operations.

This leads to an important point:

Opening a file does not necessarily mean reading the file’s contents.

open() establishes access to the file.

The actual transfer of file data usually happens afterwards.

Step 5: Now the application asks for the data

Once the file has been opened successfully, the application may issue something equivalent to:

read()

Now the question changes.

Earlier, the system was effectively asking:

“Where is the file?”

Now it is asking:

“Where are the bytes belonging to this file?”

This is where data I/O begins.

The filesystem maps the logical file offsets requested by the application to the underlying blocks or extents where the file data resides.

Those blocks may ultimately live on:

  • SSDs

  • NVMe drives

  • HDDs

  • A remote storage array

  • A distributed filesystem

  • Object-backed storage layers, depending on the architecture

The requested bytes then travel through the storage stack and eventually reach the application.

Only then can an image viewer decode the JPEG and display the photograph.

What changes when the file is on network storage?

The sequence becomes even more interesting when the file is stored remotely.

Imagine the same file is hosted on a NetApp system and accessed over NFS.

The application still performs familiar filesystem operations.

But some of those operations may now require communication across the network.

Conceptually, the path may look like this:

Application

POSIX system call

Linux Virtual File System

NFS client

Network

Storage system

Filesystem metadata and data

Operations such as directory lookup, attribute retrieval and data reads may therefore involve communication with the storage system.

Caching can eliminate many network round trips, but the underlying principle remains the same.

Why metadata performance matters

Consider two workloads.

Workload A: One enormous file

Imagine reading a single 500 GB file sequentially.

This workload is dominated largely by throughput.

The storage system needs to move large amounts of data efficiently.

Workload B: Ten million tiny files

Now imagine ten million files, each only a few kilobytes in size, being repeatedly opened, inspected and closed.

The total amount of data might actually be much smaller.

But the filesystem may have to perform millions of:

  • Directory lookups

  • Attribute checks

  • Permission checks

  • File opens

  • Metadata updates

This workload can therefore become metadata-bound rather than bandwidth-bound.

That distinction becomes extremely important in environments such as:

  • HPC

  • AI and machine learning

  • Software build farms

  • Genomics

  • Analytics

  • Large research environments

Where systems such as NetApp and WEKA become interesting

Different storage architectures handle these operations in different ways.

NetApp ONTAP uses WAFL as its filesystem architecture and serves client workloads through storage controllers while maintaining filesystem metadata and data structures internally.

Distributed filesystems such as WEKA take a different architectural approach, distributing filesystem services across multiple nodes and allowing clients to access the system in parallel.

The internal architecture may be very different.

But the fundamental questions remain the same:

Where is the file?

Who owns it?

Can I access it?

Where is its data?

How quickly can I retrieve it?

That is why understanding metadata and data I/O is so fundamental.

Technologies change.

Protocols change.

Architectures change.

But these filesystem concepts remain remarkably universal.

A simple way to remember it

Think about finding a book in a huge library.

Before reading the book, you first need to determine:

Does the book exist?

Which section is it in?

Which shelf?

Are you allowed to borrow it?

Which exact copy is yours?

That is the equivalent of metadata work.

Only after locating the book do you begin reading the pages.

That is the equivalent of data I/O.

Final thought

A simple action such as opening a photograph can involve several layers of computing:

Application → Operating System → Filesystem → Metadata → Permissions → Storage Protocol → Storage System → Data

Once you understand that path, concepts such as filesystem latency, metadata performance, NFS behaviour, caching, distributed filesystems and HPC storage become much easier to understand.

So the next time you double-click a file and it opens instantly, remember:

A surprisingly sophisticated storage conversation just took place underneath that click.

Comments