Conventions

terse folder name meanings

/dev # DEVice files (endpoints to talk to drivers)
/run # RUNning processes 
/var # VARiable data changes often

/run

Runtime state for running processes

PID files, unix sockets, lock files. Data that’s meaningless after a reboot

/run/sshd.pid           # PID file (just has the pid of the running process)
/run/systemd/           # per daemon subdirs
/run/docker.sock        # unix sockets

/var/run is a symlink to /run, for historical reasons

*.d directory

.d is a convertion that literally means directory.

Wherever there would be a single config file ssh.config, programs can allow a directory for addition config files ssh.config.d/.