As far as I know, there are nine hardcoded directory servers in the tor program. So, is it's starting by making one of them as it's guard node and then on step two, obtain data about all other relays in the network and then choose another one as it's guard node for further communications? How is the first connection established and how the steps changes on subsequent runs?
This is a good explanation of the directory servers from the Stem Wiki
At a very high level tor works as follows...
- Volunteer starts a new tor relay, during which it sends a server descriptor to each of the directory authorities.
- Each hour the directory authorities make a vote that says who they think the active relays are in the network and some attributes about them.
- The directory authorities send each other their votes, and compile that into the consensus. This document is very similar to the votes, the only difference being that the majority of the authorities agree upon and sign this document. The idividual relay entries in the vote or consensus is called router status entries.
- Tor clients (people using the service) download the consensus from an authority, fallback, or other mirror to determine who the active relays in the network are. They then use this to construct circuits and use the network.