Lesson 17 · Networking, scripting and internals

How Linux boots

Booting is a relay. Each program is small and only knows enough to load the next, bigger one into memory and hand it the CPU: the firmware starts GRUB, GRUB loads the kernel and the initramfs, the kernel runs /init from the initramfs, /init mounts the real disk and hands over to systemd, and systemd starts every service. Follow one Ubuntu-style PC from the power button to a login prompt, then check the trail with ps, /proc/cmdline and systemd-analyze.

12 min10 steps5 questionsAdvanced

Fig 17 · Interactive

Loading figure…

or ← →

Check yourself

5 quick questions

Pick an answer to see why. Your score saves with your progress.

01In what order do these programs run the CPU while a UEFI PC boots Linux?

It is a relay. The firmware loads GRUB, GRUB loads the kernel and the initramfs, the kernel runs /init from the initramfs, and /init hands over to systemd on the real disk.

02In the GRUB entry linux /boot/vmlinuz root=/dev/sda2 ro, what is root=/dev/sda2 ro?

The GRUB manual says the rest of the linux line is passed verbatim as the kernel command line. root= names the partition that holds /, and ro mounts it read-only first; systemd remounts it read-write later.

03Why does the kernel unpack an initramfs before it mounts the real disk?

The kernel may not have every driver needed to read the real root partition built in. The initramfs brings them along; its /init loads them, mounts the real root and switches to it.

04On a running Ubuntu machine, which command prints the name of process 1?

ps -p 1 selects process ID 1, and -o comm= prints only its command name with no header. On Ubuntu, Debian, Fedora and Arch it prints systemd.

05You want to add a kernel parameter permanently. What is the safe way on Ubuntu?

grub.cfg is generated by grub-mkconfig, so hand edits are overwritten. Change /etc/default/grub and regenerate it. A wrong root= can stop the machine booting, so keep a rescue USB stick ready.

Key terms

Glossary

Firmware (UEFI): The first program the CPU runs, kept in a flash chip on the main board. It wakes the hardware and starts a boot loader. Older PCs use BIOS instead.
EFI system partition: A small FAT-formatted partition on the disk where UEFI firmware looks for boot loaders, such as \EFI\ubuntu\grubx64.efi.
Boot loader (GRUB): A small program that loads the kernel and the initramfs into memory, gives the kernel its command line, and jumps to it.
Kernel command line: A line of settings the boot loader hands the kernel, for example root=/dev/sda2 ro. On a running system it is in /proc/cmdline.
initramfs: A compressed cpio archive the kernel unpacks into memory as a temporary root file system. Its /init program finds and mounts the real disk.
Root file system: The file system mounted at /, the top of the folder tree. root= on the kernel command line says which partition holds it.
PID 1 (init): Process ID 1, the first user-space process. It starts every other service; on most distributions it is systemd.
Unit / target: systemd's names for things it manages: a service is a unit, and a target such as multi-user.target is a goal made of many units.

Fine print

Notes and sources

The machine is an example: an Ubuntu-style PC with UEFI, GRUB, the kernel /boot/vmlinuz and the root file system on /dev/sda2. A real grub.cfg is longer and names the disk by UUID; /proc/cmdline also starts with BOOT_IMAGE=/boot/vmlinuz, cut to "…" on the card.
Warning: grub.cfg is generated; do not edit it by hand. To change the kernel command line, edit GRUB_CMDLINE_LINUX in /etc/default/grub and run sudo update-grub (Ubuntu, Debian) or grub2-mkconfig (Fedora). A wrong root= can leave the machine unable to boot, so keep a rescue USB stick ready.
With Secure Boot on, Ubuntu and Debian first start shimx64.efi, a small signed loader, which then starts grubx64.efi. Older PCs use BIOS instead of UEFI and keep the first stage of GRUB at the start of the disk.
Strictly, the kernel never stops: once it has started it serves every program until power-off. On Fedora the initramfs runs its own copy of systemd as /init; Ubuntu uses a small shell script. Either way the real systemd keeps process ID 1.

Quiz Unlocks after the last step.