LFCS 68 🐧 Boot Process — Overview - KandZ

⏱️ Estimated read: 12 min | |

The Linux boot process is a sequence of handoffs: firmware to bootloader, bootloader to kernel, kernel to initramfs, and initramfs to the real root filesystem where systemd takes over as PID 1. For the LFCS exam, the objective is not to memorize every driver load but to understand the stages, the components responsible for each, and where a failure can be diagnosed. A system that fails to boot is failing at a specific transition, and knowing the sequence narrows the problem.

This chapter provides the overview: the firmware stage, the GRUB2 bootloader, the kernel and initramfs, and the transition to systemd. It covers what each stage does, which commands inspect the boot timeline, and the distinction between the initramfs environment and the regular boot that follows.

Key point: The initramfs exists to solve one problem: the kernel cannot mount the real root filesystem if that filesystem depends on drivers or tools the kernel does not have built in. The initramfs loads those tools, mounts the root, and then discards itself via switch_root.

Why the boot process matters

The diagnosis problem. A system that hangs at a blinking cursor, drops to an emergency shell, or fails to find its root device is failing at a known point in a known sequence. Without the sequence, troubleshooting is guesswork. With it, the failure point identifies the responsible component: firmware settings, GRUB configuration, initramfs contents, or systemd unit dependencies.

The initramfs problem. Modern root filesystems frequently sit behind LVM, software RAID, LUKS encryption, or network storage. The kernel image alone does not carry the drivers or userspace tools for these setups. The initramfs is a temporary, RAM-based filesystem that bridges that gap. Understanding why it exists explains why rebuilding it after a kernel update or storage change is sometimes necessary .

The systemd transition problem. Once the root filesystem is mounted and switch_root completes, the boot enters a different phase governed by systemd targets. The initramfs boot and the system boot are not the same process, even though they share systemd as the init program in many distributions. Confusing the two leads to misdiagnosis: a failure before switch_root cannot be fixed by changing a systemd unit .

a. Firmware and the Bootloader

The boot begins with firmware. On BIOS systems, the firmware performs a Power-On Self-Test (POST), initializes hardware, and reads the Master Boot Record (MBR) from the boot device. The MBR contains a small boot code stub that points to GRUB2 . On UEFI systems, the firmware reads boot entries from NVRAM and executes a signed EFI binary from the EFI System Partition, typically a FAT32 partition mounted at /boot/efi .

GRUB2’s job is to load the kernel and initramfs into memory and transfer control. It reads its configuration from /boot/grub2/grub.cfg on RHEL-family systems or /boot/grub/grub.cfg on Debian-family systems. The human-edited defaults live in /etc/default/grub, and the rendered configuration is regenerated with grub2-mkconfig on RHEL or update-grub on Debian .

# Inspect the current GRUB default entry and timeout
cat /etc/default/grub

# Regenerate GRUB configuration on RHEL-family systems
sudo grub2-mkconfig -o /boot/grub2/grub.cfg

# Regenerate GRUB configuration on Debian-family systems
sudo update-grub

GRUB2 loads two files: the compressed kernel image (vmlinuz-<version>) and the initramfs image (initramfs-<version>.img on RHEL, initrd.img-<version> on Debian). It then jumps to the kernel entry point .

b. Kernel and initramfs

Once the kernel is running, it decompresses and mounts the initramfs as a temporary root filesystem in RAM. The initramfs contains the drivers and tools needed to locate and mount the real root filesystem—LVM tools, RAID assembly utilities, LUKS decryption, or network drivers for iSCSI or NFS roots .

The kernel executes /init inside the initramfs, which orchestrates the root filesystem discovery. When the real root is mounted at /sysroot, a switch_root operation discards the initramfs and executes the real /sbin/init from the mounted root .

# Check which initramfs image corresponds to the running kernel
ls -l /boot/initramfs-$(uname -r).img

# Rebuild the initramfs on RHEL-family systems (dracut)
sudo dracut --force /boot/initramfs-$(uname -r).img $(uname -r)

# Rebuild the initramfs on Debian-family systems (initramfs-tools)
sudo update-initramfs -u -k $(uname -r)

The initramfs is not the same as the regular boot environment. It is a minimal environment whose only purpose is to find and mount the root. If the root cannot be found—because a driver is missing, an LVM volume is not activated, or an encrypted volume cannot be unlocked—the system stops in the initramfs and drops to a shell rather than reaching systemd .

c. systemd as PID 1 and Targets

After switch_root, the real /sbin/init executes as PID 1. On systemd-based distributions, this is a symlink to /usr/lib/systemd/systemd . From this point, the boot is governed by systemd units and targets rather than the initramfs scripts.

systemd mounts remaining filesystems, activates udev, and begins pulling in unit dependencies starting at sysinit.target and basic.target. The final state is determined by default.target, which is typically a symlink to either multi-user.target (text console) or graphical.target (graphical login) .

# Show the current default boot target
systemctl get-default

# Set the default boot target to multi-user (text console)
sudo systemctl set-default multi-user.target

# Show the boot timeline broken into kernel, initrd, and userspace phases
systemd-analyze

# Show the critical chain of units that delayed boot the most
systemd-analyze critical-chain

The systemd-analyze command is the primary tool for understanding where boot time is spent. It separates the kernel and initramfs time from the userspace time consumed by systemd units, which distinguishes a slow kernel or initramfs from a slow service .

Complete Example Session

# ============================================
# PART 1: IDENTIFY FIRMWARE TYPE
# ============================================
# Check if the system booted via UEFI
[ -d /sys/firmware/efi ] && echo "UEFI" || echo "BIOS/Legacy"

# List UEFI boot entries (UEFI systems only)
efibootmgr -v


# ============================================
# PART 2: INSPECT GRUB CONFIGURATION
# ============================================
# View the human-edited GRUB defaults
cat /etc/default/grub

# View the rendered GRUB configuration (entry list)
grep -E "^menuentry|^submenu" /boot/grub2/grub.cfg


# ============================================
# PART 3: IDENTIFY KERNEL AND INITRAMFS FILES
# ============================================
# Show the kernel image and initramfs for the running kernel
ls -lh /boot/vmlinuz-$(uname -r) /boot/initramfs-$(uname -r).img

# List all installed kernels
ls /boot/vmlinuz-*


# ============================================
# PART 4: INSPECT INITRAMFS CONTENTS
# ============================================
# List the first entries inside the initramfs (RHEL: lsinitrd)
lsinitrd /boot/initramfs-$(uname -r).img | head -30

# On Debian, lsinitramfs lists contents
lsinitramfs /boot/initrd.img-$(uname -r) | head -30


# ============================================
# PART 5: REBUILD INITRAMFS AFTER STORAGE CHANGE
# ============================================
# RHEL-family: regenerate with dracut
sudo dracut --force /boot/initramfs-$(uname -r).img $(uname -r)

# Debian-family: regenerate with update-initramfs
sudo update-initramfs -u -k $(uname -r)


# ============================================
# PART 6: ANALYZE BOOT TIME
# ============================================
# Show kernel, initrd, and userspace breakdown
systemd-analyze

# Show the slowest chain of units
systemd-analyze critical-chain


# ============================================
# PART 7: CHECK THE DEFAULT TARGET
# ============================================
# Show what the system boots into
systemctl get-default

# Show the target of the current running system
systemctl list-units --type=target --state=active


# ============================================
# PART 8: IDENTIFY PID 1
# ============================================
# Confirm systemd is PID 1
ps -p 1 -o comm=

# Show the symlink path
ls -l /sbin/init


# ============================================
# PART 9: UNDERSTAND EMERGENCY BOOT
# ============================================
# emergency.target mounts root read-only, almost no services
# Used to fix a broken /etc/fstab
# At the GRUB menu, edit the kernel line and append:
# systemd.unit=emergency.target


# ============================================
# PART 10: VERIFY BOOT COMPONENTS ARE PRESENT
# ============================================
# Check that GRUB, kernel, and initramfs all exist
test -f /boot/grub2/grub.cfg && echo "GRUB config OK"
test -f /boot/vmlinuz-$(uname -r) && echo "Kernel OK"
test -f /boot/initramfs-$(uname -r).img && echo "Initramfs OK"

The ten parts move from identifying the firmware to inspecting the initramfs to measuring boot time. The critical commands are lsinitrd, dracut, systemd-analyze, and systemctl get-default. Together they cover the stages a boot failure can occur in.

Quick Reference

Boot Stages and Components

Stage	Component	Responsibility
1	Firmware (BIOS/UEFI)	POST, hardware init, locate boot device
2	GRUB2	Load kernel and initramfs into memory
3	Kernel	Initialize hardware, mount initramfs
4	initramfs	Find and mount real root, `switch_root`
5	systemd (PID 1)	Mount filesystems, start units, reach target

Boot Inspection Commands

Command	Purpose
`systemd-analyze`	Kernel/initrd/userspace time breakdown
`systemd-analyze critical-chain`	Slowest unit dependency chain
`lsinitrd` / `lsinitramfs`	Inspect initramfs contents
`systemctl get-default`	Show default boot target
`efibootmgr -v`	List UEFI boot entries

Initramfs Rebuild Commands

Distribution	Command
RHEL/Fedora	`dracut --force /boot/initramfs-$(uname -r).img $(uname -r)`
Debian/Ubuntu	`update-initramfs -u -k $(uname -r)`

Best Practices

✅ Do This:

# Check firmware type before troubleshooting boot
[ -d /sys/firmware/efi ] && echo "UEFI" || echo "BIOS"              # ✅

# Rebuild initramfs after changing LVM, RAID, or LUKS configuration
sudo dracut --force /boot/initramfs-$(uname -r).img $(uname -r)      # ✅

# Use systemd-analyze to separate kernel time from userspace time
systemd-analyze                                                       # ✅

# Verify the default target before rebooting after a change
systemctl get-default                                                 # ✅

# Inspect initramfs contents when the root device is not found
lsinitrd /boot/initramfs-$(uname -r).img | grep -i lvm               # ✅

❌ Don’t Do This:

# Edit /boot/grub2/grub.cfg directly
# Regenerating overwrites manual changes                                # ❌

# Forget to rebuild initramfs after adding a new LVM volume
# The root may not be found at next boot                                # ❌

# Assume a boot hang is a systemd problem
# It may be failing in the initramfs before systemd runs                # ❌

# Change default target without verifying the target exists
systemctl set-default nonexistent.target                              # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
Root device not found at boot	Initramfs lacks driver for storage	Rebuild initramfs with `dracut` or `update-initramfs`
Boot hangs at GRUB prompt	GRUB config missing or corrupt	Regenerate with `grub2-mkconfig` or `update-grub`
System boots to text instead of GUI	`default.target` points to `multi-user.target`	`systemctl set-default graphical.target`
Kernel panic after update	Initramfs not rebuilt for new kernel	Rebuild initramfs for the new kernel version
Slow boot blamed on systemd	Time spent in kernel or initramfs	Use `systemd-analyze` to isolate the phase

Real-World Examples

1. Check Firmware Type

[ -d /sys/firmware/efi ] && echo "UEFI" || echo "BIOS"

2. List UEFI Boot Entries

sudo efibootmgr -v

3. View GRUB Defaults

cat /etc/default/grub

4. Regenerate GRUB on RHEL

sudo grub2-mkconfig -o /boot/grub2/grub.cfg

5. Regenerate GRUB on Debian

sudo update-grub

6. Rebuild Initramfs on RHEL

sudo dracut --force /boot/initramfs-$(uname -r).img $(uname -r)

7. Rebuild Initramfs on Debian

sudo update-initramfs -u -k $(uname -r)

8. Analyze Boot Time

systemd-analyze

9. Show Critical Chain

systemd-analyze critical-chain

10. Check Default Target

systemctl get-default

Visual

The Boot Sequence

┌──────────────────────────────────────────────────────────────┐
│  POWER ON                                                    │
│                                                              │
│  ┌─────────────────┐                                        │
│  │ BIOS/UEFI       │  POST, hardware init                   │
│  │ (firmware)      │  Locate boot device                    │
│  └────────┬────────┘                                        │
│           ▼                                                  │
│  ┌─────────────────┐                                        │
│  │ GRUB2           │  Read grub.cfg                         │
│  │ (bootloader)    │  Load vmlinuz + initramfs              │
│  └────────┬────────┘                                        │
│           ▼                                                  │
│  ┌─────────────────┐                                        │
│  │ Kernel          │  Decompress, init hardware             │
│  │                 │  Mount initramfs as tmpfs              │
│  └────────┬────────┘                                        │
│           ▼                                                  │
│  ┌─────────────────┐                                        │
│  │ initramfs       │  Run /init                             │
│  │ (temporary)     │  Load storage drivers                  │
│  │                 │  Mount real root at /sysroot           │
│  └────────┬────────┘                                        │
│           ▼                                                  │
│  ┌─────────────────┐                                        │
│  │ switch_root     │  Discard initramfs                     │
│  │                 │  Exec real /sbin/init                  │
│  └────────┬────────┘                                        │
│           ▼                                                  │
│  ┌─────────────────┐                                        │
│  │ systemd (PID 1) │  sysinit.target → basic.target         │
│  │                 │  → default.target                      │
│  └────────┬────────┘                                        │
│           ▼                                                  │
│  ┌─────────────────┐                                        │
│  │ Login prompt    │  getty or display manager              │
│  └─────────────────┘                                        │
│                                                              │
│  A failure at any box drops the system before the next.      │
│                                                              │
└──────────────────────────────────────────────────────────────┘

Initramfs Purpose

┌──────────────────────────────────────────────────────────────┐
│  WHY INITRAMFS EXISTS                                        │
│                                                              │
│  Kernel image alone:                                         │
│  ┌─────────────────────────────────────────┐                │
│  │ Has core drivers compiled in            │                │
│  │ Does NOT have LVM tools                 │                │
│  │ Does NOT have LUKS unlock utilities     │                │
│  │ Does NOT have network drivers for iSCSI │                │
│  └─────────────────────────────────────────┘                │
│                                                              │
│  Initramfs provides:                                         │
│  ┌─────────────────────────────────────────┐                │
│  │ LVM activation binaries                 │                │
│  │ cryptsetup for LUKS                     │                │
│  │ mdadm for software RAID                 │                │
│  │ Network drivers and DHCP client         │                │
│  └─────────────────────────────────────────┘                │
│                                                              │
│  The initramfs is a bridge.                                 │
│  It mounts the root, then disappears via switch_root.       │
│                                                              │
└──────────────────────────────────────────────────────────────┘

systemd Boot Targets

┌──────────────────────────────────────────────────────────────┐
│  SYSTEMD BOOT TARGET PROGRESSION                             │
│                                                              │
│  sysinit.target                                              │
│  ┌─────────────────┐                                        │
│  │ Early boot      │  udev, filesystem mounts               │
│  └────────┬────────┘                                        │
│           ▼                                                  │
│  basic.target                                                │
│  ┌─────────────────┐                                        │
│  │ Basic services  │  Sockets, timers, paths                │
│  └────────┬────────┘                                        │
│           ▼                                                  │
│  ┌─────────────────────────────────────────┐                │
│  │ default.target                          │                │
│  │                                         │                │
│  │  ┌───────────────┐  ┌───────────────┐   │                │
│  │  │ multi-user    │  │ graphical     │   │                │
│  │  │ (text login)  │  │ (GUI login)   │   │                │
│  │  │ runlevel 3    │  │ runlevel 5    │   │                │
│  │  └───────────────┘  └───────────────┘   │                │
│  └─────────────────────────────────────────┘                │
│                                                              │
│  Check with: systemctl get-default                           │
│  Set with:   systemctl set-default <target>                  │
│                                                              │
└──────────────────────────────────────────────────────────────┘

Boot Time Analysis

┌──────────────────────────────────────────────────────────────┐
│  systemd-analyze OUTPUT STRUCTURE                            │
│                                                              │
│  Startup finished in Xs (kernel) + Ys (initrd) + Zs (userspace)│
│                          │            │            │         │
│                          ▼            ▼            ▼         │
│  ┌─────────────────┐ ┌──────────┐ ┌──────────────┐          │
│  │ Kernel init     │ │ initramfs│ │ systemd units│          │
│  │ Hardware setup  │ │ Root find│ │ Service start│          │
│  └─────────────────┘ └──────────┘ └──────────────┘          │
│                                                              │
│  If Zs is large: use systemd-analyze critical-chain          │
│  If Ys is large: initramfs is slow (storage discovery)       │
│  If Xs is large: kernel hardware detection                   │
│                                                              │
│  This separates the three phases so you fix the right one.  │
│                                                              │
└──────────────────────────────────────────────────────────────┘

Summary

Item	Value
Firmware	BIOS (MBR) or UEFI (ESP, EFI binary)
Bootloader	GRUB2, config in `/etc/default/grub`
GRUB config regenerate	`grub2-mkconfig` (RHEL), `update-grub` (Debian)
Kernel files	`vmlinuz-<version>`, `initramfs-<version>.img`
Initramfs purpose	Find and mount real root, then `switch_root`
Initramfs rebuild	`dracut` (RHEL), `update-initramfs` (Debian)
PID 1	systemd (`/sbin/init` → `/usr/lib/systemd/systemd`)
Boot timeline tool	`systemd-analyze`
Default target	`multi-user.target` or `graphical.target`
Target inspection	`systemctl get-default`

Key takeaways:

The boot is a chain of handoffs. Firmware loads GRUB2. GRUB2 loads the kernel and initramfs. The kernel runs initramfs /init. The initramfs mounts the real root and executes switch_root. systemd takes over as PID 1. A failure at any point stops the chain.
The initramfs is temporary and specific. It exists to provide drivers and tools the kernel lacks for mounting the root filesystem. After switch_root, it is discarded. Changing storage configuration (LVM, RAID, LUKS) may require rebuilding it.
systemd-analyze separates the phases. It reports kernel time, initramfs time, and userspace time independently. This tells you whether a slow boot is a hardware/kernel issue or a service startup issue.
GRUB configuration is generated, not hand-edited. Edit /etc/default/grub or use grubby, then regenerate with grub2-mkconfig or update-grub. Direct edits to grub.cfg are overwritten.
default.target determines the final state. multi-user.target is the text console; graphical.target includes the display manager. systemctl get-default and systemctl set-default are the inspection and configuration commands.

Remember: The LFCS boot process objective is about knowing where things happen, not memorizing every script. The firmware hands to GRUB, GRUB hands to the kernel, the kernel hands to the initramfs, the initramfs hands to the real root, and the real root runs systemd. Each handoff has a component, a configuration location, and a failure mode. When a system fails to boot, identify the last successful stage and fix the component responsible for the next one. The initramfs is the stage most often misunderstood—it is not the system, it is the bridge to the system, and it disappears the moment the real root is mounted.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!