Contents

Initial ramdisk

Many Linux distributions ship a single, generic Linux kernel image – one that the distribution's developers create specifically to boot on a wide variety of hardware. The device drivers for this generic kernel image are included as loadable kernel modules because statically compiling many drivers into one kernel causes the kernel image to be much larger, perhaps too large to boot on computers with limited memory, or in some cases to cause boot-time crashes or other problems due to probing for nonexistent or conflicting hardware. This static-compiled kernel approach also leaves modules in kernel memory which are no longer used or needed, and raises the problem of detecting and loading the modules necessary to mount the root file system at boot time, or for that matter, deducing where or what the root file system is.^[1]

To further complicate matters, the root file system may be on a software RAID volume, LVM, NFS (on diskless workstations), or on an encrypted partition. All of these require special preparations to mount.^[2]

Another complication is kernel support for hibernation, which suspends the computer to disk by dumping an image of the entire contents of memory to a swap partition or a regular file, then powering off. On next boot, this image has to be made accessible before it can be loaded back into memory.

To avoid having to hardcode handling for so many special cases into the kernel, an initial boot stage with a temporary root file-system – now dubbed early user space – is used. This root file-system can contain user-space helpers which do the hardware detection, module loading and device discovery necessary to get the real root file-system mounted.^[2]

Animage of this initial root file system (along with the kernel image) must be stored somewhere accessible by the Linux bootloader or the boot firmware of the computer. This can be the root file system itself, a boot image on an optical disc, a small partition on a local disk (aboot partition, usually using ext2orFAT file systems), or a TFTP server (on systems that can boot from Ethernet).

The bootloader will load the kernel and initial root file system image into memory and then start the kernel, passing in the memory address of the image. At the end of its boot sequence, the kernel tries to determine the format of the image from its first few blocks of data, which can lead either to the initrd or initramfs scheme.

In the initrd scheme, the image may be a file system image (optionally compressed), which is made available in a special block device (/dev/ram) that is then mounted as the initial root file system.^[3] The driver for that file system must be compiled statically into the kernel. Many distributions originally used compressed ext2 file system images, while the others (including Debian 3.1) used cramfs in order to boot on memory-limited systems, since the cramfs image can be mounted in-place without requiring extra space for decompression. Once the initial root file system is up, the kernel executes /linuxrc as its first process;^[4] when it exits, the kernel assumes that the real root file system has been mounted and executes /sbin/init to begin the normal user-space boot process.^[3]

In the initramfs scheme (available since the Linux kernel 2.6.13), the image may be a cpio archive (optionally compressed). The archive is unpacked by the kernel into a special instance of a tmpfs that becomes the initial root file system. This scheme has the advantage of not requiring an intermediate file system or block drivers to be compiled into the kernel.^[5] Some systems use the dracut package to create an initramfs image.^[6] In the initramfs scheme, the kernel executes /init as its first process that is not expected to exit.^[5] For some applications, initramfs can use the casper utility to create a writable environment using unionfs to overlay a persistence layer over a read-only root filesystem image. For example, overlay data can be stored on a USB flash drive, while a compressed SquashFS read-only image stored on a live CD acts as a root filesystem.^[7][8]

Depending on which algorithms were compiled statically into it, the kernel can unpack initrd/initramfs images compressed with gzip, bzip2, LZMA, XZ, LZO, LZ4,^[9] and zstd.

Some Linux distributions such as Debian will generate a customized initrd image which contains only whatever is necessary to boot some particular computer, such as ATA, SCSI and filesystem kernel modules. These typically embed the location and type of the root file system.

Other Linux distributions (such as Fedora and Ubuntu) generate a more generic initrd image. These start only with the device name of the root file system (or its UUID) and must discover everything else at boot time. In this case, the software must perform a complex cascade of tasks to get the root file system mounted:

• Any hardware drivers that the boot process depends on must be loaded. A common arrangement is to pack kernel modules for common storage devices onto the initrd and then invoke a hotplug agent to pull in modules matching the computer's detected hardware.
• On systems which display a boot splash screen, the video hardware must be initialized and a user-space helper started to paint animations onto the display in lockstep with the boot process.
• If the root file system is on NFS, it must then bring up the primary network interface, invoke a DHCP client, with which it can obtain a DHCP lease, extract the name of the NFS share and the address of the NFS server from the lease, and mount the NFS share.
• If the root file system appears to be on a software RAID device, there is no way of knowing which devices the RAID volume spans; the standard MD utilities must be invoked to scan all available block devices and bring the required ones online.
• If the root file system appears to be on a logical volume, the LVM utilities must be invoked to scan for and activate the volume group containing it.
• If the root file system is on an encrypted block device, the software needs to invoke a helper script to prompt the user to type in a passphrase and/or insert a hardware token (such as a smart card or a USB security dongle), and then create a decryption target with the device mapper.

Some distributions use an event-driven hotplug agent such as udev, which invokes helper programs as hardware devices, disk partitions and storage volumes matching certain rules come online. This allows discovery to run in parallel, and to progressively cascade into arbitrary nestings of LVM, RAID or encryption to get at the root file system.

When the root file system finally becomes visible, any maintenance tasks that cannot run on a mounted root file system are done, the root file system is mounted read-only, and any processes that must continue running (such as the splash screen helper and its command FIFO) are hoisted into the newly mounted root file system.

The final root file system cannot simply be mounted over /, since that would make the scripts and tools on the initial root file system inaccessible for any final cleanup tasks:

• On an initrd, the new root is mounted at a temporary mount point and rotated into place with pivot_root(8) (which was introduced specifically for this purpose). This leaves the initial root file system at a mount point (such as /initrd) where normal boot scripts can later unmount it to free up memory held by the initrd.
• On an initramfs, the initial root file system cannot be rotated away.^[10] Instead, it is simply emptied and the final root file system mounted over the top.

Most initial root file systems implement /linuxrcor/init as a shell script and thus include a minimal shell (usually /bin/ash) along with some essential user-space utilities (usually the BusyBox toolkit). To further save space, the shell, utilities and their supporting libraries are typically compiled with space optimizations enabled (such as with gcc's "-Os" flag) and linked against klibc, a minimal version of the C library written specifically for this purpose.^[11]

Installers for Linux distributions typically run entirely from an initramfs, as they must be able to host the installer interface and supporting tools before any persistent storage has been set up.^{[citation needed]}

Tiny Core Linux^[12] and Puppy Linux^{[13][failed verification]} can run entirely from initrd.

This section needs additional citations for verification. Please help improve this articlebyadding citations to reliable sources in this section. Unsourced material may be challenged and removed. (August 2015) (Learn how and when to remove this message)

Since Windows Vista,^[14] Windows can boot from a WIM disk image file, for which the file format is published;^[15] it is similar to the ZIP format except that it supports hard links, deduplicated chunks, and uses chunk-by-chunk compression. In this case, the whole WIM is initially loaded into RAM, followed by the kernel initialisation. Next, the loaded WIM is available as a SystemRoot with an assigned drive letter. The Windows installer uses this so it boots from BOOT.WIM, and then uses INSTALL.WIM as the collection of the Windows files to be installed.

Also, Windows Preinstallation Environment (Windows PE) uses the same, being a base for separate-boot versions of some antivirus and backup/disaster recovery software.

It is also possible to install Windows so that it will always boot from a WIM or VHD file placed on a physical drive. However, this is rarely used since the Windows boot loader is capable of loading the .sys files for boot-time kernel modules itself, which is the task that requires initrd in Linux.

• dracut
• booster initramfs generator
• Linux startup process
• List of Linux distributions that run from RAM
• EFISTUB booting allows EFI firmware to load a Linux kernel (Arch Linux Wiki)

• Debian initramfs-tools
• Detailed comparison of initrd-generating toolkits
• Kernel documentation on early userspace support
• "Motivation for switch from initrd to initramfs". Archived from the original on 4 January 2013. Alt URL