Linux boot process.

01Power on — firmware wakes up

You press the button. The CPU starts running tiny instructions that ship inside the motherboard itself — the firmware. On modern systems this firmware is called UEFI; on older ones it's called BIOS. Either way, its first job is to check that the hardware actually works. Runs POST (Power-On Self-Test): the firmware inventories RAM, CPU, storage, and GPU to make sure they respond. If POST fails you get beep codes or a dead screen — boot stops here. After POST succeeds, the firmware looks at the configured boot order (set in firmware setup) and finds a bootable device.

firmware lives in

— motherboard ROM

boot order config

— UEFI / BIOS setup menu

02UEFI / BIOS — find the bootloader

The firmware finds a small program on disk that knows how to load an operating system — called a 'bootloader'. UEFI looks inside a dedicated partition for a .efi file. Legacy BIOS reads the first 512 bytes of the boot disk (called the MBR — Master Boot Record). UEFI mounts the EFI System Partition (ESP) — a small FAT32 partition usually mounted at /boot/efi — and runs an .efi binary from inside it. Legacy BIOS jumps into the Master Boot Record's stage-1 loader (just 512 bytes — barely enough code to find the rest). UEFI remembers boot entries in non-volatile RAM (NVRAM) on the motherboard — manage them with the efibootmgr command. If Secure Boot is enabled, the firmware also checks that the bootloader is cryptographically signed before running it.

ESP mount

— /boot/efi/

vendor dir

— /boot/efi/EFI/redhat/

main binary

— /boot/efi/EFI/redhat/grubx64.efi

• $ efibootmgr -v — list UEFI boot entries
• $ efibootmgr -o 0,1,2 — set boot order

03GRUB 2 — boot menu and kernel loader

GRUB (GRand Unified Bootloader) version 2 is the standard Linux bootloader. It shows the boot menu where you pick which kernel to start, then loads two big files into memory: the kernel itself, and a small helper filesystem called an 'initramfs' (covered in the next stage). Reads /boot/grub2/grub.cfg — DON'T edit this directly; it's regenerated. Sources of truth: /etc/default/grub (kernel cmdline, timeouts) and /etc/grub.d/* (entry templates). Rebuild grub.cfg with: grub2-mkconfig -o /boot/grub2/grub.cfg (or grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg on UEFI). Press 'e' at the GRUB menu to edit a single boot entry on the fly — invaluable for rescue.

user config

— /etc/default/grub

templates

— /etc/grub.d/

generated cfg

— /boot/grub2/grub.cfg (BIOS)

generated cfg

— /boot/efi/EFI/redhat/grub.cfg (UEFI)

• $ grub2-mkconfig -o /boot/grub2/grub.cfg — regenerate (BIOS)
• $ grub2-set-default 0 — default to first entry
• $ grubby --info=ALL — inspect kernel entries

04Kernel — Linux takes control

GRUB hands the CPU to the Linux kernel — the core of the OS. The kernel decompresses itself in memory, initializes essential subsystems (memory management, scheduling, basic devices), and mounts the small initramfs filesystem as a temporary root so it has a place to look for drivers. Kernel image lives at /boot/vmlinuz-$(uname -r) — compressed bzImage. Reads its command line from GRUB. View what's currently running with: cat /proc/cmdline. Important params: root= (where the real root lives), ro/rw, rd.lvm.lv= (LVM volume), selinux=0 (disable), single (single-user), rd.break (drop to dracut shell). init=/bin/bash on the cmdline drops you to a root shell before init runs — classic password-reset trick.

kernel image

— /boot/vmlinuz-$(uname -r)

running cmdline

— /proc/cmdline

boot messages

— dmesg / journalctl -k

• $ uname -r — running kernel version
• $ cat /proc/cmdline — kernel parameters in effect
• $ dmesg | less — browse kernel boot log

05initramfs — tiny root in RAM

Chicken-and-egg problem: to mount the real root filesystem the kernel needs drivers, but the drivers live ON the real root filesystem. Solution: a tiny 'initial RAM filesystem' (initramfs) gets loaded into memory with just enough drivers and tools to find and mount the real root. Once that's done, the kernel switches over and the initramfs is gone. Built by dracut on Red Hat systems. Re-build with: dracut -f. Inspect contents with lsinitrd (no need to unpack). Runs udev for device discovery, loads kernel modules for storage controllers. Mounts the real root, then calls switch_root to pivot away from the initramfs root. If something fails here, you land in the dracut emergency shell.

initramfs image

— /boot/initramfs-$(uname -r).img

dracut config

— /etc/dracut.conf / /etc/dracut.conf.d/

• $ dracut -f — rebuild initramfs for current kernel
• $ lsinitrd /boot/initramfs-$(uname -r).img — list contents
• $ lsinitrd -f /etc/passwd $IMG — extract a single file

06systemd — PID 1

The kernel always launches one user-space program first — historically called /sbin/init. On modern Red Hat, RHEL, Fedora, and most distros, that program is systemd. Because it's the first process, it gets process ID 1 (PID 1) — and it's responsible for starting every other service in the right order. Reads unit files from /etc/systemd/system (admin), /run/systemd/system (runtime), and /usr/lib/systemd/system (packages). Admin wins. Computes a dependency graph (After=, Before=, Requires=, Wants=) and brings services up in topological order. Targets are groupings of units that represent a system state — like 'multi-user' or 'graphical'. The boot target is default.target — a symlink. Change it with systemctl set-default.

admin units

— /etc/systemd/system/

package units

— /usr/lib/systemd/system/

default target

— /etc/systemd/system/default.target (symlink)

• $ systemctl get-default — show current default target
• $ systemctl set-default multi-user.target — switch to text login on next boot
• $ systemd-analyze blame — what slowed down the boot
• $ systemd-analyze critical-chain — show the longest dependency path

07Default target reached — system is ready

systemd has brought up every required unit. You see a login prompt (multi-user.target = text console; graphical.target = GUI display manager). Boot is done. graphical.target requires multi-user.target requires basic.target requires sysinit.target — they nest. Switch live without rebooting: systemctl isolate multi-user.target. rescue.target = minimal single-user-ish mode (root, basic services). emergency.target = bare-bones, root shell, no services. Drop here when nothing else works.

graphical login

— GDM / gnome-session

text login

— agetty on /dev/tty1

• $ systemctl isolate rescue.target — drop to rescue without reboot
• $ systemctl reboot — reboot cleanly
• $ systemd-analyze — how long the boot took