The Linux Boot Process, Explained

Introduction¶

When a server won't boot, knowing the stages tells you which recovery tool to reach for — a GRUB edit, an initramfs shell, rd.break, or systemd.unit=rescue.target. This is the sequence on a modern systemd distro.

The stages¶

1. Firmware (UEFI or BIOS)¶

Power-on self-test, then the firmware looks for a bootloader. On UEFI it reads the EFI System Partition (a FAT filesystem mounted at /boot/efi) and runs an .efi binary listed in NVRAM boot entries. On legacy BIOS it runs the 512-byte MBR.

efibootmgr -v            # UEFI boot entries and order

2. Bootloader (GRUB2)¶

GRUB shows the menu (or skips it), then loads the selected kernel and its initramfs into memory and jumps to the kernel, passing a command line.

• Config: /boot/grub2/grub.cfg (generated — don't edit directly).
• Edit /etc/default/grub then grub2-mkconfig -o /boot/grub2/grub.cfg.
• At the menu, press e to edit one boot's parameters for a one-off recovery.

3. Kernel + initramfs¶

The kernel initialises hardware and mounts the initramfs as a temporary root. The initramfs is a small compressed archive containing just enough drivers and tools (dracut builds it) to find and mount the real root filesystem — which might be on LVM, RAID, LUKS, iSCSI, or NFS, none of which the kernel handles alone.

lsinitrd /boot/initramfs-$(uname -r).img | less
dracut -f                # rebuild after adding a driver or changing storage

4. Pivot to the real root¶

The initramfs mounts the real root (from the root= kernel parameter), then switch_root replaces itself with the real /sbin/init — which is systemd.

5. systemd¶

systemd reads /etc/systemd/system/default.target (a symlink, usually to multi-user.target or graphical.target) and starts everything that target pulls in, in dependency order, as parallel as possible.

systemctl get-default
systemd-analyze                 # total boot time, split by phase
systemd-analyze blame           # slowest units
systemd-analyze critical-chain  # the actual bottleneck path

Recovery entry points¶

Add one of these to the kernel line in GRUB (e at the menu):

From rd.break to reset a forgotten root password on RHEL:

mount -o remount,rw /sysroot
chroot /sysroot
passwd root
touch /.autorelabel       # SELinux
exit; exit

Verification and troubleshooting¶

• GRUB rescue prompt (grub rescue>) — GRUB can't find its modules, usually because /boot moved or the disk order changed. ls to find the partition, set prefix=(hdX,Y)/grub2, insmod normal, normal.
• "Cannot open access to console, the root account is locked" — emergency mode with a locked root. Boot with rd.break instead.
• Hangs at "A start job is running for ..." — a unit is waiting on something (a network mount, a device that never appears). Look at journalctl -b after it eventually times out; add nofail to the offending /etc/fstab entry.
• Boots to initramfs shell (dracut:/#) — the real root wasn't found. root= is wrong, or the initramfs lacks a driver (new storage controller, changed RAID). cat /proc/cmdline, ls /dev/mapper, then dracut -f from a rescue environment.
• Slow boot — systemd-analyze critical-chain. Common culprits: NetworkManager-wait-online, a DNS timeout, a slow disk mount.
• Kernel panic "not syncing: VFS: Unable to mount root fs" — same as the initramfs case but the initramfs itself is missing/corrupt. Boot the previous kernel from the GRUB menu.

Related tools and reading¶

• On-site: Crontab Generator, Linux commands reference.
• Related posts: How systemd unit files work, journalctl recipes.