Linux Boot Sequence and Boot Targets

1. Boot is a chain of trust, discovery, and handoffs

Linux boot is not one program starting everything else. It is a sequence of independently configured stages. Firmware initializes enough hardware to locate a bootable path. A bootloader selects a kernel and associated parameters. The kernel initializes processors, memory management, drivers, and core subsystems. An optional initramfs supplies early user space so encrypted, networked, RAID, LVM, or otherwise non-trivial root storage can be discovered. Finally, the kernel starts the init process as PID 1, commonly systemd, which assembles the normal userspace system.

flowchart TB
  A["Power-on or virtual-machine start"] --> B["Firmware: UEFI or legacy BIOS"]
  B --> C["Bootloader or unified kernel image"]
  C --> D["Linux kernel and command line"]
  D --> E["initramfs early user space"]
  E --> F["Mount and switch to real root"]
  F --> G["PID 1: systemd"]
  G --> H["Targets, mounts, sockets, services"]
  H --> I["Login, network, applications"]

2. Firmware and the bootloader choose what the kernel receives

UEFI firmware normally reads boot entries from nonvolatile variables and loads an EFI executable from the EFI System Partition. Legacy BIOS systems use older disk boot structures. GRUB, systemd-boot, and vendor boot mechanisms differ in interface, but the operational questions are similar: which kernel image was selected, which initrd or initramfs accompanied it, and which command-line arguments were passed?

# Identify firmware mode on the running system
if [ -d /sys/firmware/efi ]; then
  echo "Booted in UEFI mode"
else
  echo "UEFI runtime directory absent; legacy or restricted environment"
fi

# Inspect the kernel command line used for this boot
cat /proc/cmdline

# Inspect boot files without modifying them
find /boot -maxdepth 2 -type f -printf '%p\n' 2>/dev/null | sort | head -n 80

# systemd-boot information, when applicable
bootctl status 2>/dev/null || true

The kernel command line can select a root device, control logging, enable or disable security features, choose a systemd target, or alter driver behavior. Treat it as configuration evidence. A parameter that fixes one boot may weaken security or mask a deeper storage problem if made permanent without review.

3. The kernel and initramfs create a usable root environment

The bootloader places the kernel and usually an initramfs image in memory. The kernel decompresses, initializes built-in drivers, processes command-line arguments, and mounts the temporary root supplied by the initramfs. Early userspace loads modules and tools needed to assemble the actual root stack—for example device mapper, LUKS, LVM, MD RAID, multipath, or network storage. It then performs a switch-root operation and starts the real init process.

# Kernel release and build information
uname -a

# Current root source and filesystem
findmnt -no SOURCE,FSTYPE,OPTIONS /
lsblk -o NAME,TYPE,FSTYPE,SIZE,MOUNTPOINTS

# Common initramfs images and their timestamps
ls -lh /boot/initr* /boot/*initramfs* 2>/dev/null || true

# Distribution-specific image inspection tools, if installed
command -v lsinitramfs >/dev/null && lsinitramfs /boot/initrd.img-"$(uname -r)" | head
command -v lsinitrd >/dev/null && lsinitrd | head

A kernel may be present while its matching initramfs is missing, stale, or unable to locate the root device. This often appears as an early emergency shell, a timeout waiting for a UUID, or an inability to unlock or assemble the root stack.

4. PID 1 activates a dependency graph, not a shell script list

systemd loads unit definitions and constructs transactions from dependencies. Targets are synchronization and grouping units. They do not directly “contain” services; instead, dependency links pull services, sockets, mounts, paths, and other targets into a transaction. default.target usually points to multi-user.target for a non-graphical server or graphical.target for a desktop.

# Current default and currently active targets
systemctl get-default
systemctl list-units --type=target --state=active

# Dependency trees are read-only
systemctl list-dependencies default.target
systemctl list-dependencies --reverse multi-user.target

# Resolve the default.target symlink
readlink -f /etc/systemd/system/default.target 2>/dev/null || true

5. Separate boot duration from boot criticality

systemd-analyze reports firmware, loader, kernel, initrd, and userspace timing where the platform exposes them. blame lists activation duration for units, but a slow unit is not automatically on the critical path; services often start in parallel. critical-chain follows time-critical dependencies and is a better starting point for boot latency.

systemd-analyze time
systemd-analyze blame | head -n 30
systemd-analyze critical-chain
systemd-analyze critical-chain multi-user.target

# Failed units and high-priority messages from this boot
systemctl --failed
journalctl -b -p warning..alert --no-pager | tail -n 120

6. Hands-on lab: build a boot evidence bundle

This laboratory is read-only. It records the active boot path, timing, targets, failed units, and boot journal for later comparison.

lab="$HOME/devops-academy/linux/chapter11/lesson01"
mkdir -p "$lab"
cd "$lab"

{
  printf '=== time ===\n'
  systemd-analyze time 2>&1 || true
  printf '\n=== command line ===\n'
  cat /proc/cmdline
  printf '\n=== root ===\n'
  findmnt -no SOURCE,FSTYPE,OPTIONS /
  printf '\n=== default target ===\n'
  systemctl get-default
} > boot-summary.txt

systemd-analyze critical-chain > critical-chain.txt 2>&1 || true
systemd-analyze blame > blame.txt 2>&1 || true
systemctl --failed --no-pager > failed-units.txt 2>&1 || true
systemctl list-units --type=target --state=active --no-pager > active-targets.txt
journalctl -b --no-pager -n 500 > current-boot-journal.txt 2>&1 || true

sha256sum ./*.txt > evidence.sha256
wc -l ./*.txt

7. Common boot-analysis mistakes

8. Knowledge check

9. Summary

Linux boot is a sequence of handoffs: firmware selects a loader, the loader supplies a kernel and command line, the kernel and initramfs establish the real root, and PID 1 activates a dependency graph toward the default target. Reliable diagnosis identifies the failed stage, preserves boot evidence, and avoids treating timing output as proof without dependency context.

10. Further reading

• bootup(7) and boot(7).
• systemd(1), systemd.special(7), systemd-analyze(1), and kernel-command-line(7).
• Distribution documentation for GRUB, initramfs generation, encrypted root, and recovery boot entries.