Skip to content

Expert · Boot, recovery and containers · topic 39 of 57 · 30 min

The boot process, step by step

Explanation

Booting is a relay race: the firmware (BIOS or UEFI) finds the boot loader, GRUB2 loads the kernel and the initramfs, the kernel starts with the initramfs as a temporary root to find the real disk, and then systemd (PID 1) starts everything up to the default target. Knowing the order tells you where to look when a boot fails.

Why learn the boot order?

When a server does not come up, the first question is "how far did it get?" Each stage hands over to the next, and each has its own typical failures and fixes. If you know the stages, you can look at the screen and say "GRUB is fine, the kernel started, but systemd is stuck mounting /data", which is half of the fix.

Think of it like this: Booting is like opening a shop in the morning. The watchman (firmware) unlocks the gate and calls the manager (GRUB). The manager picks today's cashier (the kernel) and gives them a small starter kit (the initramfs) with the keys to the main store room. Once the store room (the real root disk) is open, the supervisor (systemd) opens every counter in the right order until the shop is ready (the default target).

The stages

  1. Firmware: BIOS (older) or UEFI (modern) tests the hardware and finds a boot device. UEFI reads boot entries from NVRAM and runs a program from the EFI system partition (/boot/efi).
  2. Boot loader: GRUB2 shows the menu, reads its config, and loads the chosen kernel and its initramfs into memory, passing kernel arguments (the command line).
  3. Kernel: starts, detects hardware, and unpacks the initramfs into memory as a temporary root file system.
  4. initramfs: a small image built by dracut that contains just enough drivers and tools (storage, LVM, RAID, encryption) to find and mount the real root file system on /sysroot. Then it switches root to it.
  5. systemd: PID 1 on the real root. It reads /etc/fstab and unit files and starts units in parallel until default.target (multi-user or graphical) is reached. Then you see a login prompt.
bash
$ ls /boot
config-5.14.0-427.13.1.el9_4.x86_64       loader
efi                                       symvers-5.14.0-427.13.1.el9_4.x86_64.gz
grub2                                     System.map-5.14.0-427.13.1.el9_4.x86_64
initramfs-5.14.0-427.13.1.el9_4.x86_64.img vmlinuz-5.14.0-427.13.1.el9_4.x86_64
$ cat /proc/cmdline
BOOT_IMAGE=(hd0,gpt2)/vmlinuz-5.14.0-427.13.1.el9_4.x86_64 root=/dev/mapper/rhel-root ro crashkernel=1G-4G:192M,4G-64G:256M,64G-:512M rd.lvm.lv=rhel/root rd.lvm.lv=rhel/swap rhgb quiet
/proc/cmdline shows the kernel arguments of the running boot.

How long did each step take?

bash
$ systemd-analyze
Startup finished in 1.912s (kernel) + 2.410s (initrd) + 9.884s (userspace) = 14.207s
multi-user.target reached after 9.861s in userspace.
$ systemd-analyze blame | head -3
5.102s NetworkManager-wait-online.service
1.344s kdump.service
  611ms dnf-makecache.service
$ journalctl -b -p warning --no-pager | head     # warnings from this boot

Where boots fail, and what it looks like

StageSymptomTypical cause
FirmwareNo boot device foundWrong boot order, failed disk
GRUBgrub> or grub rescue> promptDamaged GRUB files or config
Kernel / initramfsKernel panic, or a dracut emergency shellMissing driver in initramfs, wrong root= argument
systemdEmergency mode, "Give root password for maintenance"Bad /etc/fstab line, missing disk
LoginBoots fine but you cannot log inLost root password (next lessons)

If the initramfs is broken, for example after a driver change, you can rebuild it for the running kernel with dracut -f, or boot an older kernel from the GRUB menu first.

Common mistakes

  • Deleting "old" kernels from /boot by hand to free space. Use dnf remove kernel-core-<version> instead, so GRUB entries stay consistent.
  • Ignoring the "rhgb quiet" arguments when debugging: remove them for one boot (press e in GRUB) to see all messages on screen.
  • Assuming a slow boot is hardware. systemd-analyze blame usually shows one service, often a network wait, that holds everything up.

Need help?

Stuck on a word or an idea? Search this course, or every course, and jump straight to the explanation or a worked question.

Try:

Watch the lesson

The boot process, step by step · 1/6

firmware → GRUB2 → kernel → initramfs → systemd

Booting is a relay race with five runners.

Prefer a video by a teacher? Find free videos on “linux boot process explained bios uefi grub2 initramfs systemd” on YouTube ↗

In real life: A slow-booting bank branch server

A bank branch server in Patna took four minutes to boot after every power cut, delaying counter opening. systemd-analyze blame showed NetworkManager-wait-online taking almost the whole time, because a second, unplugged network card was set to wait for DHCP. The admin set that connection to not autoconnect, and boot time fell to 25 seconds.

bash
$ systemd-analyze blame | head -2
3min 2.412s NetworkManager-wait-online.service
     1.388s kdump.service
# nmcli con mod "Wired connection 2" connection.autoconnect no

Practice (0/3 done)

Task 1 · Question

Which component loads the kernel and the initramfs into memory?

Task 2 · Question

The boot stops with "Give root password for maintenance" after a "Dependency failed for /data" message. Which stage failed?

Task 3 · Code · Python

Write slowest(blame_text, n) for "systemd-analyze blame" output. Each line is a time and a unit, like "5.102s NetworkManager-wait-online.service", "611ms dnf-makecache.service" or "3min 2.412s foo.service". Convert each time to seconds (min = 60 s, s, ms = 0.001 s) and return the names of the n slowest units, slowest first.

Quick quiz

Question 1

1.What is the job of the initramfs?

Question 2

2.Which tool builds the initramfs on RHEL?

Question 3

3.Which file shows the kernel arguments of the current boot?

Question 4

4.Which command lists services by how long they took to start?

Read more (free)

Open a question to see the answer and why. The first ones are this topic's own quiz, so try the quiz above before you peek.

What is the job of the initramfs?

Answer: Provide drivers and tools to find and mount the real root file system

It is a temporary root used early in boot.

Which tool builds the initramfs on RHEL?

Answer: dracut

dracut builds initramfs images.

Which file shows the kernel arguments of the current boot?

Answer: /proc/cmdline

/proc/cmdline.

Which command lists services by how long they took to start?

Answer: systemd-analyze blame

blame sorts units by start-up time.

Which command shows the kernel that boots by default?Related

Answer: grubby --default-kernel

uname -r shows the running kernel, which may differ.

From GRUB2, kernel arguments and the default kernel

Which command shows the logs of the service orders-api and keeps following new lines?Related

Answer: journalctl -u orders-api -f

journalctl -u selects the unit and -f follows new entries.

From Processes, signals and systemd services

Which target is the usual default on a RHEL server?Related

Answer: multi-user.target

Servers normally boot to multi-user.target.

From Targets: the boot goal of the system

Which kernel argument replaces systemd with a bash shell for one boot?Related

Answer: init=/bin/bash

init= sets the first program the kernel runs.

From Recovering a lost root password

Pass the quiz (60% or more) or mark this topic as done when you are ready.

Your progress is saved on this device only.

Next: GRUB2, kernel arguments and the default kernel →

Next steps

  1. 4 more topics in “Boot, recovery and containers” before its exam: GRUB2, kernel arguments and the default kernel, Recovering a lost root password, Containers with Podman: images, run, ports and logs, Persistent storage and containers as systemd services.
  2. Module 8 exam: Boot, recovery and containers · 13 questions · 25 min, without help. 5 topics of this module still to finish first.
  3. Then the next module, Ansible fundamentals. 57 topics left in the course before the final exam.

← Previous: Bash scripts: conditions, loops and safe habits