Linux systems may seem complex, but at their core, they consist of two fundamental components: the kernel and a root filesystem. Understanding how these elements interact during the boot process can demystify Linux and provide insight into how your system comes to life each time you power it on.

The Two Main Components of a Linux Distribution

1. The Linux Kernel

The kernel is the heart of any Linux system. It’s responsible for:

  • Managing hardware resources
  • Providing essential services to applications
  • Facilitating communication between software and hardware
  • Implementing security and process isolation

The kernel is typically stored as a file named something like vmlinuz in your /boot directory.

2. The Root Filesystem

The root filesystem (rootfs) contains all the directories, files, and programs that make up your Linux environment. This includes:

  • System binaries and libraries
  • Configuration files
  • User applications
  • User data
  • System services

The root filesystem defines the unique personality of a Linux distribution, determining whether it’s Ubuntu, Fedora, Arch, or another variant.

Kernel Configuration: The Kernel Command Line

The kernel doesn’t simply start up and run blindly. It needs parameters to know how to behave, and these are provided via the “kernel command line” - a set of parameters passed to the kernel at boot time.

Common kernel command line parameters include:

  • root=: Specifies where to find the root filesystem
  • ro or rw: Determines if the root filesystem should be mounted read-only or read-write initially
  • quiet: Reduces boot-time messages
  • splash: Enables a graphical boot splash screen
  • loglevel=: Sets the verbosity of kernel messages

These parameters can be set in your bootloader configuration (like GRUB) and drastically affect how your system boots and operates.

Here’s where things get interesting. The kernel needs to mount the root filesystem, but this presents a chicken-and-egg problem: what if the drivers needed to access the storage device containing the root filesystem aren’t built into the kernel? Or what if the root filesystem requires special preparation before mounting?

This is where the initramfs (Initial RAM Filesystem) comes in. The initramfs is:

  1. A temporary root filesystem loaded into memory during boot
  2. Packed with essential drivers and tools needed to access the real root filesystem
  3. Capable of running scripts to prepare the system before the actual rootfs is mounted

Example: Encrypted Root Filesystem

A perfect illustration of the initramfs’s importance is when using an encrypted root filesystem:

  1. The computer boots and the bootloader loads the kernel and initramfs into memory
  2. The kernel starts execution and mounts the initramfs as a temporary root filesystem
  3. The initramfs contains the encryption tools and drivers needed to access the encrypted drive
  4. A script in the initramfs prompts the user for the decryption password
  5. Once the password is provided, the initramfs unlocks the encrypted volume
  6. The initramfs can now mount the real root filesystem and tell the kernel where to find it
  7. The kernel switches from using the initramfs to using the real rootfs

Without the initramfs, the kernel would have no way to access the encrypted filesystem, as the decryption tools aren’t part of the kernel itself.

The Final Step: Executing init

Once the real root filesystem is mounted, the kernel performs one crucial task: it executes the init process. The init process is the first user-space program run on the system and is responsible for bringing up all other system services.

In most modern Linux distributions, systemd serves as the init system. The path to the init program is typically /sbin/init, which is often a symbolic link to the systemd binary.

The init process (systemd) then:

  1. Reads its configuration
  2. Brings up system services in the correct order
  3. Starts the display manager for graphical logins
  4. Manages all other system processes

At this point, the boot process is complete, and you have a fully operational Linux system.

Summary: The Boot Flow

To recap, here’s the entire process:

  1. Bootloader loads the kernel and initramfs into memory
  2. Kernel initializes and processes kernel command line parameters
  3. Kernel mounts the initramfs as a temporary root filesystem
  4. Initramfs prepares and locates the real root filesystem (potentially decrypting it)
  5. Kernel mounts the real root filesystem
  6. Kernel executes the init process from the root filesystem
  7. Init (systemd) brings up all system services and completes the boot