Kernel, initramfs, and the first userland

Between GRUB and PID 1, the kernel decompresses, initialises hardware, mounts a temporary root, runs the initramfs, and only then mounts the real root filesystem. Understanding this sequence is the foundation of every boot-recovery scenario.

The kernel boot sequence

sequenceDiagram
  participant GRUB as GRUB
  participant K as Kernel
  participant I as Initramfs
  participant Root as Real root
  participant PID1 as systemd

  GRUB->>K: load vmlinuz + command line
  GRUB->>I: load initramfs
  K->>K: decompress (gzip/zstd)
  K->>K: architecture-specific init (head.S)
  K->>K: main.c: start_kernel()
  K->>K: sched_init, mm_init, driver init
  K->>I: unpack initramfs to tmpfs
  K->>K: run /init (PID 1 of initramfs)
  I->>I: load modules, udev, mount rootfs
  I->>Root: switch_root to /dev/sda2 (or whatever)
  I->>PID1: exec /sbin/systemd
  Note over PID1: systemd is now PID 1

The kernel’s responsibilities at boot:

• Decompress itself (vmlinuz is a compressed image).
• Initialise the architecture (CPU, MMU, interrupts).
• Initialise core subsystems (scheduler, memory management, VFS).
• Initialise device drivers compiled into the kernel (not modules).
• Mount the initramfs as / (a tmpfs).
• Run /init (PID 1 of the initramfs).

The initramfs responsibilities:

• Load kernel modules for storage, network, and other devices not built into the kernel.
• Bring up complex storage (LVM, mdadm RAID, LUKS encryption, NFS root, iSCSI).
• Wait for devices to appear.
• Mount the real root filesystem.
• switch_root to the real root and exec /sbin/systemd.

$ uname -a; ls -lh /boot/vmlinuz-* /boot/initrd.img-* 2>/dev/null | head

Linux host 6.6.31-linuxkit ... x86_64
-rw------- 1 root root  14M Aug  9 11:11 /boot/vmlinuz-6.6.31-linuxkit
-rw------- 1 root root  85M Aug  9 11:11 /boot/initrd.img-6.6.31-linuxkit

Inspecting the initramfs

$ lsinitrd /boot/initrd.img-6.6.31-linuxkit | head -20

Image: /boot/initrd.img-6.6.31-linuxkit: 85M
==========================================================================
Early CPIO image
==========================================================================
drwxr-xr-x  3 root root  0 Aug  9 11:11 .
-rw-r--r--  1 root root  2 Aug  9 11:11 early_cpio
...
==========================================================================
Version: dracut-modules 102
dracut modules:
bash
btrfs
...
==========================================================================
drwxr-xr-x  2 root root  0 Aug  9 11:11 bin
...

$ lsinitrd /boot/initrd.img-6.6.31-linuxkit | grep -E 'ext4|xfs|lvm|crypt|nvme|ahci' | head

...

“Cannot mount root filesystem”

The classic boot failure. The kernel boots, the initramfs runs, and switch_root fails because the root filesystem cannot be mounted. Common causes:

$ dmesg | grep -E 'VFS|Cannot|filesystem|root device'

...

Custom initramfs for complex storage

For storage that the kernel’s built-in modules cannot handle (LVM on LUKS on RAID, iSCSI with multipath), the initramfs must be custom-built to include the right tools:

$ dracut -f --add-drivers 'dm_mod dm_mirror dm_raid' /boot/initramfs-custom.img

Recovery with dracut

$ dracut -f

...

Knowledge check