BOOTC-BOOTLOADERS(7)

💖 BOOTC-BOOTLOADERS 💖

okay bestie, welcome to bootc-bootloaders — this is section 7 of the Miscellaneous Information Manual, and it's literally the whole tea on how bootc handles bootloaders. pour yourself a lil something, we're going in 🫶

---

✨ NAME ✨

bootc-bootloaders — Bootloaders in bootc 🌸

---

✨ DESCRIPTION ✨

so the vibe is: bootc supports two ways to manage bootloaders. that's it, that's the tweet. two. 💅

🎀 bootupd

bootupd ⟨https://github.com/coreos/bootupd/⟩ is a project that was literally explicitly designed to abstract over and manage bootloader installation and configuration. like, that's its whole job, its main character moment. Today it primarily supports GRUB+shim. There are pending patches for it to support systemd-boot as well — so watch this space 👀

When you run bootc install, it invokes bootupctl backend install to install the bootloader to the target disk or filesystem. The specific bootloader configuration is determined by the container image and the target system's hardware. (so like, it's giving bespoke, not off-the-rack ✨)

Currently, bootc only runs bootupd during the installation process. It does not automatically run bootupctl update to update the bootloader after installation. This means that bootloader updates must be handled separately, typically by the user or an automated system update process.

ngl this is the part where you set a reminder in your phone bestie, because bootc is not gonna do it for you 😭 bootloader updates = your problem, or your friendly neighborhood automated system update process's problem.

🦋 systemd-boot

NOTE: systemd-boot is only supported for Composefs Backend and not for Ostree ⚠️

If bootupd is not present in the input container image, then systemd-boot will be used by default (except on s390x). slay, defaults 💅

👑 s390x

bootc uses zipl. that's it. that's the entire section. iconic, honestly.

💀 none

It is possible to skip bootloader installation entirely by using --bootloader=none (or bootloader = "none" in the [install] section of the config file). zero bootloader, zero notes, we're just rawdogging the boot process (respectfully).

With this option, users can have explicit control over how the boot loading is handled, without bootc or bootupd intervention. you're the main character now, you drive 🚗

NOTE: none is only supported for the Ostree backend and not for Composefs. It is also not supported for the s390x architecture. If used with --generic-image, it will lead to a generic image that does not have support for any bootloader. so like... know what you're signing up for, fr fr 🙈

🌈 composefs backend

Whenever the container image has a UKI, bootc automatically selects the composefs backend during installation. The prerequisites for sealed images (see bootc-sealed-images(7)) describe the currently-supported UKI + systemd-boot configuration.

Note that having a UKI does not by itself make an install sealed — that also depends on whether fs-verity enforcement (see bootc-composefs(7)) is on. two separate checkboxes bestie, don't conflate them 💖

Composefs installs using a traditional vmlinuz/initramfs.img layout instead of a UKI can enforce fs-verity, but are never sealed, since nothing authenticates the root digest. They can use either bootupd (GRUB) or systemd-boot.

Under the hood, bootc writes standard BLS boot entries for both UKI and traditional kernels; see the composefs boot module documentation ⟨https://github.com/bootc-dev/bootc/blob/main/crates/lib/src/bootc_composefs/boot.rs⟩ for details on how entry filenames and sort-keys are chosen to sort correctly on both GRUB and systemd-boot. (the filename sort-key lore is real and it lives at that link 🧚)

---

⭐ SEE ALSO ⭐

• bootc(8)
• bootc-composefs(7)
• bootc-docs(7)
• bootc-sealed-images(7)

---

🌸 VERSION 🌸

v1.17.1

---

okay that's the whole page bestie, go forth and boot responsibly 🎀✨💜

BOOTC-BOOTLOADERS(7) — from the Miscellaneous Information Manual, version v1.17.1. mwah, bye 🫶💖