BOOTC-INSTALL-TO-DISK(8)

💾 bootc-install-to-disk — install to the target block device 💅

okay bestie, this is bootc-install-to-disk(8) from the System Manager's Manual, and it does EXACTLY what it says on the tin: it installs to the target block device. 🎀

---

✨ SYNOPSIS ✨

bootc install to-disk [OPTIONS...] <DEVICE>

---

🌸 DESCRIPTION 🌸

Install to the target block device. That's the whole vibe. 💖

Now, the important part, no cap: this command must be invoked inside of the container which will be installed. Yes, literally inside it. And that container must be run in --privileged mode, which means it will be able to see all block devices on the system. 👀 (that's the point, but also, that's a lot of power, so like… be aware.)

The default storage layout uses the root filesystem type configured in the container image, alongside any required system partitions such as the EFI system partition. If you want anything more complex — RAID, LVM, LUKS etc. — you use install to-filesystem instead. This one is the simple queen. 👑

🧩 Partitioning details

The default as of bootc 1.11 uses the Discoverable Partitions Specification ⟨https://uapi-group.org/specifications/specs/discoverable_partitions_specification/⟩ (DPS) for the generated root filesystem, as well as any required system partitions such as the EFI system partition. she's discoverable, she's spec'd, she's iconic. ✨

🌈 Partition layout

The installer creates a GPT partition table with architecture-appropriate partitions. The exact layout varies by architecture but generally includes:

• Boot partition (architecture-specific): BIOS boot for x86_64, PReP for ppc64le, etc.
• ESP: EFI System Partition on UEFI architectures (x86_64, aarch64), at least 512 MiB
• Boot: Separate /boot partition, only created when using LUKS encryption
• Root: The root filesystem, using the remaining disk space

The root partition uses an architecture-specific DPS type GUID. Specific partition sizes and type GUIDs are implementation details that may change between versions — so please don't hardcode your whole personality around them. 😭 Use install to-filesystem if you need precise control over the partition layout. periodt.

🔍 Root filesystem discovery

The root partition can be discovered at boot time in two ways:

• UUID mode (default): A kernel argument root=UUID=<uuid> is injected, providing broad compatibility with all initramfs implementations and bootloaders. Lowkey the "works everywhere" option. 💅
• DPS auto-discovery: The root= kernel argument is omitted entirely. systemd-gpt-auto-generator in the initramfs discovers the root partition by its DPS type GUID. This enables transparent block-layer changes (such as adding LUKS encryption) without updating kernel arguments. DPS auto-discovery requires the bootloader to implement the Boot Loader Interface (BLI). systemd-boot always supports this; GRUB supports it only with newer builds that include the bli module. So petty of GRUB honestly. 🙈

When using systemd-boot, DPS auto-discovery is enabled by default. For GRUB, container base images that ship a BLI-capable build should set discoverable-partitions = true in their install configuration (see bootc-install-config(5)). 🫶

---

💅 OPTIONS 💅

• DEVICE — Target block device for installation. The entire device will be wiped. ⚠️ THE ENTIRE DEVICE. GONE. This argument is required.
• --wipe — Automatically wipe all existing data on device. like, all of it. 🧹
• --block-setup=BLOCK_SETUP — Target root block device setup.

Possible values:

• direct
• tpm2-luks

• --filesystem=FILESYSTEM — Target root filesystem type.

Possible values:

• xfs
• ext4
• btrfs

• --root-size=ROOT_SIZE — Size of the root partition (default specifier: M). Allowed specifiers: M (mebibytes), G (gibibytes), T (tebibytes).
• --source-imgref=SOURCE_IMGREF — Install the system from an explicitly given source.
• --target-transport=TARGET_TRANSPORT — The transport; e.g. oci, oci-archive, containers-storage. Defaults to registry.

Default: registry

• --target-imgref=TARGET_IMGREF — Specify the image to fetch for subsequent updates.
• --enforce-container-sigpolicy — This is the inverse of the previous --target-no-signature-verification (which is now a no-op). Enabling this option enforces that containers-policy.json (see man containers-policy.json for the full search path) includes a default policy which requires signatures. 🔐 security girl summer.
• --run-fetch-check — Verify the image can be fetched from the bootc image. Updates may fail when the installation host is authenticated with the registry but the pull secret is not in the bootc image.
• --skip-fetch-check — Verify the image can be fetched from the bootc image. Updates may fail when the installation host is authenticated with the registry but the pull secret is not in the bootc image. (yes bestie, the description is the same as --run-fetch-check in the original — I'm not gonna invent facts for you, I just report them 💀)
• --disable-selinux — Disable SELinux in the target (installed) system.
• --karg=KARG — Add a kernel argument. This option can be provided multiple times. 🔁
• --karg-delete=KARG_DELETE — Remove a kernel argument. This option can be provided multiple times. 🔁
• --root-ssh-authorized-keys=ROOT_SSH_AUTHORIZED_KEYS — The path to an authorized_keys that will be injected into the root account. 🗝️
• --generic-image — Perform configuration changes suitable for a "generic" disk image. At the moment:
• --bound-images=BOUND_IMAGES — How should logically bound images be retrieved.

Possible values:

• stored
• skip
• pull

Default: stored

• --stateroot=STATEROOT — The stateroot name to use. Defaults to default.
• --bootupd-skip-boot-uuid — Don't pass --write-uuid to bootupd during bootloader installation.
• --bootloader=BOOTLOADER — The bootloader to use.

Possible values:

• grub
• grub-cc
• systemd
• none

• --via-loopback — Instead of targeting a block device, write to a file via loopback. 🔄
• --composefs-backend — Use the composefs backend instead of ostree. This is the default for images with a UKI, and for images with /usr/lib/composefs/setup-root-conf.toml and no ostree prepare-root.conf.

Default: false

• --allow-missing-verity — Make fs-verity validation optional in case the filesystem doesn't support it (composefs backend only).

Default: false

• --uki-addon=UKI_ADDON — Name of the UKI addons to install without the .efi.addon suffix. This option can be provided multiple times if multiple addons are to be installed (composefs backend only). ✨
• --run-repart — Whether to use systemd-repart for partitioning. This requires the image to have repart.d definitions.

---

🦋 EXAMPLES 🦋

Install to a disk, wiping all existing data:

bootc install to-disk --wipe /dev/sda

Install with a specific root filesystem type:

bootc install to-disk --filesystem xfs /dev/nvme0n1

Install with TPM2 LUKS encryption:

bootc install to-disk --block-setup tpm2-luks /dev/sda

Install with custom kernel arguments:

bootc install to-disk --karg=nosmt --karg=console=ttyS0 /dev/sda

---

👀 SEE ALSO 👀

bootc(8), bootc-install(8), bootc-install-to-filesystem(8)

go read the friends, they're all slaying in their own way 🫶

---

⭐ VERSION ⭐

v1.17.1 💖

okay that's the whole page bestie, mwah, go install something responsibly, don't wipe a disk you love, and remember: this was BOOTC-INSTALL-TO-DISK(8) from the System Manager's Manual, version v1.17.1 🎀💅✨