Part II · Your system
20.3 GRUB vs systemd-boot vs UKI
alsogrubgrub2systemd-bootbootctlukiunified kernel imageboot loader
TL;DR
- GRUB is the classic bootloader: menus, many filesystems, BIOS and UEFI.
Its configuration is generated (
grub.cfg). - systemd-boot is a small UEFI-only menu that reads simple entry files from
the EFI partition;
bootctlmanages it. - A UKI (unified kernel image) bundles kernel, initramfs and command line
into one
.efifile, which UEFI or systemd-boot starts directly.
bootctl status
efibootmgr -v
ls /boot/efi/EFI
On your machine
$ atfq 20.3 Firmware UEFI · Secure Boot on Kernel 6.12.48-amd64 Cmdline BOOT_IMAGE=/vmlinuz-6.12.48-amd64 root=UUID=3f1c2a9e-8b7d-4e21-9c55-0a6b2d7e9f10 ro rootflags=subvol=@ quiet splash Init systemd · default target graphical.target Loader systemd-boot 256.4 · 1 unified kernel image(s) Up 3 days, 4 h
An example: Alice's laptop, one of the test machines. In your terminal, this block shows your own machine, read live.
Pitfalls
- Never edit
grub.cfgby hand: it is regenerated (see 20.2). - systemd-boot needs the kernels on a partition UEFI can read, usually the EFI partition: it must be big enough for several kernels.
- With a UKI, the command line is part of the signed image: changing it means building the image again.
- In dual boot, a Windows update may change the boot order: fix it in the
firmware menu or with
sudo efibootmgr -o.
Deep dive 2 questions
Why UKIs?
With Secure Boot, the kernel is signed, but the initramfs and the command
line next to it are not, so they could be changed. A UKI puts all three in
one signed file, and the whole path from firmware to root is checked.
Tools such as ukify, dracut and mkinitcpio can build them.
Which one do I have?
bootctl status reports the loader that started the system, when it tells
systemd. The firmware's entries, listed by efibootmgr -v, show the file
it starts: shimx64.efi or grubx64.efi for GRUB, systemd-bootx64.efi
for systemd-boot.