Pressing the power button on a Linux machine triggers a complex chain reaction. A series of specialized software components hand control from one to the next, slowly building up the environment until your login prompt appears.

Understanding this process is vital for troubleshooting unbootable systems. Here is the modern Linux boot process, step-by-step.

Phase 1: UEFI and Secure Boot

When power is applied, the motherboard executes the UEFI (Unified Extensible Firmware Interface) firmware, which has largely replaced the legacy BIOS.

1. Hardware Initialization: The UEFI performs a Power-On Self-Test (POST) to check CPU, memory, and hardware components.
2. Finding the Bootloader: Unlike legacy BIOS which looked at the first sector of a disk (MBR), UEFI looks for a specific fat32-formatted partition known as the EFI System Partition (ESP).
3. Secure Boot: If Secure Boot is enabled, the UEFI verifies the cryptographic signature of the bootloader. If the signature is invalid or missing, the boot process halts to prevent malware from hijacking the system.

Phase 2: The Bootloader (GRUB2)

The UEFI executes the bootloader found in the ESP. The standard bootloader for most Linux distributions is GRUB2 (GRand Unified Bootloader).

1. Menu Display: GRUB loads its configuration (/boot/grub/grub.cfg) and presents a menu allowing you to choose an operating system or a specific kernel version.
2. Loading the Kernel: Once a selection is made, GRUB loads the compressed Linux kernel image (vmlinuz) from the /boot partition into memory.
3. Loading Initramfs: GRUB also loads the Initial RAM Filesystem (initramfs or initrd) into memory.
4. GRUB then passes execution control to the Linux kernel.

Phase 3: The Linux Kernel and Initramfs

Now the Linux Kernel is running. It initializes memory management, sets up CPU scheduling, and probes for basic hardware.

However, there is a catch: The kernel needs to mount the root filesystem (/) to load the rest of the OS. But what if the root filesystem is on an encrypted disk (LUKS), a software RAID array, or an LVM volume? The kernel doesn’t have those complex drivers built-in.

This is where the Initramfs comes in.

1. The kernel extracts the initramfs archive into a temporary RAM disk.
2. The initramfs contains a miniature, bare-bones Linux environment. It contains the exact kernel modules and scripts needed to unlock encrypted drives, assemble RAID arrays, and map LVM volumes.
3. Once the storage is prepped, the initramfs mounts the real root filesystem onto a directory.
4. The kernel performs a pivot_root or switch_root, swapping the temporary RAM disk for the real root filesystem.

Phase 4: systemd (The Init Process)

With the real root filesystem mounted, the kernel executes the very first process: /sbin/init. On almost all modern Linux distributions, this is a symlink to systemd.

systemd takes over as Process ID 1 (PID 1).

1. Target Evaluation: systemd reads its default target (usually graphical.target for desktops or multi-user.target for servers).
2. Parallel Startup: systemd analyzes the dependency tree of services and begins starting them in parallel. It mounts /etc/fstab entries, starts the network manager, configures firewalls, starts SSH, and eventually launches the display manager (like GDM or SDDM) or the TTY login prompt.

Summary

1. UEFI initializes hardware and runs GRUB.
2. GRUB loads the Kernel and Initramfs.
3. Kernel executes Initramfs to unlock complex storage and mount the root disk.
4. systemd brings up the network, services, and UI.

Knowing exactly where the system hangs allows you to apply the right fix—whether that’s reinstalling GRUB via a Live CD, rebuilding the initramfs (update-initramfs), or checking journalctl for failing systemd services.