/boot

the kernel and the boot loader

/boot holds what the machine needs before Linux is running. The boot loader reads the kernel and an initial RAM disk from here and starts them. Once the system is up, nothing here is touched again until the next kernel update.

Small, rarely looked at, and the machine cannot start without it.

Holds

The kernel

And the boot loader’s files

On disk

Often its own partition

Small, and kept simple

Who writes

Kernel updates

Through the package manager

Read

At power-on

By GRUB or another boot loader

Why it exists

Every directory at the top of the tree is there for a reason. This is the problem /boot solves.

The boot loader needs a simple place

A boot loader understands only a few filesystems. Keeping the kernel on a small, plain partition means it can be read even when the rest of the disk is encrypted or uses something more complex.

More than one kernel is kept

An update installs the new kernel beside the old one. If the new one fails to boot, the previous one can be chosen from the boot menu.

What you find inside

Not everything, but the entries worth recognising. Each is marked as a directory, a file, a link or a device.

/boot

vmlinuz-6.8.0-45-genericfileThe kernel, compressed. The version number varies.
initrd.img-6.8.0-45-genericfileA small temporary system that loads the drivers needed to reach the real disk.
config-6.8.0-45-genericfileThe options this kernel was built with.
grubdirectoryThe boot loader’s configuration and modules.
efidirectoryThe EFI system partition, on machines that boot with UEFI.

At the terminal

Four commands that show what this directory is doing on a real machine.

ls -lh /boot

List the installed kernels and their sizes.

uname -r

Show which of those kernels is running now.

df -h /boot

Check how full /boot is — a full one makes kernel updates fail.

cat /proc/cmdline

Show the options the boot loader passed to the running kernel.

Handle with care

What goes wrong here, and what someone securing or attacking the machine looks at.

A full /boot blocks updates

Old kernels pile up on a small partition. Remove them with the package manager — sudo apt autoremove on Debian and Ubuntu — never by deleting the files.

It is usually not encrypted

Even with full-disk encryption, /boot is often left readable so the machine can start. Someone with physical access could alter it, which is what Secure Boot exists to detect.

Read alongside

/libShared libraries the programs depend on, and the kernel’s modules. A link to /usr/lib./The root directory. Every other path on the system starts here./procRunning processes and kernel state, presented as files.