systemd systemd-sysinstall 8 systemd-sysinstall systemd-sysinstall.service Simple OS installer systemd-sysinstall OPTIONS BLOCKDEVICE systemd-sysinstall.service systemd-sysinstall is a simple terminal and command line based operating system installer tool. Its primary use-case is to act as an automatically started interactive interface when booting from an installer medium (e.g. a USB stick), in order to install an OS onto a target disk. However, it may also be invoked directly from a shell. It executes the following steps: It prompts the user for the target disk to install the OS on. (Unless the block device is already specified on the command line, or is picked automatically via --device-auto.) It validates whether the disk is suitable (i.e. large enough, and with enough free/unpartitioned space) for an OS installation. If it is generally suitable the user is prompted if they want to erase the disk before installation, or if the OS shall be added to the existing partitions on the disk (the latter only if enough free/unpartitioned disk space is available). It prompts the user whether to register the newly installed OS with the firmware boot option menu. It requests confirmation from the user, after showing a summary of the planned OS installation. It invokes systemd-creds1's encrypt command in order to generate encrypted (TPM locked, if available) system credential files for a few, very basic system settings of the currently booted system (locale, keymap, timezone), which it will install on the target disk, parameterizing the invoked kernel. (Or in other words, it prepares that some settings already in effect on the installer system are propagated securely onto the new installation.) It invokes systemd-repart8 with a definitions directory of /usr/lib/repart.sysinstall.d/ (only if populated – if not will use the default of /usr/lib/repart.d/). This is supposed to set up the basic OS partition structure on the target disk and copies in basic OS partitions (most importantly the /usr/ hierarchy). It invokes bootctl1's link command to install an OS kernel image onto the target disk's ESP/XBOOTLDR, together with the credential files prepared earlier. It invokes bootctl1's install command to install the systemd-boot7 boot loader onto the target disk's ESP. After confirmation, it reboots the system. Note that the prompts/confirmation may be disabled via the command line, enabling fully automatic, non-interactive installation. See below. Note this tool does not interactively query the user for a user to create or a root password to be set on the target system, under the assumption these questions are better prompted from within the newly installed system's first boot process, for example via the systemd-firstboot1 or systemd-homed-firstboot.service components. Note that if required such settings may be propagated explicitly via the --load-credential= switch below. The following options are understood: --definitions= Overrides the directory where systemd-repart shall read its partition definitions from, in place of the default of /usr/lib/repart.sysinstall.d/. --device-auto Automatically pick the target disk instead of prompting for it or taking it from the command line. The tool watches the block devices of the system (via udev) and waits for the list of candidate disks to settle: the timeout configured with --device-auto-timeout= starts at invocation and is restarted whenever a block device appears, disappears or changes. Once it expires without further changes, the single candidate disk present at that moment is selected as installation target. If no candidate disk is present when the timeout expires, or if at any time more than one candidate disk is present, the installation fails. Candidate disks are those systemd-repart8 would offer in the interactive prompt (i.e. that support partition scanning, are writable, not the disk the running system is booted from, and contain a medium). If the disk the running system is booted from cannot be determined – and hence cannot reliably be excluded from the candidate set – the automatic selection is refused. Cannot be combined with an explicitly specified block device. This is primarily useful together with --confirm=no, --erase= and --variables=, for fully unattended installations. --device-auto-timeout= Configures the settle timeout for --device-auto, i.e. for how long the list of candidate disks must remain unchanged before a disk is selected. Takes a time span, see systemd.time7. Defaults to 30s. --welcome= Takes a boolean argument. Controls whether to show the brief welcome text normally displayed at the beginning of the installation. Defaults to true. --chrome= Takes a boolean argument. Controls whether to show the colored bars at the top and bottom of the terminal interface. Defaults to true. --erase= Takes a boolean argument. Controls whether to erase the current contents of the target disk. If this switch is not used the user is prompted. --confirm= Takes a boolean argument. Controls whether to interactively query the user for confirmation before initiating the OS installation. Defaults to true. --reboot= Takes a boolean argument. Controls whether to reboot the system after completing the installation. Defaults to false. --variables= Takes a boolean argument. Controls whether to register the installed boot loader in the firmware's boot options database. If not specified the user will be prompted. --summary= Takes a boolean argument. Controls whether to show a summary of the choices made before asking for confirmation to proceed with the OS installation. Defaults to true. --kernel= Takes a path to a unified kernel image (UKI). Explicitly selects the kernel image to install on the target disk. If unspecified the currently booted kernel image is installed on the target disk. --set-credential=id:value Accepts an additional system credential to encrypt (with a key generated on the local TPM, if available, and the null key otherwise) and place next to the installed kernel image in the ESP. This may be used to parameterize the installed kernel with arbitrary system credentials. Do not use this switch for sensitive data (such as passwords), use --load-credential= instead, see below. May be used multiple times to configure multiple credentials. Note that three system credentials are propagated in similar fashion to the target system: the locale, keymap and timezone. This may be controlled by the relevant --copy-locale=, --copy-keymap= and --copy-timezone= options below. See systemd.system-credentials7 for a list of well-known system credentials that may be propagated this way. (Note that you may pass arbitrary additional credentials this way, that can be consumed by any service of your choice, via the usual system credentials logic.) --load-credential=id:path Similar to --set-credential= but reads the credential value from a file on disk or an AF_UNIX socket in the file system. This is generally preferable for sensitive data, such as passwords. --copy-locale= --copy-keymap= --copy-timezone= These options take boolean parameters. They control whether the indicated system settings shall be propagated from the currently running system into the new target OS installation. These options default to true. Typically, these three settings are the minimal settings that need to be configured during early boot of an installer medium in order to make the installer tool accessible to the user. The systemd-firstboot1 tool may be used to query the user interactively when the OS install medium is booted for these properties. By propagating these settings to the target installation via system credentials they do not need to be queried again on first boot of the new installation. --mute-console= Takes a boolean argument. Controls whether to disable kernel and service manager log output to the console the installer is invoked on temporarily while running, in order to avoid interleaved output. Defaults to false. On success, 0 is returned, and a non-zero failure code otherwise. systemd-sysinstall \ /dev/disk/by-id/nvme-Micron_MTFDKBA1T0TFH_214532D0CDA5 \ --erase=yes \ --confirm=no \ --variables=yes \ --load-credential=ssh.authorized_keys.root:my-ssh-key This installs the OS on the selected disk, erasing any previous contents, without confirmation, registers it in the firmware, and drops in the SSH key for the root user, read from the my-ssh-key file in the current directory. systemd1 systemd-creds1 systemd-repart8 bootctl1 systemd-firstboot1 systemd-boot7 systemd.system-credentials7