dracut
Donate
dracut is an initial ramdisk (also called initrd or initramfs) generator. It assembles the early userspace image used during boot.
Introduction
[edit]This page documents dracut usage, terminology, and common tasks such as checking which initrd generator is installed, installing dracut, and re-generating the initrd. It also highlights important warnings, typical pitfalls, and where to look for upstream development and bug reports.
Initial Ramdisk Based Encryption Password Prompt
[edit]Please enter passphrase for disk ... (press TAB for no echo)
Figure: initramfs (initramfs-tools or dracut) Based Encryption Password Pre-Boot Authentication Prompt - Example (cropped)
Figure: initramfs (initramfs-tools or dracut) Based Encryption Password Prompt - Example (full)
This is related to Full Disk Encryption (FDE).
Terminology
[edit]initrd
initrd is the initial ramdisk. It is a small filesystem used as part of the boot process to provide an early userspace environment, so the system can load drivers and mount the real operating system (OS) root filesystem. A common synonym is initramfs. [1] [2]
In modern Linux systems, the initramfs is typically a compressed cpio archive that the kernel unpacks into RAM and then runs /init from. Older systems used an initrd image as a RAM disk style filesystem image. [3]
exitrd
exitrd [4] is the shutdown ramdisk (also called a shutdown initramfs). It is conceptually symmetrical to initrd, but it is not a standalone kernel feature: it is implemented in user space (most commonly by systemd). During late shutdown, if /run/initramfs/shutdown exists, systemd can switch root into /run/initramfs and execute /shutdown from there, so the old root filesystem can be unmounted cleanly and complex storage stacks can be dismantled. [5] [6]
On systems using dracut, this commonly involves restoring (unpacking) an initramfs into /run/initramfs during shutdown, so it is available for the exitrd switch-root step. [7]
A synonym is initramfs-shutdown.
Find out which initrd Generator is installed
[edit]To check if dracut is already installed, run. On Debian based operating systems such as Kicksecure this can be done using the following commands.
dpkg -l | grep dracut
To check if initramfs-tools is already installed, run.
dpkg -l | grep initramfs-tools
Installation
[edit]1 Notices.
Platform specific.
- Debian: The following warning is applicable because
dracutis not installed by default in Debian. - Kicksecure: The following warning is only applicable if
dracutis not yet installed. In newer Kicksecure versions,dracutis installed by default.
To check your currently installed initrd generator, see Find out which initrd Generator is installed.
2 Warning.
Warning:
There is a risk of the system becoming unbootable due to changes in the initrd creation tool.
- General risk: The system may become unbootable when changing the initrd creation tool.
- Backups: Always maintain backups and proceed with caution when making changes.
- Dracut bug reports: If issues with
dracutoccur, do not report them here, as they are unrelated to Kicksecure.
3 Create folder /etc/dracut.conf.d.
sudo mkdir --parents /etc/dracut.conf.d
4 Create a new configuration file. [8]
Open file /etc/dracut.conf.d/60_user.conf in an editor with administrative ("root") rights.
1 Select your platform.
2 Notes.
- Sudoedit guidance: See Open File with Root Rights for details on why using
sudoeditimproves security and how to use it. - Editor requirement: Close Featherpad (or the chosen text editor) before running the
sudoeditcommand.
3 Open the file with root rights.
sudoedit /etc/dracut.conf.d/60_user.conf
2 Notes.
- Sudoedit guidance: See Open File with Root Rights for details on why using
sudoeditimproves security and how to use it. - Editor requirement: Close Featherpad (or the chosen text editor) before running the
sudoeditcommand. - Template requirement: When using Kicksecure-Qubes, this must be done inside the Template.
3 Open the file with root rights.
sudoedit /etc/dracut.conf.d/60_user.conf
4 Notes.
- Shut down Template: After applying this change, shut down the Template.
- Restart App Qubes: All App Qubes based on the Template need to be restarted if they were already running.
- Qubes persistence: See also Qubes Persistence
- General procedure: This is a general procedure required for Qubes and is unspecific to Kicksecure-Qubes.
2 Notes.
- Example only: This is just an example. Other tools could achieve the same goal.
- Troubleshooting and alternatives: If this example does not work for you, or if you are not using Kicksecure, please refer to Open File with Root Rights.
3 Open the file with root rights.
sudoedit /etc/dracut.conf.d/60_user.conf
5 Paste.
hostonly=yes hostonly_mode=sloppy
6 Save.
7 Install dracut and systemd-cryptsetup.
sudo apt install --no-install-recommends dracut systemd-cryptsetup
8 Done.
Installation of dracut has been completed.
Re-Generate dracut Initrd
[edit]1 Run.
sudo dracut -f
2 Done.
The dracut initrd has been re-generated.
Development
[edit]Bugs
[edit]- Specific risk: Issues may occur during migration to
dracutif full disk encryption is used.- Likely issues:
- Package
systemd-cryptsetupis not installed. hostonly=yesconfiguration option is not used.
- Package
- Workaround: If boot fails: setting the kernel parameter
rd.automight help. (Tested on Debian12/bookworm.)
- Likely issues:
- Note on bug status: Closed bugs do not necessarily mean the issue is resolved in your distribution's APT repository. Fixes may have been reverted upstream, making bug status verification difficult.
dracut(abandoned)- fix(crypt): Encrypted root FS handling with generic initrd #2520
(abandoned pull request for dracut) - Generic initrd does not work with encrypted root FS without further configuration
- fix(crypt): Encrypted root FS handling with generic initrd #2520
dracut-ng(maintained) upstream bug reports and pull requests:- With encrypted root + unencrypted boot + systemd, dracut may generate an initrd incapable of decrypting the root disk without showing any warnings or errors #684
- fix(systemd-crypt): add potentially needed modules to generic initrd #319
- fix(crypt): unlock encrypted devices by default during boot #320
- revert(crypt): do not unlock encrypted devices by default during boot #529
- With encrypted root + unencrypted boot + systemd, dracut may generate an initrd incapable of decrypting the root disk without showing any warnings or errors #684
- Debian upstream bug reports:
- Forum discussion:
- ram-wipe discussion:
- ↑
Linux kernel documentation: Ramfs, rootfs and initramfs
- ↑
Initramfs images are also called "initrd".dracut man page
- ↑
Linux kernel documentation: Ramfs, rootfs and initramfs
- ↑
Arch Linux bootup(7): THE_EXITRD
- ↑
man7.org bootup(7): THE EXITRD
- ↑
systemd Initrd Interface: shutdown hook via /run/initramfs/shutdown
- ↑
dracut-shutdown.service(8): restore /run/initramfs on shutdown
- ↑ File name '60_user.conf' is important to override the configuration file 50-generic.conf by package 'dracut-config-generic', if installed.
A secure by default operating system with the latest security research in place.
At
Kicksecure we value freedom and trust, supporting Open Source and Freedom Software
2012-
2026 ENCRYPTED SUPPORT LLC
We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 14 year success story and maybe DONATE!