Arch Linux Base Installation

Installing the Arch Linux Base System with optional LUKS2 encryption, Btrfs, and UKI (systemd-boot).¹²

(Optional) Erasing.

lsblk
blkdiscard /dev/sdX

Discard all blocks on the supported (NVMe/SSD) device.

Disk partitioning.

lsblk

List disks and partitions.

wipefs -a /dev/sdX

Delete existing filesystem and partition table signatures.

sgdisk -Z /dev/sdX

Wipe the existing partition table.

sgdisk -n1:0:+512M -t1:ef00 -c1:EFI -N2 -t2:8304 -c2:ARCH /dev/sdX

Create GPT partitions. 512M EFI, remaining space for Linux root.

partprobe -s /dev/sdX

Reload the partition table.

lsblk /dev/sdX

List partitions on sdX.

Root setup.

cryptsetup luksFormat --type luks2 /dev/sdX2
cryptsetup open /dev/sdX2 arch
ROOT=/dev/mapper/arch

Optional step: Encrypted root.

ROOT=/dev/sdX2

Unencrypted root.

Filesystem.

mkfs.vfat -F32 -n EFI /dev/sdX1
mkfs.btrfs -f -L arch $ROOT

Format the EFI and root partitions.

Mount filesystems.

mount $ROOT /mnt

btrfs subvolume create /mnt/@
btrfs subvolume create /mnt/@home

umount /mnt

mount -o compress=zstd,subvol=@ $ROOT /mnt

mkdir -p /mnt/home /mnt/efi
mount -o compress=zstd,subvol=@home $ROOT /mnt/home
mount -o fmask=0177,dmask=0077,noexec,nosuid,nodev /dev/sdX1 /mnt/efi

Mount the root filesystem and create separate Btrfs subvolumes for / and /home.

Base packages.

reflector --country TR --age 24 --protocol http,https \
 --sort rate --save /etc/pacman.d/mirrorlist

Select the desired country and update the mirrorlist.

pacstrap -K /mnt base base-devel linux linux-firmware \
 amd-ucode btrfs-progs dosfstools \
 networkmanager sudo vim

Install base system packages and hardware utilities.

Optional step: Install also cryptsetup package for LUKS encryption support.

base: base system packages, base-devel: build tools, linux: Linux kernel, linux-firmware: hardware firmware, amd-ucode: AMD CPU microcode, cryptsetup: LUKS encryption, btrfs-progs: Btrfs tools, dosfstools: FAT filesystem tools, networkmanager: network management, sudo: privilege escalation, vim: text editor.

Filesystem table.

genfstab -U /mnt >> /mnt/etc/fstab

Generate fstab from the current mounts.

cat /mnt/etc/fstab

Review the generated filesystem table.

System configuration.

vim /mnt/etc/locale.gen

Uncomment the desired locale, e.g. en_US.UTF-8 UTF-8.

arch-chroot /mnt locale-gen

Generate the selected locale.

arch-chroot /mnt systemd-firstboot --prompt

Set keymap, timezone, and hostname.

Create user.

arch-chroot /mnt useradd -G wheel -m arch-user
arch-chroot /mnt passwd arch-user

Create the user and add it to the wheel group.

vim /mnt/etc/sudoers

%wheel ALL=(ALL:ALL) NOPASSWD: ALL

Allow wheel users to use sudo without a password.

arch-chroot /mnt passwd -l root

Lock the root account password.

Kernel command line and initramfs.

ROOT_UUID=$(blkid -s UUID -o value $ROOT)

Get the root filesystem UUID.

LUKS_UUID=$(cryptsetup luksUUID /dev/sdX2)

Optional step: Get the LUKS UUID of the root partition.

echo "quiet rd.luks.name=${LUKS_UUID}=arch \
 root=UUID=${ROOT_UUID} \
 rootflags=subvol=@" > /mnt/etc/kernel/cmdline

Optional step: Set the kernel command line for the encrypted root.

echo "quiet root=UUID=${ROOT_UUID} \
 rootflags=subvol=@" > /mnt/etc/kernel/cmdline

Set the kernel command line.

cat /mnt/etc/kernel/cmdline

Verify the kernel command line.

mkdir -p /mnt/efi/EFI/Linux

Prepare the EFI directory for UKIs.

vim /mnt/etc/mkinitcpio.conf

… sd-vconsole block sd-encrypt filesystems …

Optional step: Add sd-encrypt to HOOKS after block for encrypted roots.

vim /mnt/etc/mkinitcpio.d/linux.preset

ALL_config="/etc/mkinitcpio.conf"
ALL_kver="/boot/vmlinuz-linux"
#ALL_kerneldest="/boot/vmlinuz-linux"
#PRESETS=(‘default’)
PRESETS=(‘default’ ‘fallback’)
#default_config="/etc/mkinitcpio.conf"
#default_image="/boot/initramfs-linux.img"
default_uki="/efi/EFI/Linux/arch-linux.efi"
default_options="–splash /usr/share/systemd/bootctl/splash-arch.bmp"
#fallback_config="/etc/mkinitcpio.conf"
#fallback_image="/boot/initramfs-linux-fallback.img"
fallback_uki="/efi/EFI/Linux/arch-linux-fallback.efi"
fallback_options="-S autodetect"

Configure the preset to generate default and fallback UKIs in /efi/EFI/Linux/.

arch-chroot /mnt mkinitcpio -P

Generate the initramfs and UKI images.

ls -lR /mnt/efi

Check the generated EFI files.

Boot and services.

systemctl --root /mnt enable \
 systemd-resolved systemd-timesyncd NetworkManager

Enable networking, DNS and time synchronization.

ln -sf ../run/systemd/resolve/stub-resolv.conf /mnt/etc/resolv.conf

Configure systemd-resolved as the DNS resolver.

arch-chroot /mnt bootctl install --esp-path=/efi

Install systemd-boot to the EFI System Partition and create the UEFI boot entry.

Finish.

sync
umount -R /mnt

Sync changes and unmount the installation target.

cryptsetup close arch

Optional step: Close the encrypted volume.

systemctl reboot

Reboot the system.