{"slug": "systemd-boot", "name": "systemd-boot", "category": "other", "category_name": "Other software", "description": "", "recommenders": 5, "commenters": 7, "warners": 0, "score": 4.851, "rising": -1.64, "first": "2025-11-17", "latest": "2026-07-07", "why": "Learned a lot about systemd-boot which I have never used before, but feels a lot saner to me than grub ever was.", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 4, "neutral": 3, "compare": 0, "warn": 0}, "spark": [1, 0, 0, 1, 0, 0, 1, 0, 1, 0, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "Learned a lot about systemd-boot which I have never used before, but feels a lot saner to me than grub ever was.", "kind": "", "icon": true, "domain": "freedesktop.org", "github_repo": null, "official_url": "https://www.freedesktop.org/software/systemd/man/latest/systemd-boot.html", "pricing": "", "aliases": ["systemd-boot"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 781242080, "item_id": 48827630, "url": "https://news.ycombinator.com/item?id=48827630", "by": "Confiks", "date": "2026-07-07", "version": null, "stance": "recommend", "quote": "Learned a lot about systemd-boot which I have never used before, but feels a lot saner to me than grub ever was.", "excerpt": "Not a great time price-wise to be building a NAS, but I have been doing so for the last past weeks. Inside a Jonsbo N6 case, which is pretty nice with an 8x SATA backplane and drive bays (unlike the earlier Jonsbo variants). I ended up on shucking 4x the 14 TB WD Elements Desktop. They contain helium drives, the WD140EDGZ in my case, and are about 25% cheaper than 4x the 12 TB WD Red Plus drives (which are air-filled", "context": "building a ZFS NAS", "use_case": "NAS bootloader", "switched_from": "GRUB", "story": "How to Build a Minimal ZFS NAS Without Synology, QNAP, TrueNAS"}, {"id": 768796625, "item_id": 48049789, "url": "https://news.ycombinator.com/item?id=48049789", "by": "ciupicri", "date": "2026-05-07", "version": null, "stance": "recommend", "quote": "I prefer the more minimalist approach of systemd-boot.", "excerpt": "I'm using rEFInd because it can load and use the NVMe EFI driver unlike GRUB and systemd-boot. rEFInd is a true UEFI boot loader. I think that Fedora doesn't know to update its configuration when I install or remove a kernel, so I use rEFInd only to run systemd-boot which is pretty well supported by Fedora. I could probably try letting rEFInd scan the boot partition for kernels or modify/tune kernel-install [1], but ", "context": "Fedora user", "use_case": "booting Fedora kernels", "switched_from": "", "story": "Diskless Linux boot using ZFS, iSCSI and PXE"}, {"id": 751007776, "item_id": 46937986, "url": "https://news.ycombinator.com/item?id=46937986", "by": "NekkoDroid", "date": "2026-02-08", "version": null, "stance": "recommend", "quote": "systemd-boot can do that if you force it to", "excerpt": "The enrolling of the certs happen before the bootloader calls `ExitBootServices()` (I think that is what the function was called). Up until then the bootloader still has elevated priviledges and can modify certain UEFI stuff it can't after, including enrolling certs. systemd-boot can do that if you force it to (only does it by default on VMs cuz expectedly UEFI implementations in the wild are kinda shit)[1, 2] [1]: h", "context": "", "use_case": "", "switched_from": "", "story": "Exploiting signed bootloaders to circumvent UEFI Secure Boot"}, {"id": 751006880, "item_id": 46937930, "url": "https://news.ycombinator.com/item?id=46937930", "by": "NekkoDroid", "date": "2026-02-08", "version": null, "stance": "recommend", "quote": "See last paragraph in this section as example", "excerpt": "I was talking about the same \"install\" that is already done (pre-installed on the drive that is first booted). Enrolling certs into the UEFI isn't something that needs to be done manually when \"Setup Mode\" is enabled, the bootloader can automatically enroll them. This already is a thing with the exception of the ship in \"Setup Mode\" part. Though some motherboard UEFI implementations are shit (as to be expected) and s", "context": "", "use_case": "", "switched_from": "", "story": "Exploiting signed bootloaders to circumvent UEFI Secure Boot"}, {"id": 749922784, "item_id": 46870174, "url": "https://news.ycombinator.com/item?id=46870174", "by": "tmtvl", "date": "2026-02-03", "version": null, "stance": "recommend", "quote": "It's really awesome because it lets me boot from Btrfs snapshots", "excerpt": "OpenSUSE uses systemd-boot for its GRUB2 BLS implementation (<https://news.opensuse.org/2024/10/08/grub2-bls/>). It's really awesome because it lets me boot from Btrfs snapshots on a fully LUKS2 argon2id encrypted system.", "context": "", "use_case": "Boot loader for Btrfs snapshots", "switched_from": "", "story": "Linux from Scratch Ends SysVinit Support"}]}], "caveats": [], "who": [{"by": "Confiks", "context": "building a ZFS NAS", "url": "https://news.ycombinator.com/item?id=48827630", "date": "2026-07-07"}, {"by": "ciupicri", "context": "Fedora user", "url": "https://news.ycombinator.com/item?id=48049789", "date": "2026-05-07"}], "tags": [], "use_cases": ["nas bootloader", "booting fedora kernels", "bootloader", "boot loader for btrfs snapshots"], "compared": [{"slug": "grub", "name": "GRUB", "co": 4, "switched_from": 1, "switched_to": 0}, {"slug": "refind", "name": "rEFInd", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=48045012", "title": "Diskless Linux boot using ZFS, iSCSI and PXE", "mentions": 3}, {"url": "https://news.ycombinator.com/item?id=46934579", "title": "Exploiting signed bootloaders to circumvent UEFI Secure Boot", "mentions": 3}, {"url": "https://news.ycombinator.com/item?id=48827325", "title": "How to Build a Minimal ZFS NAS Without Synology, QNAP, TrueNAS", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46858829", "title": "Linux from Scratch Ends SysVinit Support", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=45893471", "title": "Runit Linux: Complete Guide to Unix Init Scheme with Service Supervision", "mentions": 1}], "sentiment_by_month": {"2025-11": {"recommend": 1}, "2025-12": {}, "2026-01": {}, "2026-02": {"recommend": 1, "neutral": 1}, "2026-03": {}, "2026-04": {}, "2026-05": {"neutral": 2, "recommend": 1}, "2026-06": {}, "2026-07": {"recommend": 1}, "2026-08": {}, "2026-09": {}, "2026-10": {}}, "versions": [], "version_unnamed": 0, "family_ref": null, "runs_on": null, "lines": [], "quotes": [{"id": 781242080, "item_id": 48827630, "url": "https://news.ycombinator.com/item?id=48827630", "by": "Confiks", "date": "2026-07-07", "version": null, "stance": "recommend", "quote": "Learned a lot about systemd-boot which I have never used before, but feels a lot saner to me than grub ever was.", "excerpt": "Not a great time price-wise to be building a NAS, but I have been doing so for the last past weeks. Inside a Jonsbo N6 case, which is pretty nice with an 8x SATA backplane and drive bays (unlike the earlier Jonsbo variants). I ended up on shucking 4x the 14 TB WD Elements Desktop. They contain helium drives, the WD140EDGZ in my case, and are about 25% cheaper than 4x the 12 TB WD Red Plus drives (which are air-filled", "context": "building a ZFS NAS", "use_case": "NAS bootloader", "switched_from": "GRUB", "story": "How to Build a Minimal ZFS NAS Without Synology, QNAP, TrueNAS"}, {"id": 768843264, "item_id": 48052704, "url": "https://news.ycombinator.com/item?id=48052704", "by": "ux266478", "date": "2026-05-07", "version": null, "stance": "neutral", "quote": "systemd-boot's automatic sourcing of UKIs isn't a BLS thing", "excerpt": "systemd-boot's automatic sourcing of UKIs isn't a BLS thing. This is BLS: https://uapi-group.org/specifications/specs/boot_loader_specification/", "context": "", "use_case": "", "switched_from": "", "story": "Diskless Linux boot using ZFS, iSCSI and PXE"}, {"id": 768796625, "item_id": 48049789, "url": "https://news.ycombinator.com/item?id=48049789", "by": "ciupicri", "date": "2026-05-07", "version": null, "stance": "recommend", "quote": "I prefer the more minimalist approach of systemd-boot.", "excerpt": "I'm using rEFInd because it can load and use the NVMe EFI driver unlike GRUB and systemd-boot. rEFInd is a true UEFI boot loader. I think that Fedora doesn't know to update its configuration when I install or remove a kernel, so I use rEFInd only to run systemd-boot which is pretty well supported by Fedora. I could probably try letting rEFInd scan the boot partition for kernels or modify/tune kernel-install [1], but ", "context": "Fedora user", "use_case": "booting Fedora kernels", "switched_from": "", "story": "Diskless Linux boot using ZFS, iSCSI and PXE"}, {"id": 768755410, "item_id": 48047213, "url": "https://news.ycombinator.com/item?id=48047213", "by": "DaSHacka", "date": "2026-05-07", "version": null, "stance": "neutral", "quote": "There's also systemd-boot, which seems to be getting more popular.", "excerpt": "There's also systemd-boot, which seems to be getting more popular. https://systemd.io/BOOT/", "context": "", "use_case": "", "switched_from": "", "story": "Diskless Linux boot using ZFS, iSCSI and PXE"}, {"id": 751007776, "item_id": 46937986, "url": "https://news.ycombinator.com/item?id=46937986", "by": "NekkoDroid", "date": "2026-02-08", "version": null, "stance": "recommend", "quote": "systemd-boot can do that if you force it to", "excerpt": "The enrolling of the certs happen before the bootloader calls `ExitBootServices()` (I think that is what the function was called). Up until then the bootloader still has elevated priviledges and can modify certain UEFI stuff it can't after, including enrolling certs. systemd-boot can do that if you force it to (only does it by default on VMs cuz expectedly UEFI implementations in the wild are kinda shit)[1, 2] [1]: h", "context": "", "use_case": "", "switched_from": "", "story": "Exploiting signed bootloaders to circumvent UEFI Secure Boot"}, {"id": 751006880, "item_id": 46937930, "url": "https://news.ycombinator.com/item?id=46937930", "by": "NekkoDroid", "date": "2026-02-08", "version": null, "stance": "recommend", "quote": "See last paragraph in this section as example", "excerpt": "I was talking about the same \"install\" that is already done (pre-installed on the drive that is first booted). Enrolling certs into the UEFI isn't something that needs to be done manually when \"Setup Mode\" is enabled, the bootloader can automatically enroll them. This already is a thing with the exception of the ship in \"Setup Mode\" part. Though some motherboard UEFI implementations are shit (as to be expected) and s", "context": "", "use_case": "", "switched_from": "", "story": "Exploiting signed bootloaders to circumvent UEFI Secure Boot"}, {"id": 751000144, "item_id": 46937509, "url": "https://news.ycombinator.com/item?id=46937509", "by": "NekkoDroid", "date": "2026-02-08", "version": null, "stance": "neutral", "quote": "systemd-boot can tell the UEFI to load (file system) drivers off of it", "excerpt": "> From that mindset what makes sense are hardware vendors including a cache of trusted third party root certificates from known other vendors. Today this would include Microslop, the same said hardware vendor, probably various respected Linux organizations/groups (Offhand, Linux Foundation, ArchLinux, Debian, IBM/RedHat, Oracle, SUSE, etc), similar for BSD... IMO systems should be shipped in \"Setup Mode\" by default w", "context": "", "use_case": "bootloader", "switched_from": "", "story": "Exploiting signed bootloaders to circumvent UEFI Secure Boot"}, {"id": 749922784, "item_id": 46870174, "url": "https://news.ycombinator.com/item?id=46870174", "by": "tmtvl", "date": "2026-02-03", "version": null, "stance": "recommend", "quote": "It's really awesome because it lets me boot from Btrfs snapshots", "excerpt": "OpenSUSE uses systemd-boot for its GRUB2 BLS implementation (<https://news.opensuse.org/2024/10/08/grub2-bls/>). It's really awesome because it lets me boot from Btrfs snapshots on a fully LUKS2 argon2id encrypted system.", "context": "", "use_case": "Boot loader for Btrfs snapshots", "switched_from": "", "story": "Linux from Scratch Ends SysVinit Support"}, {"id": 735251536, "item_id": 45953221, "url": "https://news.ycombinator.com/item?id=45953221", "by": "udev4096", "date": "2025-11-17", "version": null, "stance": "recommend", "quote": "systemd-boot (a lot more secure than grub)", "excerpt": "Using luks to encrypt all partitions (incl. /boot) and it's only unlocked using yubikey. I have secureboot enabled (sbctl to enroll keys) and TPM PCR values to avoid tampering. systemd-boot (a lot more secure than grub) doesn't have password to lock the kernel editor so I have disabled the editor altogether. I use fapolicy for \"whitelisting\" apps. Unfortunately, coreboot doesn't have BIOS password feature so it's unl", "context": "", "use_case": "", "switched_from": "", "story": "Runit Linux: Complete Guide to Unix Init Scheme with Service Supervision"}]}