Arch Linux

LichenEater

Member

Registered: 2026-08-22

Posts: 3

Need help understanding how encrypted boot partitions work (GRUB+BIOS)

TLDR: Erroneously (I think) mounted /boot due to a gap in knowledge, and Arch didn't install properly.

Hello, this is my first time installing Arch Linux, and my goal was to encrypt my entire drive during the install process, including the boot partition. I am doing a Legacy/BIOS install not UEFI, for context. I am following the guide linked here (as well as the default Arch installation guide): https://wiki.archlinux.org/title/Dm-cry … ion_(GRUB)

Where I believe I made a mistake was when I attempted to mount /boot to the 1MiB BIOS boot partition I created. For context, I have an SSD I'm installing on and I formatted the SSD to the GPT scheme with fdisk, then created two partitions: A 1MiB BIOS boot partition (/dev/nvme0n1p1), and a LUKS encrypted partition taking up the rest of the drive space (/dev/nvme0n1p2). The guide said to create a 1 MiB BIOS boot partition if you are doing a Legacy/BIOS install. I then did all of the same steps in Section 8.1 and 8.2 of the above linked guide. This is when I then typed the following commands:

"mkfs.ext4 /dev/nvme0n1p1"
"mount --mkdir /dev/nvme0n1p1 /mnt/boot".

Apparently, you are not supposed to format the BIOS boot partition nor mount /boot to it (even though its called the boot partition). My assumption here was that /boot and GRUB and all of the bootloader stuff was supposed to be in the 1MiB BIOS partition, but apparently, /boot actually sits inside the LUKS encrypted partition (I was confused why the guide never encrypts the 1MiB BIOS partition, or the UEFI partition for if you are using UEFI). The errors started coming in after i did pacstrap and the /boot stuff got partially installed into my BIOS partition, which messed up the "mkinitcpio -P" command required to regenerate mkinitcpio after editing it to work for LUKS (Error: early uncompressed CPIO image generation failed, bsdtar step 1 reported an error).

I then attempted to unmount /boot from the 1MiB BIOS boot partition, wipe the BIOS boot partition of erroneously installed files, and redo pacstrap so /boot gets installed inside the LUKS partition which seemed to make "mkinitcpio -P" work. However, there were still problems. My /mnt/etc/fstab file still showed /boot mounted to the BIOS partition, so I deleted that line. I then did the GRUB configuration as outlined in the guide and GRUB seemed to install with no problems.

However, when rebooting and trying to boot into the drive I installed Arch on, it doesn't boot at all (so I am assuming that mounting /boot to my BIOS boot partition must've messed something up along the way, so I will try a reinstall). My question is then, how does encrypted /boot really work? Is /boot something that sits inside the /root or /home directory in the LUKS encrypted partition? What then is the purpose of the 1MiB BIOS boot partition, if it is not /boot or where GRUB lives?

Last edited by LichenEater (Today 05:13:14)

frostschutz

Member

Registered: 2013-11-15

Posts: 1,652

Re: Need help understanding how encrypted boot partitions work (GRUB+BIOS)

The 1MiB partition can't be mounted (no filesystem), it is just for grub core to embed itself in (still needs additional modules from /boot/grub/...). grub core is also usually just around a hundred kilobytes in size, 1MiB is done for alignment reasons. If you're using uefi boot you don't need it at all, grub core is put on the efi partition as a regular file then.

It's still a good idea to have a dedicated /boot partition so Grub does not have to handle the entire rootfs plus additional headaches like RAID, LVM, btrfs/zfs checksums and snapshots, etc. (if you use any of those). Grub sometimes stop working with filesystems that are still under active development when it encounters unknown filesystem flags.

If you changed your partition/mounting layout, you might have to re-run grub-install and grub-mkconfig.

Last edited by frostschutz (Today 05:20:42)