Arch Linux philosophy and installation planning

Arch philosophy: simplicity, modernity, and user centrality#

Arch Linux’s design principles include simplicity, modernity, pragmatism, user centrality, and versatility. Simplicity here does not mean a bare-bones interface. It means avoiding unnecessary modifications and complex abstractions so users can understand and control their systems.

• Simplicity: choose tools to suit your needs. systemd-boot and systemd-networkd can form a lean system, but GRUB and NetworkManager are equally reasonable choices.
• Modernity: rolling releases bring new kernel and userspace features into the repositories relatively quickly. UKI and Btrfs are optional technologies, not default installation requirements.
• User centrality: archinstall can reduce repetitive work; manual installation makes the relationships between partitioning, mounting, booting, and system configuration more explicit. Both require understanding the settings that will be applied.

Pre-installation research#

Boot mode

If you plan to use systemd-boot, UKI, and Secure Boot, boot the installation image in UEFI mode. Arch also supports BIOS installations; only the UEFI chain-of-trust approach discussed in this series depends on UEFI.

ls /sys/firmware/efi/efivars

If the directory is absent, the current installation environment may have been booted in BIOS/CSM mode.

ESP capacity

When creating an EFI System Partition, 1 GiB can serve as a starting point. Adjust it for the number of kernels, UKIs, firmware updates, and dual-boot requirements. UKI size varies with the modules and initramfs contents, so no fixed size range should be guaranteed. Do not immediately reformat an existing Windows ESP; first check its capacity and boot files.

Storage and recovery

Decide whether to use LUKS2, Btrfs subvolumes, disk-backed swap, and hibernation before designing the mount layout. Keep recovery media, backups of important data, and encryption recovery passphrases. Whether installing manually or with a script, check disk names first: confirming formatting in the installer really does delete data.

Optional SSH access for installation#

SSH can let you perform the installation from another terminal, but the temporary installation environment and the installed system have different access policies. Do not disable your only working access method before verifying that a regular user can log in.

Generate a key

ssh-keygen -t ed25519 -C "arch-install-key"

Ed25519 is a common choice. RSA still has valid uses with a sufficient key length and modern RSA-SHA2 signatures; restrictions on the old ssh-rsa SHA-1 signature scheme do not mean that the entire RSA algorithm is prohibited.

Access configuration for the installed system

You can use the following in /etc/ssh/sshd_config:

PermitRootLogin no
PasswordAuthentication no

Before applying it, verify public-key login, sudo privileges, and configuration syntax, and keep your original session open. OpenSSH’s default algorithms change between versions. Do not copy a KexAlgorithms list containing ellipses or override well-maintained defaults just to use a particular algorithm name.

Build a base system from the live environment#

graph TD
    A[安装镜像] --> B[选择是否使用 LUKS2]
    B --> C[文件系统和子卷布局]
    C --> D[pacstrap 基础包]
    D --> E[配置引导程序或 UKI]
    E --> F[验证恢复入口后配置 Secure Boot]

Choose installation tools

The archinstall interface and available features vary by version; use the installed version and official documentation as your guide. Custom scripts can collect fixed steps such as time zone, locale, and sudoers setup into a heredoc, but disk selection, key enrollment, and credentials should not be automated blindly.

Example base packages

The following example assumes that the target root partition and ESP are correctly mounted at their respective locations under /mnt, and that Btrfs has been selected. It installs only the base components; it does not complete all system initialization:

pacstrap -K /mnt base linux linux-firmware sudo btrfs-progs sbctl networkmanager neovim

• -K initializes an empty pacman keyring in the target rather than copying the installation environment’s keyring.
• btrfs-progs provides Btrfs administration tools; adjust this if using a different filesystem.
• sbctl manages Secure Boot keys and signatures and is needed only if you choose that approach.
• networkmanager provides network management; it still needs to be configured to start after installation.
• Choose intel-ucode or amd-ucode according to the CPU type; do not infer the actual hardware from a microcode package name.

Common questions#

GRUB or systemd-boot?

GRUB supports multiple boot modes and complex layouts; systemd-boot suits UEFI systems, conventional kernel entries, and UKIs. Choose based on disk layout, dual-boot requirements, and snapshot booting needs.

Not enough ESP space, or the wrong output path?

Check the actual mount point, UKI output location, and free space. Your choice of /efi, /boot, or /boot/efi must match the generation tool and bootloader configuration.