Re: New News Item: 2026-xx-yy-dracut-hostonly-cmdline

Sam James <[email protected]> Thu, 07 May 2026 01:26:15 +0100
Newsgroups	gmane.linux.gentoo.devel
Organization	Gentoo
Message-ID	<[email protected]>
Nowa Ammerlaan <[email protected]> writes:

> On 02/05/2026 14:52, Nowa Ammerlaan wrote:
>> Hi Team,
>> This is the first draft of a news item to accompany the next release
>> of sys-kernel/dracut (111) which will change the default value of
>> the hostonly_cmdline setting. I have tried to keep a logical flow
>> from the specific to the general which I hope will help users find
>> which specific instructions are relevant for them. There might still
>> be room for improvement here though, this is a rather complicated
>> one because of the large variation in setups. Anyway, let me know
>> what you think.
>> Best regards,
>> Nowa
>> 
> Sorry, I messed up the copy-paste somehow, here's the proper version:
>
> Title: Dracut changed default for hostonly_cmdline setting
> Author: Nowa Ammerlaan <[email protected]>
> Posted: 2026-xx-yy
> Revision: 1
> News-Item-Format: 2.0
> Display-If-Installed: >=sys-kernel/dracut-111
>
> Dracut is an initramfs generation tool. It may be invoked via the
> installkernel mechanism or manually after building custom kernels.

Thanks for handling this. I'm a bit worried about the verbosity of the
news item, and the difficulty for users in quickly determining if
they're actually affected or not.

IMO bullet points and short sentences in their own paragraph can help
with that (longer sentences are fine around it, but having some small
ones to state clearly what you're about to go into more detail on, perhaps).

At the moment, we're assuming they know for sure which method they're
using, but not really explaining clearly how to then specify it
properly.

I think it's clearer if we just list, for each method, how to set the
cmdline if one is needed, like:
* Method
** Obtaining the current cmdline: ...
** Setting the new cmdline: ... (may not be necessary if above is blank)

(not in that format but I mean that's the information I suggest per
section)

>
> What changed?
> ====================

The '='s should always match the length of the words above it.

>
> In version 111 of sys-kernel/dracut the default for the
> hostonly_cmdline setting changed from enabled to disabled. When
> enabled, this setting causes Dracut to attempt to detect which
> parameters are required on the kernel command line to boot the system.
> Examples are the root= parameter or parameters controlling partition
> decryption. These parameters are then included in the generated
> initramfs and appended to the kernel command line during boot.
>
> Why has this setting been changed
> ====================
>
> When enabled, Dracut's hostonly_cmdline setting may use the kernel
> command line of the running kernel (/proc/cmdline) to construct the
> kernel command line that will be embedded in the initramfs. This can
> cause problems when Dracut is being executed from a live or rescue
> environment. In such cases an incorrect root= could be included in the
> embedded kernel command line which could lead to boot failure.
>
> To prevent this behaviour from causing such unpleasant surprises, a
> check was added to sys-kernel/installkernel to detect whether the
> kernel was being installed from chroot and if Dracut was configured
> to include an embedded kernel command line (hostonly_cmdline=yes).
> While this check prevents boot failures, it also has the unfortunate
> side effect of creating a hard error that is triggered by default on
> new Gentoo installs. This has proven to be a significant stumbling
> block that new users often trip over. For this reason it was decided
> to disable the hostonly_cmdline setting in Gentoo's default settings
> for Dracut.
>
> User Action Required (all users)
> ====================
>
> When upgrading to Dracut version 111, a sanity check should be
> performed to ensure that kernel parameters required to boot
> successfully are still present in the kernel command line. When in
> doubt, ensure a system rescue CD or USB is close at hand. More

Just say "rescue media".

> specific instructions for various setups follow below, ordered from
> the specific to the more general.
>
> As always, do not hesitate to use our support channels to ask for
> clarification or assistance.
>
> User Action Required (Systemd GPT Auto Generator)
> ====================
>
> Systems that utilise the Systemd GPT Auto Generator mechanism to
> automatically detect and find the root partition at boot should not
> require any manual intervention. Though, before rebooting, users
> should verify that the GPT Auto Generator is actually being used and
> is working properly. To do so, check that /dev/gpt-auto-root currently
> exists and points to your root partition. For example:
>
> ls -l /dev/gpt-auto-root
>
> Should produce an output similar to the below if /dev/nvme0n1p1 is the
> root partition:
>
> lrwxrwxrwx 1 root root 4 May  2 10:33 /dev/gpt-auto-root -> nvme0n1p1
>
> If this is not the case then proceed with the instructions below that
> best match the setup to ensure that the root partition is set on the
> kernel command line using an alternative method.
>
> User Action Required (Generic Unified Kernel Image: "generic-uki")
> ====================
>
> Users booting with the generic Unified Kernel Image (USE=generic-uki)
> functionality provided by the distribution kernels (dist-kernel) do
> not have to take any action as the hostonly_cmdline is already
> disabled in these builds:
> - sys-kernel/vanilla-kernel[generic-uki]
> - sys-kernel/gentoo-kernel[generic-uki]
> - sys-kernel/gentoo-kernel-bin[generic-uki]
>
> User Action Required (Unified Kernel Image with Secure Boot)
> ====================
>
> Booting a Unified Kernel Image (UKI) with Secure Boot enabled is a
> special case because in this situation the kernel command line
> supplied by the bootloader or the firmware is ignored and the built-in
> UKI command line, along with the parameters embedded in the initramfs,
> take precedence. The instructions below are also relevant if no
> kernel command line is set by the bootloader or the firmware.
>
> An easy way to check the built-in kernel command line of an UKI is to
> use the lsinitrd tool provided by sys-kernel/dracut. For example:
>
> lsinitrd /efi/EFI/Linux/gentoo-x.y.z-gentoo-dist.efi
>
> This command will produce an output that could contain for example:
>
> <snip>
> Command line:
> quiet
> splash
> root=PARTUUID=7ae430c6-07e8-3b4e-a796-b2a28706b3fb
> <snip>
> dracut cmdline:
> ro
>
> Showing that the built-in kernel command line for this UKI contains
> "quiet", "splash" and sets the root partition to the partition that
> has the partition UUID "7ae430c6-07e8-3b4e-a796-b2a28706b3fb".
> Additionally, the kernel command line embedded in the initramfs
> contains "ro".
>
> If kernel parameters that are essential for successfully booting
> the system (such as root=) are present in the "dracut cmdline"
> section but not in the "Command line" section then user intervention
> is required. In that case please adjust the configuration of the
> UKI generator to include the appropriate kernel parameters in the
> built-in UKI command line.
>
> If Ukify (sys-apps/systemd[ukify] or sys-apps/systemd-utils[ukify])
> is generating the UKI then adjust the "Cmdline=" setting in
> /etc/kernel/uki.conf. If that setting is not present in the uki.conf
> then adjust the kernel command line in /etc/kernel/cmdline.
>
> If Dracut itself is generating the UKI then please set or adjust the
> "kernel_cmdline=" setting in a dracut configuration file in
> /etc/dracut.conf.d/.
>
> If unsure which tool is generating the UKI then please inspect the
> current value of "uki_generator" in /usr/lib/kernel/install.conf and
> /etc/kernel/cmdline.
>
> User Action Required (systemd-boot)
> ====================
>
> Users booting with systemd-boot should compare the contents of
> /etc/kernel/cmdline against the kernel command line embedded in the
> initramfs or Unified Kernel Image (UKI). If Unified Kernel Images are
> used and the /etc/kernel/cmdline file is empty or missing then no
> kernel command line is set by systemd-boot, in this case please refer
> to the "Unified Kernel Image with Secure Boot" section above, even if
> Secure Boot is not enabled.
>
> The lsinitrd utility provided by sys-kernel/dracut can be used to
> inspect the kernel parameters embedded in an initramfs or UKI. For
> example, in the case of a plain initramfs:
>
> lsinitrd /efi/gentoo/x.y.z-gentoo-dist/initrd
>
> Or, in the case of an Unified Kernel Image:
> lsinitrd /efi/EFI/Linux/gentoo-x.y.z-gentoo-dist.efi
>
> The final lines of the output of these commands show which kernel
> parameters are embedded in the Dracut initramfs. For example:
>
> dracut cmdline:
> ro
>
> If kernel parameters that are essential for successfully booting
> the system (such as root=) are present in the "dracut cmdline"
> section but not in /etc/kernel/cmdline then user intervention is
> required. In that case please adjust /etc/kernel/cmdline to include
> the missing kernel parameters.
>
> User Action Required (GRUB)
> ====================
>
> Users booting with GRUB should compare the GRUB_CMDLINE_LINUX and
> GRUB_CMDLINE_LINUX_DEFAULT settings in /etc/default/grub against the
> kernel command line embedded in the initramfs or
> Unified Kernel Image (UKI). The lsinitrd utility provided by
> sys-kernel/dracut can be used for this purpose. For example, in the
> case of a plain initramfs:
>
> lsinitrd /boot/initramfs-x.y.z-gentoo-dist.img
>
> Or, in the case of an Unified Kernel Image:
> lsinitrd /boot/vmlinuz-x.y.z-gentoo-dist.efi
>
> The final lines of the output of these commands show which kernel
> parameters are embedded in the Dracut initramfs. For example:
>
> dracut cmdline:
> ro
>
> If kernel parameters that are essential for successfully booting
> the system (such as root=) are present in the "dracut cmdline"
> section but not in /etc/default/grub then user intervention is
> required. In that case please adjust the GRUB_CMDLINE_LINUX or
> GRUB_CMDLINE_LINUX_DEFAULT settings in /etc/default/grub to include
> the missing kernel parameters. After adjustments don't forget to
> update the grub.cfg. For example:
>
> grub-mkconfig -o /boot/grub/grub.cfg
>
> Note that when Secure Boot is enabled the grub.cfg might reside in a
> different directory, for example: /efi/EFI/Gentoo/grub.cfg.
>
> User Action Required (rEFInd)
> ====================
>
> Users booting with rEFInd should compare kernel command line set
> in the refind_linux.conf file against the kernel command line embedded
> in the initramfs or Unified Kernel Image (UKI). The refind_linux.conf
> configuration file usually resides in /boot but may also be found
> elsewhere. If Unified Kernel Images are used and the refind_linux.conf
> configuration file is empty or missing then no kernel command line is
> set by rEFInd, in this case please refer to the "Unified Kernel Image
> with Secure Boot" section above, even if Secure Boot is not enabled.
>
> The lsinitrd utility provided by sys-kernel/dracut can be used to
> inspect the kernel parameters embedded in an initramfs or UKI. For
> example, in the case of a plain initramfs:
>
> lsinitrd /boot/initramfs-x.y.z-gentoo-dist.img
>
> Or, in the case of an Unified Kernel Image:
> lsinitrd /boot/vmlinuz-x.y.z-gentoo-dist.efi
>
> The final lines of the output of these commands show which kernel
> parameters are embedded in the Dracut initramfs. For example:
>
> dracut cmdline:
> ro
>
> If kernel parameters that are essential for successfully booting
> the system (such as root=) are present in the "dracut cmdline"
> section but not in the refind_linux.conf then user intervention is
> required. In that case please adjust refind_linux.conf to include the
> missing kernel parameters.
>
> User Action Required (other/general)
> ====================
>
> For other setups please refer to the wiki page or manual of your
> bootloader and find where the kernel command line is set. Then
> compare this setting with the kernel parameters embedded in the
> initramfs. If essential parameters are present in the later but not in
> the former, then please move those parameters to your bootloader's
> configuration. When Unified Kernel Images are used then also consider
> the built-in UKI command line set by the UKI generator. Note that when
> Secure Boot is disabled, the bootloader may override the built-in UKI
> command line. However, when Secure Boot is enabled then any parameters
> set by the bootloader are ignored and the built-in UKI command line is
> always used.
>
> See Also
> ====================
>
> [1] https://github.com/dracut-ng/dracut-ng/pull/2399
> [2] https://bugs.gentoo.org/971572
signature.asc (application/pgp-signature, 418 B)