doc/system-installation/002-basic-system-installation.qd

.docname {Basic System Installation}
.include {docs}

This page explains the basic setup of Arch Linux. It was last updated July 2026.

> Tip: Always cross check this page with the current version of the [Arch Linux Installation Guide][arch-wiki-install],
> as the instructions on this page might be outdated or no longer complete.

> Important: Commands in this guide will modify your hard disk, including partitions, encryption, and more.
> Make sure to understand all commands before you execute them. You will lose data!
> Consult the [Arch Wiki][arch-wiki] or the man pages of all commands and options you are unfamiliar with.
>
> Create a backup of all important data that you do not want to lose before you continue with the installation of
> Arch Linux!

## Preparation

To install Arch Linux, boot from the installation medium. It might be necessary to change UEFI settings to do so.
For example:

- Disable Secure Boot
- Delete existing Boot Sequences or Boot Entries
- Enable USB Boot Support
- Enabled External USB Ports

.box {DELL XPS 13 9370 (2018)} type:{note}
    To access the boot menu or UEFI, press

    - .keybinding {F2} to access UEFI settings
    - .keybinding {F12} to access one-time boot menu

    In the UEFI settings:

    - Enable the support to boot from USB devices:
      `System Configuration` -> `USB Configuration` -> `Enable USB Boot Support`
    - Set `POST Behaviour` -> `Fastboot` to any value other than `Minimal`

    Secure Boot can already be enabled and set to audit mode to facilitate Secure Boot installation later. This allows
    the machine to boot without any valid secure boot keys with a warning message. As soon as we have set up valid
    keys and signed our boot image, secure boot can then be enabled to fail on unsigned boot images.

    In the UEFI settings:

    - enable `Secure Boot` -> `Secure Boot Enable` -> `Secure Boot Enable`
    - set `Secure Boot` -> `Secure Boot Mode` to `Audit Mode`
    - enable `Secure Boot` -> `Expert Key Management` -> `Enable Custom Mode`

.box {DELL XPS 13 9350 (2024)} type:{note}
    To access the boot menu or UEFI, press

    - .keybinding {F2} to access UEFI settings
    - .keybinding {F12} to access one-time boot menu

    In the UEFI Settings:

    - Enable the support to boot from USB devices:
      enable `Integrated Devices` -> `USB/Thunderbolt Configuration` -> `Enable USB Boot Support`

    Secure Boot should be configured to not use any Microsoft UEFI CA keys and should be prepared for enrollment
    of a custom certificate

    In the UEFI Settings:

    - enable `Boot Configuration` -> `Secure Boot` -> `Enable Secure Boot`
    - disable `Boot Configuration` -> `Secure Boot` -> `Enable Microsoft UEFI CA`
    - set `Boot Configuration` -> `Secure Boot` -> `Secure Boot Mode` to ` Auto Mode`
    - enable `Boot Configuration` -> `Expert Key Management` -> `Enable Custom Mode`

## Setting Keyboard Layout and Console Font

List available console key maps with `localectl list-keymaps`, then set the desired key map with
`loadkeys <key map>`.

Console fonts are located in `/usr/share/kbd/consolefonts` and can be set with `setfont <font>`.

.example
    Commonly, I set my systems to
    ```sh
    loadkeys de-latin1-nodeadkeys
    setfont eurlatgr
    ```

> Note: These changes are temporary and will be lost during reboot. Should you need to reboot your machine before
> the installation is finished and before the settings are persisted, repeat these commands after each boot.

> Tip: On HiDPI screens, a larger font might be desirable. E.g. `ter-132b` (the largest font), or
> `ter-118n`. If you need region-specific special characters, set the key map with the `-m` option,
> e.g. `setfont ter-118n -m 88591`.

## Verify Boot Mode

Verify that the system is booted in UEFI mode.

```sh
cat /sys/firmware/efi/fw_platform_size
```

This command should return `64`. If the command returns `32`, the system is booted in EUFI mode and has a 32-bit IA32
UEFI. While this is supported by Arch Linux, it is not part of this guide.

If the file does not exist, the system may be booted in BIOS or CSM mode. In this case, disable CMS Mode and restart
the computer

> Important: This guide does not work on systems in BIOS mode, or with IA32 UEFI!

## Connect to the Internet

Make sure that the computer is connected to the internet by running the following commands:

```sh
ip link # check interface link status
ip a # check for valid IP address assignment
```

For a quick test, you can try to ping the arch linux website

```sh
ping -c3 archlinux.org
```

If you are not yet automatically connected, follow one of these steps, depending on the connection type you want
to set up.

1. For wireless lan (WiFi) and WWAN , make sure the wireless network card is not blocked by `rfkill`, check
  ```sh
  rfkill
  list
  ```
2. Connect to the network:
  - **Ethernet:** Plug in your cable.
  - **Wi-Fi:** Authenticate to the wirless network using [`iwctl`][arch-wiki-iwctl].
  - **Mobile Broadband Modem:** connecto the mobile network with the [`nmcli`][arch-wiki-nmcli] utility.
3. Configure the network connection:
  - **DHCP**: dynamic IP address and DNS server assignment should work out of the box.
  - **Static IP Address**: See [Network Configuration][arch-wiki-network-configuration]

## Update the System Clock

Once a network connection is established, the system clock should be updated automatically. Check the correct date and
time has been acquired by running `timedatectl`.

## Partition the Disks

Get an overview of available disks with `lsblk` and / or `fdisk -l`. Make sure to identify the drives you want to
install Arch Linux to.

This guide sets up two partitions. The first partition is the EFI system partition. It will be used to boot from a
unified kernel image. The second partition will be a LUKS encrypted partition. Inside of it will be a LVM2 container
with SWAP, system, and data partitions as you see fit. The unencrypted EFI partition is required for the system to boot.

> Note: Even though we use LVM2 inside of the LUKS encrypted partition, this setup does not allow for the LVM2 volume
> group to span multiple disks. This is a limitation of this setup. If this limitation is unacceptabnle for you, check
> [LVM on LUKS in the Arch Wiki][arch-wiki-lvm-on-luks] for workarounds or different partition layouts you can use.

> Important: The following steps will repartition and format the disks you specify in the commands. Double-check all
> drive paths in all commands before continuing. Specifying the wrong drive paths **will erase data** from drives that
> you did not intend to erase, and that will be **unrecovarbly** lost!

### Transitioning from a Previously Unencrypted System

Repartitioning the drives and switching to a new encrypted disk will not mask any of your previously unencrypted data.
The unencrypted data might still be recoverable by data recovery or data forensic tools. If you want to make sure that
data previously stored on the disk is un-recoverable, you need to overwrite all of the disk with random data.

Depending on your disk size and write speed, this can take hours.

If your disk was already encrypted previously, or you do not consider this necessary, you can [skip to the next
section](#create-partitions).

Overwriting your disk with data can be achieved by the following commands

```sh
cryptsetup open -q --type plain -d /dev/urandom <drive path> to_be_wiped
dd bs=4M if=/dev/zero of=/dev/mapper/to_be_wiped conv=fsync oflag=direct status=progress
cryptsetup close to_be_wiped
```

### Create Partitions {#create-partitions}

Create a 1GB EFI partition as the first partition. Use the rest of the disk for the encrypted LUKS partition.
To format the disk, use `fdisk <drive path>`. Helpful commands:

- `m` to show help
- `g` to create a new GPT partition table
- `n` to create a new partition
- `t` to change the type of a partition
  - The EFI partition should be type `1: EFI System`
  - The LUKS partition should be type `43: Linuzx RAID`
- `w` to write the changes and quit

### Encrypt the System Partition

Create a LUKS encrypted system partition and open it

```sh
cryptsetup luksFormat <system partition>
cryptsetup open <system partition> cryptlvm
```

### TRIM and Workqueues for SSD Drives

You can [skip this section](#prepare-lvm) if you are not using a SSD (Solid State Drive).

You might want to configure TRIM support and disable workqueues to improve performance of SSD Drives.

> Warning: Enabling TRIM support on an encrypted drive has potential security implications. See [TRIM support for solid
> state drives][arch-wiki-trim-support]. If this is an issue, you might want to [skip this section](#prepare-lvm).

Verify your SSD supports TRIM:

```sh
lsblk --discard
```

Enable TRIM support:

```sh
cryptsetup --allow-discards --persistent refresh cryptlvm
```

Drive operation workqueues make sense for slow spinning disks. For SSDs, they usually introduce unnecessary delays.
Disabling workqueues can double the speed of file operations on SSDs. Disable the workqueues with the following command.

```sh
cryptsetup --perf-no_read_workqueue --perf-no_write_workqueue --persistent refresh cryptlvm
```

### Preparing the Logical Volumes {#prepare-lvm}

Inside the encrypted system partition, create the logical volumes.

```sh
pvcreate /dev/mapper/cryptlvm
vgcreate vgsys /dev/mapper/cryptlvm
lvcreate -L <swap size> vgsys -n lvswap
lvcreate -L 64G vgsys -n lvroot
lvcreate -L 64G vgsys -n lvhome
lvcreate -L 64G vgsys -n lvopt
lvcreate -L 64G vgsys -n lvvar
```

> Tip: The SWAP partition can be of any size. You could even go without one if you have enought RAM. The [Arch
> Wiki][arch-wiki] recommends at least 4GB. If you want to be able to use hibernation, I would recommend two times of
> your physical RAM size
>
> The (estimated) minimum SWAP space (in bytes) for successful hibernation can be found by looking at
> `cat /sys/power/image_size`. It is usually around 2/5 of the physical RAM.

### Create the File Systems

Create the file system on the EFI partition, the logical volumes, and the SWAP.

```sh
mkfs.fat -F 32 -n EFI <efi partition>
mkfs.ext4 -L root /dev/vgsys/lvroot
mkfs.ext4 -L home /dev/vgsys/lvhome
mkfs.ext4 -L opt /dev/vgsys/lvopt
mkfs.ext4 -L var /dev/vgsys/lvvar
mkswap /dev/vgsys/lvswap
```

### Mount the File Systems

Mount the created file systems

```sh
swapon /dev/vgsys/lvswap
mount /dev/vgsys/lvroot /mnt
mount --mkdir /dev/vgsys/lvhome /mnt/home
mount --mkdir /dev/vgsys/lvopt /mnt/opt
mount --mkdir /dev/vgsys/lvvar /mnt/var
mount --mkdir <efi partition> /mnt/efi
```

## Install Packages

Packages are installed from mirror servers, which are defined in `/etc/pacman.d/mirrorlist`. On the ISO, after
connecting to the internet, `reflector` updates the mirror list by choosing the 20 most recently synchronized HTTPS
mirrors, sorting them by download speed.

The higher a mirror is placed in the mirror list, the more priority it is given when downloading a packge. You might
want to inspect the mirror list to see if it is satisfactory. If it is not, edit the file accordingly or run `reflector`
to create a new mirror list specifying custom sorting parameters.

The file `/etc/pacman.d/mirrorlist` of the live ISO image is the only configuration file that will be copied from the
live ISO to the operating system that is being installed. So investing some time now and getting the mirror list right
is worth the effort now.

.example {Reflector Configuration}
    The following command will instruct reflector to select the 10 most up to date https mirrors from Germany, Austria,
    Switzerland, and Netherlands - then sort them by most recently updated.

    ```sh
    reflector \
    --country Germany,Austria,Switzerland,Netherlands \
    --protocol https \
    --latest 10 \
    --sort age \
    --save /etc/pacman.d/mirrorlist
    ```

Install the essential packages to the system

> Tip: This list already contains some essential software that is strictly not needed for a minimal system install.
> If you want to go more minimal, check the Arch Wiki for the minimal set of packages required.

```sh
pacstrap -K /mnt base linux linux-firmware \
exfatprogs e2fsprogs lvm2 \
neovim git base-devel man-db man-pages texinfo \
terminus-font intel-ucode efibootmgr sbctl openssh wget
```

> Important: On AMD CPU based systems, replace `intel-ucode` with `amd-ucode`.

[arch-wiki]: https://wiki.archlinux.org/
[arch-wiki-install]: https://wiki.archlinux.org/title/Installation_guide
[arch-wiki-iwctl]: https://wiki.archlinux.org/title/Iwd#iwctl
[arch-wiki-nmcli]: https://wiki.archlinux.org/title/Mmcli
[arch-wiki-network-configuration]: https://wiki.archlinux.org/title/Network_configuration
[arch-wiki-lvm-on-luks]: https://wiki.archlinux.org/title/Dm-crypt/Encrypting_an_entire_system#LVM_on_LUKS
[arch-wiki-trim-support]: https://wiki.archlinux.org/title/Dm-crypt/Specialties#Discard/TRIM_support_for_solid_state_drives_(SSD)