Learn Alpine Linux - Kernel & Kernel Management

#Introduction

The kernel is the bridge between hardware and software, and Alpine provides kernel choices you can tailor to your needs. Episode 12 covers Alpine's two main kernels — linux-lts and linux-stable — along with module management and boot parameters.

Understanding the kernel isn't just for the curious: boot failures often come from a module that isn't loaded or a wrong kernel parameter. After this episode, you'll be able to swap kernels confidently and recover the system if booting goes wrong.

#linux-lts versus linux-stable

#The Two Main Kernel Choices

Alpine provides several kernel packages in its repositories:

linux-lts: the long-term support kernel, the default and most stable choice for production.
linux-stable: the newest release kernel, replacing linux-edge since Alpine 3.23. For new hardware or the latest features.
linux-virt: a kernel optimized for virtualization, available for VMs.

Check the running kernel:

Check the active kernel

uname -r
uname -a
cat /etc/alpine-release

The uname -r output shows the kernel version. Compare it with the installed kernel packages:

List installed kernel packages

apk info | grep '^linux-'
apk info -e linux-lts

apk info -e linux-lts shows whether the LTS kernel package is present on the system.

#Updating the Kernel

#Upgrading and Rebooting Correctly

When a new Alpine release comes out, the kernel is updated along with it. Upgrade the kernel safely with:

Upgrade the kernel together with the system

apk update
apk upgrade
apk add linux-lts

After the kernel is installed, make sure the bootloader is updated and reboot:

Update the bootloader and reboot

update-grub
reboot

The uname -r output after rebooting should show the new kernel version. If booting fails, pick the old kernel from the GRUB menu as a fallback.

#Kernel Module Management

#modprobe and lsmod

Kernel modules load hardware support dynamically. The main commands:

Manage kernel modules

lsmod
modprobe wireguard
modprobe -r wireguard
modinfo wireguard

Explanation:

lsmod shows the currently loaded modules.
modprobe wireguard loads the module together with its dependencies.
modprobe -r unloads a module.
modinfo shows module metadata.

To load a module automatically at boot, write its name in /etc/modules:

Contents of /etc/modules

wireguard
nf_tables

Each line in /etc/modules is loaded at boot. Check the logs for modules that failed to load:

Check module logs

dmesg | grep -i error
tail -20 /var/log/messages

The dmesg | grep -i error output shows kernel errors, including modules that failed to load.

#Boot Parameters and the Bootloader

#GRUB and efibootmgr

Boot parameters are passed to the kernel at boot and can change system behavior, for example disabling the serial console or specifying the root partition. The default parameters are stored in /etc/default/grub:

Parameters in /etc/default/grub

GRUB_CMDLINE_LINUX_DEFAULT="quiet mitigations=auto"
GRUB_CMDLINE_LINUX="console=tty0"

Apply the parameter changes:

Update the GRUB configuration

update-grub
reboot

For UEFI systems, boot entries can be managed with efibootmgr:

Manage UEFI boot entries

efibootmgr
efibootmgr -v
efibootmgr --bootorder 0001,0000

efibootmgr lists the boot entries, and efibootmgr --bootorder sets the boot order. If GRUB doesn't detect the kernel after an upgrade, regenerate the config:

Regenerate the boot configuration

grub-mkconfig -o /boot/grub/grub.cfg

The grub-mkconfig -o /boot/grub/grub.cfg command rewrites the GRUB menu from the current settings.

Warning

Always test a new kernel in a VM or non-production environment before applying it to an important server. A failed production boot can be avoided with a single test reboot beforehand.

#Closing

Episode 12 covered Alpine's kernel management: the difference between linux-lts and linux-stable, version verification with uname, safe kernel upgrades, module management with modprobe and lsmod, the /etc/modules file, and boot parameters via GRUB and efibootmgr.

Key takeaways:

linux-lts for stable production; linux-stable for the newest hardware.
uname -r verifies the running kernel version.
apk upgrade and apk add linux-lts update the kernel.
modprobe and lsmod manage modules dynamically.
/etc/modules loads modules automatically at boot.
GRUB_CMDLINE_LINUX_DEFAULT determines the default boot parameters.

In the next episode, episode 13, we'll cover security hardening — the habit of regular updates with apk upgrade, strengthening SSH and the firewall, doas and umask policy, and using lynis and fail2ban for auditing and detection.