Learn Rocky Linux - Kernel, Boot Process & Kernel Modules

#Introduction

In the previous episode 9, you connected the system to the network. Now we enter the deepest layer of the operating system: the kernel and the boot process. Every time you press the power button, a series of precise events turns the server from a dead machine into a system ready to work — and understanding that sequence is what separates an ordinary sysadmin from a true one. This episode guides you from UEFI to systemd, then into day-to-day kernel management: choosing a default kernel, adjusting runtime parameters, loading and unloading modules, and rescuing a system that fails to boot through rescue mode and initramfs regeneration.

#The Boot Journey

#From Firmware to GRUB2

When power is on, the UEFI firmware (or BIOS on older systems) runs POST, then loads the bootloader from the EFI partition. The bootloader on Rocky Linux is GRUB2. GRUB2 reads its configuration from /boot/grub2/grub.cfg:

cat /boot/grub2/grub.cfg

This file lists all available kernel entries. Changes to the GRUB menu are done via grub2-mkconfig, not by editing this file directly:

grub2-mkconfig -o /boot/grub2/grub.cfg

#Kernel, Initramfs, and Systemd

After GRUB2 selects the kernel, three things happen in sequence:

1. The kernel is loaded into memory along with the initramfs — a temporary image containing the early drivers and modules needed to access storage.
2. The kernel starts systemd (PID 1), which takes over full bootstrapping.
3. Systemd reaches the boot target, finally arriving at multi-user.target.

journalctl -b

journalctl -b shows all messages since the last boot — the primary tool for understanding what happens when the system powers on.

#Kernel Management

#Identifying the Kernel

uname -r
uname -a

uname -r shows the version of the running kernel. This matters when comparing with other kernels installed on the system.

#Choosing a Default Kernel with Grubby

A Rocky Linux system usually stores several kernels at once. Selecting a default kernel is done with grubby:

grubby --info=ALL | grep -E '^kernel|^index'

grubby --default-kernel

grubby --set-default /boot/vmlinuz-6.6.0-100.el10.x86_64

grubby --default-kernel shows the kernel path that will be used at boot. --set-default changes that choice — useful for making a particular kernel the default after an upgrade or for rolling back from a problematic kernel.

#Installed Kernels

To view the list of kernels available on the system:

rpm -qa | grep ^kernel

A good habit: keep one or two backup kernels as a rollback path, then clean up old ones with dnf5 remove as learned in episode 4.

#/proc, /sys, and sysctl

#Virtual Filesystems

/proc and /sys are windows into the kernel. /proc shows process and system information (CPU, memory, uptime), while /sys exposes device and subsystem parameters:

cat /proc/cpuinfo
cat /proc/meminfo
cat /sys/class/net/eth0/speed

#Changing Parameters with sysctl

Kernel parameters can be changed at runtime via sysctl:

sysctl vm.swappiness
sysctl net.ipv4.ip_forward

sysctl -w vm.swappiness=10

To make changes persist after a reboot, write them to a file in /etc/sysctl.d/:

echo 'vm.swappiness = 10' > /etc/sysctl.d/99-tuning.conf
sysctl --system

sysctl --system reloads all sysctl files — a quick verification before reboot. Broader kernel tuning will be covered in episode 17.

#Kernel Modules

#The Module Concept

Kernel modules are pieces of code that can be loaded and unloaded without a reboot — the kernel's way of extending hardware support and features. Examples: NIC drivers, storage drivers, and netfilter.

lsmod

modinfo nf_tables

#Loading and Unloading Modules

Module operations are rarely done manually because the kernel usually loads them automatically, but you need to master them for debugging:

modprobe bonding

modprobe -r bonding
lsmod | grep bonding

modprobe handles module dependencies automatically — the reason to use modprobe rather than insmod.

#Configuration in /etc/modprobe.d

Module behavior is controlled through files in /etc/modprobe.d/. Two common uses: loading a module at boot and blocking dangerous modules:

echo 'options bonding miimon=100 mode=1' > /etc/modprobe.d/bonding.conf

echo 'install usb-storage /bin/false' > /etc/modprobe.d/block-usb.conf

Blocking modules like usb-storage is a hardening step that protects against physical attacks — you'll find this pattern in high-security environments.

#Boot Options and Recovery

#Rescue and Single-User Mode

When the system fails to boot, don't panic. There are two rescue modes:

• rescue mode — boots to a minimal system that uses an environment for repair, often from the installation media.
• single-user (emergency) — boots directly to a minimal root shell with core services only.

Both modes are selected from the GRUB2 menu at boot. Inside them you can repair broken files, fix an incorrect fstab (remember the warning from episode 8), or run disk maintenance.

grubby --update-kernel=ALL --args="rescue"

#Initramfs Regeneration with Dracut

If the initramfs is corrupted or you added a driver that must be present from boot, regenerating the initramfs solves it:

dracut --force

dracut --force /boot/initramfs-6.6.0-100.el10.x86_64.img \
  6.6.0-100.el10.x86_64

dracut --force rebuilds the initramfs image for the running kernel. This is the standard rescue step after storage drivers change or after kernel manipulation fails to boot.

#Closing

In this episode 10, you understood the Rocky Linux boot journey from UEFI, GRUB2, kernel, and initramfs to systemd; kernel management with uname and grubby; runtime parameter adjustments via sysctl; kernel module management with modprobe, lsmod, and modinfo; and rescue mode, single-user mode, and initramfs regeneration with dracut as your rescue weapons.

Key takeaways:

• The boot flow: UEFI → GRUB2 → kernel + initramfs → systemd.
• grub2-mkconfig to update the GRUB menu; grubby --set-default to choose a kernel.
• Runtime parameters are changed with sysctl and persisted in /etc/sysctl.d/.
• Modules are managed with modprobe, lsmod, and modinfo; default behavior is set in /etc/modprobe.d/.
• Keep one backup kernel and master rescue mode plus dracut --force for recovery.

In the next episode 11, we will discuss Cockpit and remote management — Rocky Linux's built-in web console for monitoring the system, managing services and users, viewing logs and updates, plus integration with Podman and KVM. From inside the machine, now it's time to view the system from outside!