This document captures what I have discovered about the initrd file that is first loaded as the root file system during kernel initialization. A. HOW I GOT IT In Ubuntu 12.04 the initrd file is a gzip-compressed cpio archive. Therefore to retrieve its contents: mkdir /tmp/initrd cd /tmp cp /boot/INIRD-FILE INITRD-FILE.gz gunzip INITRD-FILE cd initrd cpio -i <../INITRD-FILE B. CONTENTS This file system contains the following directories: bin/ etc/ lib/ run/ sbin/ The above directories are subsets of the corresponding directories in the real root file system that is part of the running system. It is interesting to note that the bin directory contains busybox, a utility program primarily used in embedded devices. mount, sh, and sleep are implemented via busybox. Since the init script is the first file executed by the kernel, and since that script begins with the line: #!/bin/sh and since /bin/sh is a symbolic link to /bin/busybox, this means that the first executable to be run by the kernel is really busybox. conf/ scripts/ The above directories contain shell scripts used during system initialization. init This is a shell script that is invoked by the kernel as the first process to run. C. PROCESSING When the /init script is run, it (in summary) does the following steps. 1. It creates the following directories to be used primarily as mount-points for other file systems: /dev /dev/pts /root /sys /proc /tmp /var /var/lock 2. init then mounts the /sys and /proc file systems. 3. It creates the /dev file system. 4. It creates a set of environment variables and then parses the kerenel command line and sets the environment variables accordingly. 5. A set of drivers are loaded. The specific modules to be loaded are listed in the file /conf/modules. (In my system, which is running in a VMware virtual machine, this file contains only VMware modules.) 5. The "real" root file system is now mounted. The address of this file system on disk was passed to the kernel on the kernel command line and capture in step 4 above. Eventually the real root file system will be mounted on "/", but that spot is currently occupied by the initrd file system and so the real root file system is initially mounted as /root. 6. /sys and /proc are moved to /root/sys and /root/proc. 7. The init script now looks for an init program in several places. In most cases it will find it in /sbin/init (currently /root/sbin/init). 8. At this point, the init script runs the binary program, run-init. At that point the trail goes cold.