Build the initramfs

The initramfs solves a chicken-and-egg problem. To mount the root filesystem the kernel needs drivers – for the disk controller, for btrfs, maybe for unlocking LUKS – and those drivers live on the root filesystem it cannot mount yet.

So the bootloader loads a second, tiny filesystem into memory alongside the kernel. That image contains just enough to find the real root, mount it, and hand over. Arch builds it with mkinitcpio, and pacstrap already generated one when it installed the kernel.

Look at what it is doing

Run this inside the chroot:

grep -E '^(MODULES|HOOKS)' /etc/mkinitcpio.conf

(stdout)

MODULES=()
HOOKS=(base systemd autodetect microcode modconf kms keyboard sd-vconsole block filesystems fsck)

Those defaults are already correct for an unencrypted btrfs system, so if you did not encrypt the disk there is nothing to change here. The hooks that matter:

Hook	What it does
`systemd`	Uses systemd as the early-boot init, rather than busybox shell scripts
`autodetect`	Trims the image to the modules this machine actually loads
`microcode`	Folds CPU microcode into the initramfs
`block`	Block-device drivers, so the disk is visible
`filesystems`	The filesystem drivers needed to mount the root

btrfs needs no entry in MODULES: the kernel has the driver and filesystems pulls it in.

The microcode hook changes the old advice

Guides written before mkinitcpio 38 tell you to add a separate initrd /intel-ucode.img line to your bootloader entry. The microcode hook in the default HOOKS does that job now, so that line is no longer needed and is not used later in this chapter.

If you encrypted the disk

The initramfs is what prompts for the passphrase, and it can only do that if it is built to. Add sd-encrypt to HOOKS, after block:

Edit this file: /etc/mkinitcpio.conf

HOOKS=(base systemd autodetect microcode modconf kms keyboard sd-vconsole block sd-encrypt filesystems fsck)

sd-encrypt, not encrypt

There are two LUKS hooks, and they are not interchangeable. sd-encrypt belongs with the systemd hook; plain encrypt belongs to the older busybox-based initramfs. Since the default HOOKS above starts with base systemd, the one you want is sd-encrypt. Mixing encrypt into a systemd initramfs produces an image that builds without complaint and then cannot unlock the disk.

Rebuild it

Only necessary if you changed HOOKS, but it is harmless to run either way and it confirms the image builds:

Run this inside the chroot:

mkinitcpio -P

(stdout)

==> Creating gzip-compressed initcpio image: '/boot/initramfs-linux.img'
  -> Early uncompressed CPIO image generation successful
==> Initcpio image generation successful

Read the output rather than skimming it. Warnings about missing firmware for hardware you do not have are normal; an actual error here means the machine will not boot, and now is a much better time to find out than after the reboot.