GRUB2 netboot

Use GRUB to network boot UEFI hardware.


For local development, install the dependencies for libvirt with UEFI.

Ensure that you've gone through the matchbox with rkt and matchbox guides and understand the basics.


Run matchbox with rkt, but mount the grub group example.


On Fedora, add the metal0 interface to the trusted zone in your firewall configuration.

$ sudo firewall-cmd --add-interface=metal0 --zone=trusted

Run the container image with rkt or docker.

sudo rkt run --net=metal0:IP= \
  -- -d -q \
  --dhcp-range=, \
  --enable-tftp \
  --tftp-root=/var/lib/tftpboot \
  --dhcp-match=set:efi-bc,option:client-arch,7 \
  --dhcp-boot=tag:efi-bc,grub.efi \
  --dhcp-userclass=set:grub,GRUB2 \
  --dhcp-boot=tag:grub,"(http;","" \
  --log-queries \
  --log-dhcp \
  --dhcp-userclass=set:ipxe,iPXE \
  --dhcp-boot=tag:pxe,undionly.kpxe \
  --dhcp-boot=tag:ipxe, \

Client VM

Create UEFI VM nodes which have known hardware attributes.

$ sudo ./scripts/libvirt create-uefi


If you use Docker, run matchbox according to matchbox with Docker, but mount the grub group example. Then start the coreos/dnsmasq Docker image, which bundles a grub.efi.

$ sudo docker run --rm --cap-add=NET_ADMIN -d -q --dhcp-range=, --enable-tftp --tftp-root=/var/lib/tftpboot --dhcp-match=set:efi-bc,option:client-arch,7 --dhcp-boot=tag:efi-bc,grub.efi --dhcp-userclass=set:grub,GRUB2 --dhcp-boot=tag:grub,"(http;","" --log-queries --log-dhcp --dhcp-option=3, --dhcp-userclass=set:ipxe,iPXE --dhcp-boot=tag:pxe,undionly.kpxe --dhcp-boot=tag:ipxe, --address=/

Create a VM to verify the machine network boots.

$ sudo virt-install --name uefi-test --pxe --boot=uefi,network --disk pool=default,size=4 --network=bridge=docker0,model=e1000 --memory=1024 --vcpus=1 --os-type=linux --noautoconsole