Ubuntu Architecture Explained: From Boot Process to Running Services

Ubuntu, as one of the most popular Linux distributions, builds on the standard Linux kernel while adding polished user-space components, predictable release cycles, and excellent hardware support. Under the hood, its architecture follows the classic Linux layered model, but with modern conventions centered around UEFI, GRUB2, initramfs, and systemd.

This article walks through the complete boot sequence and explains how the system transitions from firmware to fully operational services.

1. Firmware Phase: UEFI or Legacy BIOS

Everything begins when power is applied.

• On modern systems (2012+ hardware), UEFI firmware executes first.
  • Performs Power-On Self-Test (POST)
  • Initializes basic hardware (memory controller, PCIe bus, storage controller, USB)
  • Reads EFI System Partition (ESP) — usually FAT32 mounted at /boot/efi
  • Locates the EFI boot entry pointing to grubx64.efi (or shimx64.efi when Secure Boot is enabled)
• On older legacy BIOS systems (still supported but rare in 2025+):
  • BIOS reads the Master Boot Record (MBR) of the boot disk
  • Loads the first-stage GRUB bootloader into memory

Most Ubuntu installations since 18.04 default to UEFI mode unless explicitly configured otherwise.

2. Bootloader: GRUB2

GRUB2 (GRand Unified Bootloader) is Ubuntu’s default bootloader.

Key responsibilities during boot:

• Loads its own configuration (/boot/grub/grub.cfg)
• Displays the boot menu (if timeout > 0 or Shift held during boot)
• Allows kernel command-line editing (very useful for recovery: rw init=/bin/bash, nomodeset, systemd.unit=rescue.target, etc.)
• Loads the selected Linux kernel image (vmlinuz-*) into memory
• Loads the corresponding initramfs image (initrd.img-*)

GRUB passes control to the kernel, providing it with:

• Kernel command line parameters (from /etc/default/grub + grub.cfg)
• The location of the initramfs archive

3. Kernel Startup & Early Userspace (initramfs)

Once the kernel gains control, it executes in protected mode (x86_64) or equivalent.

Early kernel phases include:

• Decompression of itself
• Initialization of core subsystems (CPU, interrupt controllers, timers, memory management)
• Parsing of the kernel command line
• Mounting of the initramfs as a tmpfs-based root filesystem

Ubuntu uses initramfs (not the older initrd format) — a compressed cpio archive containing:

• Minimal userspace tools (busybox or custom binaries)
• Essential kernel modules (usually auto-detected via mkinitramfs)
• Scripts (/init, /scripts/*) written mostly in POSIX shell

The /init script in initramfs runs and performs critical early tasks:

1. Parses kernel command line
2. Loads additional modules needed to access real root (NVMe, RAID, LVM, encrypted LUKS, ZFS, NFS root, etc.)
3. Sets up device-mapper for LVM or dm-crypt
4. For encrypted root: prompts for passphrase (via Plymouth if graphical)
5. Mounts the real root filesystem (usually ext4) to a temporary mount point
6. Switches root (switch_root / pivot_root) → discards initramfs and executes /sbin/init on the real root

At this point the kernel has mounted the real / filesystem and handed control to userspace.

4. Systemd: The Init System and Service Manager

Since Ubuntu 15.04, systemd is the init process (PID 1).

Systemd fundamentally changes how services are started compared to classic SysV init or Upstart.

Major systemd boot targets (runlevels equivalent)

• basic.target — core system setup complete
• multi-user.target — console-ready system (traditional runlevel 3)
• graphical.target — full GUI (runlevel 5)
• rescue.target / emergency.target — recovery shells

Boot sequence under systemd

1. systemd reads its default target (usually graphical.target)
2. Mounts filesystems listed in /etc/fstab (systemd-fstab-generator creates units dynamically)
3. Starts sysinit.target dependencies in parallel:
   • systemd-udev — device discovery & naming
   • systemd-journald — logging
   • systemd-tmpfiles — create directories/files defined in tmpfiles.d
   • local-fs-pre.target → actual local filesystem mounts
   • swap.target
   • cryptsetup.target (if LUKS)
4. Activates basic.target — timers, paths, sockets, services needed early
5. Reaches multi-user.target → starts networking, cron, sshd, docker, etc.
6. If graphical.target is wanted → starts display manager (gdm, sddm, lightdm)

Key systemd features visible in Ubuntu

• Parallel service startup → dramatically faster boot
• Socket activation (services start on first connection)
• cgroups v2 integration (unified hierarchy since Ubuntu 21.10+)
• systemd-oomd — userspace out-of-memory killer
• systemd-resolved — local DNS stub resolver (127.0.0.53)
• systemd-networkd — optional modern network configuration (increasingly popular over NetworkManager on servers)

You can inspect boot dependency tree with:

systemd-analyze plot > boot.svg       # visual timeline
systemd-analyze critical-chain        # slowest chain to graphical.target
systemd-analyze blame                 # per-unit time consumption

5. From Boot Complete to Running Services

After reaching the default target:

• Login managers run:
  • Console → getty@.service (agetty)
  • GUI → gdm-wayland-session / gdm-x-session
• User services can be started via:
  • systemd –user instances (lingering enabled or on-demand)
  • Desktop autostart mechanisms (.desktop files in ~/.config/autostart)
• Long-running daemons are managed as systemd units located in:
  • /lib/systemd/system/ (packaged defaults)
  • /etc/systemd/system/ (sysadmin overrides)
  • /run/systemd/system/ (runtime-generated)

Common examples in Ubuntu:

• NetworkManager.service or systemd-networkd.service
• snapd.service (Snap package manager)
• apparmor.service
• unattended-upgrades.service
• ssh.service

Summary: Layered View of Ubuntu Architecture

Understanding this flow helps greatly when debugging slow boots, failed services, encrypted root issues, custom kernels, or rescue operations.

Next time your Ubuntu system hangs during boot, remember the sequence: firmware → GRUB → kernel → initramfs → systemd targets → services. Most problems occur at one of these handoff points.