Installing SakuraOS
Fourteen steps, each one saying what it will do rather than naming the thing it configures. Nothing is written to the disk until the summary screen, and the summary says so.
What it asks
Language, keyboard, network, time, appearance, disk, encryption, your account, a browser, how updates should behave, which SakuraOS features you want, and privacy. Then a summary, then the install.
The network step is optional. SakuraOS installs from the disc, so a machine with no cable and no wifi still gets a complete system. Connecting during the install means the machine arrives up to date with the right graphics driver already on it, rather than doing that on first boot.
The disk layout
One EFI system partition and one BTRFS partition, with five subvolumes.
| Subvolume | Mounted at | Why it is separate |
|---|---|---|
@ | / | The system. This is what a restore point restores and what a rollback replaces. |
@home | /home | Your files. Never part of a system restore point, so rolling back the system never touches your documents. |
@log | /var/log | Logs survive a rollback. The record of what went wrong is the thing you need after going back, and it would otherwise be rolled back along with the fault. |
@pkg | /var/cache/pacman/pkg | The package cache is large and worthless to snapshot. Keeping it out means snapshots stay cheap. |
@snapshots | /.snapshots | Where the restore points live. A subvolume cannot usefully contain its own snapshots. |
The EFI system partition is 1 GiB. That is larger than the usual advice, and deliberately: a unified kernel image is the kernel plus the entire initramfs in one file, there are two of them here (the normal one and the recovery one), and a machine that cannot write a new boot image because the ESP filled up is a machine that cannot take a kernel update.
It is mounted with fmask=0077,dmask=0077. It holds the boot
chain and, once Secure Boot is set up, key material. No other account has
business reading it.
Encryption
Optional, LUKS, and applied to the BTRFS partition only. The ESP stays unencrypted because firmware has to be able to read it, which is true of every full-disk encryption setup on every operating system.
When encryption is on, the encrypt hook goes into the initramfs
and the kernel command line carries the cryptdevice for both the
normal and the recovery boot images. The recovery path is easy to forget and
is exactly when you need it to work.
Secure Boot
If the firmware is in setup mode, the installer generates keys on your
machine with sbctl, enrols them alongside Microsoft's, and signs
the boot chain.
Microsoft's keys are enrolled too because some hardware needs them for its own option ROMs, and a machine whose graphics card stops initialising is a worse outcome than a slightly larger trust store.
Most Arch-based distributions tell you to switch Secure Boot off in firmware. That is where a lot of people quietly give up, and it is why this is part of the install rather than a wiki page.
The kernel is chosen for your processor
The installer checks what your CPU supports and installs the tuned kernel or the standard one accordingly. You are not asked, and there is nothing to undo. See Kernel.
Nothing is written until you press Install. The summary screen lists every decision and states plainly which disk is about to be erased and that other disks are not touched.