A sub-1 MB iPXE loader with a menu fetched at boot
netboot.xyz is an iPXE bootloader under 1 MB. Start it from a USB stick, a mounted ISO or the DHCP server on the LAN, and it pulls a menu from boot.netboot.xyz listing Linux and BSD installers, live distributions and rescue tools. Choosing an entry downloads that system's kernel and initrd. One stick covers the whole catalog, and new distribution releases show up in the menu, so the stick never needs reflashing.
ISO-only distros rebuilt into iPXE-ready kernels
- For distributions that only ship ISOs, the project's CI unpacks each new release and republishes a kernel and initrd that iPXE loads directly. Loading the whole ISO through memdisk doesn't work under UEFI and fails on most Linux ISOs.
- Every file's URL, on the project's storage or an upstream mirror, is printed on screen while it downloads.
- There's a loader for each way in: an ISO for a CD or DRAC/iLO virtual media, a USB image, a
.lkrnkernel for GRUB or EXTLINUX,.kpxeand.efifiles for DHCP, ARM64 binaries, and an SD card image for the Raspberry Pi 4. Every build ships SHA256 checksums. - The Ansible playbook behind the public service also renders a private instance into
/var/www/html, with mirrors and other defaults overridden inuser_overrides.yml. - Site-specific entries go in
custom/custom.ipxe, apart from the upstream menu, which keeps updating on its own.
Installs over iLO and a rescue entry in GRUB
- Install an OS on a remote server by attaching the ISO as DRAC or iLO virtual media.
- Add the
.lkrnkernel to GRUB as a rescue entry. - Run Clonezilla, GParted, Memtest or System Rescue without a stick per tool.
- Put Proxmox VE (ARM64 included since 3.0.3) or Proxmox Datacenter Manager on a bare machine.
Wired-only booting and a keyboard catch in 3.x
Booting needs wired Ethernet, since Wi-Fi isn't supported. The docs recommend at least 4 GB of RAM, and more for live distributions, which load entirely into memory.
The default menu lives on the internet. Prebuilt loaders fetch it from boot.netboot.xyz and pull installer files from upstream mirrors. Serving it from the LAN takes the Ansible build or the Docker container (web UI, TFTP, local copies of the project's files). The docs pitch the container for developing custom menus and point anyone who doesn't want to manage iPXE menus to the USB or ISO image.
Secure Boot works end to end only for Debian, Devuan and Kali. Fedora, the RHEL family, openSUSE and Ubuntu publish no shim usable for netboot, so installing them means turning Secure Boot off. The signed images, added in 3.0.1, are locked: they can't be rebuilt, and the menu loses its theme and its signature verification.
Windows, RHEL and VMware need install media you provide. Windows also needs an SMB share, a WinPE image and the Docker container.
3.x images can lock up a USB keyboard. On some hardware, their USB network drivers knock out the firmware's keyboard handling. The legacy images added in 3.0.2 drop those drivers, and USB Ethernet adapter support along with them.
3.0.3, released on August 29, 2026, is the year's fourth release. 3.0.0 in January replaced the embedded signing certificates, and 2.x loaders move to 3.x on their own at first boot. New distribution versions reach the public menu continuously, between releases. The latest commit is from October 26, 2026.