cloud-boot

From firmware entry to distro userspace — pure Go, four arches, one ISO.

cloud-boot boots an unmodified cloud image on any UEFI hypervisor. Three complementary tracks coexist : Phase 1 ships a UKI toolchain plus three boot paths (kexec, UKI menu-then-reboot, pure-UEFI TinyGo loader) that all land on the same stock OS userspace ; Phase 2 is a pure-Go TamaGo bare-metal UEFI loader that walks PCI, drives virtio-net, speaks DHCPv4 / DNS / TLS / HTTPS / OCI v2, verifies cosign signatures, and chain-boots the distro kernel — entirely inside Boot Services, no cgo, no external linker ; Phase 3 generalises Phase 2 into an OS-agnostic OCI boot architecture — same loader, but it publishes its own EFI_BLOCK_IO_PROTOCOL + EFI_SIMPLE_FILE_SYSTEM_PROTOCOL (Go-side) over an in-memory UFS2 / FAT / NTFS image and chain-boots the target OS's native first-stage loader (loader.efi / boot.efi / bootmgfw.efi).

One multi-arch hybrid ISO embeds BOOTX64.EFI + BOOTAA64.EFI + BOOTRISCV64.EFI + BOOTLOONGARCH64.EFI ; firmware on each CPU reads only its own arch's file. Phase 2 reaches a real Debian 13 userspace on all four arches from a fresh DHCP lease against a public OCI registry — arm64 17.1 s, amd64 16.1 s, riscv64 18.1 s, loong64 17.1 s wall-clock (Debian 6.12.90 across the first three, 7.0.12 on loong64). M8.15 subsequently unified all four arches on the initrd= path and M8.16 deleted ~1684 LOC of dead LoadFile2 publish code. Phase 3 is live for OpenBSD end-to-end (boot> prompt, amd64, 2026-06-11) ; FreeBSD reaches currdev selection against our UFS but OOMs at kernel-load (sprint 2E pending) ; NetBSD and Windows scaffolding ships behind their own gates (ISO size, NTFS reader).

x86_64arm64riscv64loongarch64cloud-boot.isoUbuntuDebianRockyAlpineFreeBSDNetBSDOpenBSD

One ISO, four architectures, OS-agnostic chain-boot. The same cloud-boot.iso ships BOOTX64.EFI + BOOTAA64.EFI + BOOTRISCV64.EFI + BOOTLOONGARCH64.EFI ; spheres are boot envelopes landing on each (arch, OS) target. Phase 2 reaches a real Debian 13 userspace end-to-end on all four arches in 16-18 s wall-clock from a cold DHCP lease ; M8.15+M8.16 consolidated the path and pruned legacy code. Phase 3 generalises the loader to OpenBSD (live), FreeBSD (currdev, OOM at kernel-load), NetBSD (scaffolded), and Windows (scaffolded) via a pure-Go BlockIO + SFS publish pair on top of an in-memory UFS2 image — built with the new go-filesystems/ufs read+write driver. M9.0+M9.1+M9.2 shipped an interactive boot menu ; the nightly cron re-publishes a fresh vmlinuz for each arch.

Why cloud-boot

Cloud images are built once, by the distro vendor, signed by the distro vendor, and meant to boot unmodified on any hypervisor. The reality is that each hypervisor wants a slightly different boot envelope — UEFI here, direct kernel there, a custom GRUB config somewhere else. cloud-boot is the glue : it lets the same untouched cloud image boot under KVM/OVMF, Apple VZ, and OpenStack without rebuilding the image and without trusting yet another bootloader.

Three paths, one outcome

UKI + init + kexec

Production target on Linux hosts (QEMU/OVMF, OpenStack). Boots a UKI, the init reaches the stock kernel via kexec. Predictable, fast, kernel-version-flexible.

Pure-UEFI loader

Apple Virtualization.framework can't kexec — the loader stays in UEFI all the way through. Pure-Go via TinyGo + the peln linker. Multi-arch.

UKI menu-then-reboot

The hybrid path : a UKI menu runs as PID 1, fetches the target plan over OCI, stages a Boot####/BootOrder, then reboot(2). Works under VZ + OpenStack + bare metal.

Architecture × hypervisor matrix

Components

cloud-boot

The top-level CLI. cloud-boot iso assembles a multi-arch hybrid ISO from per-arch UKIs.

loader/

Pure-UEFI, pure-Go bootloader. The production target on Apple VZ.

uki/

UKI assembler + the menu-then-reboot init that runs as PID 1 inside the staged UKI.

peln

Pure-Go COFF/PE linker covering amd64 / arm64 / riscv64 / loongarch64. Replaces lld-link for the last two.

tinygo-riscv64-uefi / tinygo-loongarch64-uefi

TinyGo runtime shims that produce baremetal UEFI binaries for the two emerging architectures.

go-bootloaders/grub · systemd-boot

Parsers for legacy bootloader configs — used by the menu init to enumerate target OSes on an existing ESP.

go-filesystems/*

Pure-Go read-only drivers for ext4, xfs, btrfs, zfs, apfs — lets the init mount the target's root without kernel FS modules.

go-fde/* + go-crypto/*

Full-disk-encryption (LUKS, APFS FDE) + the crypto primitives behind them, also pure-Go.

Sibling : Weft

cloud-boot is the boot toolchain ; Weft is the cloud platform that uses it. Weft creates VMs, schedules them across a multi-DC cluster, and points each one at a cloud-boot UKI — the same UKI on x86_64 and arm64, the same UKI for Ubuntu and FreeBSD. The two projects share an ethos (pure Go, multi-arch, no rebuild per target) and a colour palette.