{ "mode": "man", "parameter": "SYSTEMD-REPART", "section": "8", "url": "https://www.chedong.com/phpMan.php/man/SYSTEMD-REPART/8/json", "generated": "2026-10-09T17:24:20Z", "synopsis": "systemd-repart [OPTIONS...] [[BLOCKDEVICE]...]\nsystemd-repart.service", "sections": { "NAME": { "content": "systemd-repart, systemd-repart.service - Automatically grow and add partitions\n", "subsections": [] }, "SYNOPSIS": { "content": "systemd-repart [OPTIONS...] [[BLOCKDEVICE]...]\n\nsystemd-repart.service\n", "subsections": [] }, "DESCRIPTION": { "content": "systemd-repart grows and adds partitions to a partition table, based on the configuration\nfiles described in repart.d(5).\n\nIf invoked with no arguments, it operates on the block device backing the root file system\npartition of the running OS, thus growing and adding partitions of the booted OS image\nitself. If --image= is used it will operate on the specified image file. When called in the\ninitrd it operates on the block device backing /sysroot/ instead, i.e. on the block device\nthe system will soon transition into. The systemd-repart.service service is generally run at\nboot in the initrd, in order to augment the partition table of the OS before its partitions\nare mounted. systemd-repart (mostly) operates in a purely incremental mode: it only grows\nexisting and adds new partitions; it does not shrink, delete or move existing partitions. The\nservice is intended to be run on every boot, but when it detects that the partition table\nalready matches the installed repart.d/*.conf configuration files, it executes no operation.\n\nsystemd-repart is intended to be used when deploying OS images, to automatically adjust them\nto the system they are running on, during first boot. This way the deployed image can be\nminimal in size and may be augmented automatically at boot when needed, taking possession of\ndisk space available but not yet used. Specifically the following use cases are among those\ncovered:\n\n• The root partition may be grown to cover the whole available disk space.\n\n• A /home/, swap or /srv/ partition can be added.\n\n• A second (or third, ...) root partition may be added, to cover A/B style setups where a\nsecond version of the root file system is alternatingly used for implementing update\nschemes. The deployed image would carry only a single partition (\"A\") but on first boot a\nsecond partition (\"B\") for this purpose is automatically created.\n\nThe algorithm executed by systemd-repart is roughly as follows:\n\n1. The repart.d/*.conf configuration files are loaded and parsed, and ordered by filename\n(without the directory prefix). For each configuration file, drop-in files are looked for\nin directories with same name as the configuration file with a suffix \".d\" added.\n\n2. The partition table already existing on the block device is loaded and parsed.\n\n3. The existing partitions in the partition table are matched up with the repart.d/*.conf\nfiles by GPT partition type UUID. The first existing partition of a specific type is\nassigned the first configuration file declaring the same type. The second existing\npartition of a specific type is then assigned the second configuration file declaring the\nsame type, and so on. After this iterative assigning is complete any left-over existing\npartitions that have no matching configuration file are considered \"foreign\" and left as\nthey are. And any configuration files for which no partition currently exists are\nunderstood as a request to create such a partition.\n\n4. Partitions that shall be created are now allocated on the disk, taking the size\nconstraints and weights declared in the configuration files into account. Free space is\nused within the limits set by size and padding requests. In addition, existing partitions\nthat should be grown are grown. New partitions are always appended to the end of the\npartition table, taking the first partition table slot whose index is greater than the\nindexes of all existing partitions. Partitions are never reordered and thus partition\nnumbers remain stable. When partitions are created, they are placed in the smallest area\nof free space that is large enough to satisfy the size and padding limits. This means\nthat partitions might have different order on disk than in the partition table. Note that\nthis allocation happens in memory only, the partition table on disk is not updated yet.\n\n5. All existing partitions for which configuration files exist and which currently have no\nGPT partition label set will be assigned a label, either explicitly configured in the\nconfiguration or — if that's missing — derived automatically from the partition type. The\nsame is done for all partitions that are newly created. These assignments are done in\nmemory only, too, the disk is not updated yet.\n\n6. Similarly, all existing partitions for which configuration files exist and which\ncurrently have an all-zero identifying UUID will be assigned a new UUID. This UUID is\ncryptographically hashed from a common seed value together with the partition type UUID\n(and a counter in case multiple partitions of the same type are defined), see below. The\nsame is done for all partitions that are created anew. These assignments are done in\nmemory only, too, the disk is not updated yet.\n\n7. Similarly, if the disk's volume UUID is all zeroes it is also initialized, also\ncryptographically hashed from the same common seed value. This is done in memory only\ntoo.\n\n8. The disk space assigned to new partitions (i.e. what was previously free space) is now\nerased. Specifically, all file system signatures are removed, and if the device supports\nit, the BLKDISCARD I/O control command is issued to inform the hardware that the space is\nnow empty. In addition any \"padding\" between partitions and at the end of the device is\nsimilarly erased.\n\n9. The new partition table is finally written to disk. The kernel is asked to reread the\npartition table.\n\nAs exception to the normally strictly incremental operation, when called in a special\n\"factory reset\" mode, systemd-repart may also be used to erase existing partitions to reset\nan installation back to vendor defaults. This mode of operation is used when either the\n--factory-reset=yes switch is passed on the tool's command line, or the\nsystemd.factoryreset=yes option specified on the kernel command line, or the FactoryReset\nEFI variable (vendor UUID 8cf2644b-4b0b-428f-9387-6d876050dc67) is set to \"yes\". It alters\nthe algorithm above slightly: between the 3rd and the 4th step above any partition marked\nexplicitly via the FactoryReset= boolean is deleted, and the algorithm restarted, thus\nimmediately re-creating these partitions anew empty.\n\nNote that systemd-repart by default only changes partition tables, it does not create or\nresize any file systems within these partitions, unless the Format= configuration option is\nspecified. Also note that there are also separate mechanisms available for this purpose, for\nexample systemd-growfs(8) and systemd-makefs.\n\nThe UUIDs identifying the new partitions created (or assigned to existing partitions that\nhave no UUID yet), as well as the disk as a whole are hashed cryptographically from a common\nseed value. This seed value is usually the machine-id(5) of the system, so that the machine\nID reproducibly determines the UUIDs assigned to all partitions. If the machine ID cannot be\nread (or the user passes --seed=random, see below) the seed is generated randomly instead, so\nthat the partition UUIDs are also effectively random. The seed value may also be set\nexplicitly, formatted as UUID via the --seed= option. By hashing these UUIDs from a common\nseed images prepared with this tool become reproducible and the result of the algorithm above\ndeterministic.\n\nThe positional argument should specify the block device to operate on. Instead of a block\ndevice node path a regular file may be specified too, in which case the command operates on\nit like it would if a loopback block device node was specified with the file attached. If\n--empty=create is specified the specified path is created as regular file, which is useful\nfor generating disk images from scratch.\n", "subsections": [] }, "OPTIONS": { "content": "The following options are understood:\n", "subsections": [ { "name": "--dry-run=", "content": "Takes a boolean. If this switch is not specified --dry-run=yes is the implied default.\nControls whether systemd-repart executes the requested re-partition operations or whether\nit should only show what it would do. Unless --dry-run=no is specified systemd-repart\nwill not actually touch the device's partition table.\n\nAdded in version 245.\n" }, { "name": "--empty=", "content": "Takes one of \"refuse\", \"allow\", \"require\", \"force\" or \"create\". Controls how to operate\non block devices that are entirely empty, i.e. carry no partition table/disk label yet.\nIf this switch is not specified the implied default is \"refuse\".\n\nIf \"refuse\" systemd-repart requires that the block device it shall operate on already\ncarries a partition table and refuses operation if none is found. If \"allow\" the command\nwill extend an existing partition table or create a new one if none exists. If \"require\"\nthe command will create a new partition table if none exists so far, and refuse operation\nif one already exists. If \"force\" it will create a fresh partition table unconditionally,\nerasing the disk fully in effect. If \"force\" no existing partitions will be taken into\naccount or survive the operation. Hence: use with care, this is a great way to lose all\nyour data. If \"create\" a new loopback file is create under the path passed via the device\nnode parameter, of the size indicated with --size=, see below.\n\nAdded in version 245.\n" }, { "name": "--discard=", "content": "Takes a boolean. If this switch is not specified --discard=yes is the implied default.\nControls whether to issue the BLKDISCARD I/O control command on the space taken up by any\nadded partitions or on the space in between them. Usually, it's a good idea to issue this\nrequest since it tells the underlying hardware that the covered blocks shall be\nconsidered empty, improving performance. If operating on a regular file instead of a\nblock device node, a sparse file is generated.\n\nAdded in version 245.\n" }, { "name": "--size=", "content": "Takes a size in bytes, using the usual K, M, G, T suffixes, or the special value \"auto\".\nIf used the specified device node path must refer to a regular file, which is then grown\nto the specified size if smaller, before any change is made to the partition table. If\nspecified as \"auto\" the minimal size for the disk image is automatically determined (i.e.\nthe minimal sizes of all partitions are summed up, taking space for additional metadata\ninto account). This switch is not supported if the specified node is a block device. This\nswitch has no effect if the file is already as large as the specified size or larger. The\nspecified size is implicitly rounded up to multiples of 4096. When used with\n--empty=create this specifies the initial size of the loopback file to create.\n\nThe --size=auto option takes the sizes of pre-existing partitions into account. However,\nit does not accommodate for partition tables that are not tightly packed: the configured\npartitions might still not fit into the backing device if empty space exists between\npre-existing partitions (or before the first partition) that cannot be fully filled by\npartitions to grow or create.\n\nAlso note that the automatic size determination does not take files or directories\nspecified with CopyFiles= into account: operation might fail if the specified files or\ndirectories require more disk space then the configured per-partition minimal size limit.\n\nAdded in version 246.\n" }, { "name": "--factory-reset=", "content": "Takes boolean. If this switch is not specified --factory=reset=no is the implied default.\nControls whether to operate in \"factory reset\" mode, see above. If set to true this will\nremove all existing partitions marked with FactoryReset= set to yes early while executing\nthe re-partitioning algorithm. Use with care, this is a great way to lose all your data.\nNote that partition files need to explicitly turn FactoryReset= on, as the option\ndefaults to off. If no partitions are marked for factory reset this switch has no effect.\nNote that there are two other methods to request factory reset operation: via the kernel\ncommand line and via an EFI variable, see above.\n\nAdded in version 245.\n" }, { "name": "--can-factory-reset", "content": "If this switch is specified the disk is not re-partitioned. Instead it is determined if\nany existing partitions are marked with FactoryReset=. If there are the tool will exit\nwith exit status zero, otherwise non-zero. This switch may be used to quickly determine\nwhether the running system supports a factory reset mechanism built on systemd-repart.\n\nAdded in version 245.\n", "long": "--can-factory-reset" }, { "name": "--root=", "content": "Takes a path to a directory to use as root file system when searching for repart.d/*.conf\nfiles, for the machine ID file to use as seed and for the CopyFiles= and CopyBlocks=\nsource files and directories. By default when invoked on the regular system this defaults\nto the host's root file system /. If invoked from the initrd this defaults to /sysroot/,\nso that the tool operates on the configuration and machine ID stored in the root file\nsystem later transitioned into itself.\n\nSee --copy-source= for a more restricted option that only affects CopyFiles=.\n\nAdded in version 245.\n" }, { "name": "--image=", "content": "Takes a path to a disk image file or device to mount and use in a similar fashion to\n--root=, see above.\n\nAdded in version 249.\n\n--image-policy=policy\nTakes an image policy string as argument, as per systemd.image-policy(7). The policy is\nenforced when operating on the disk image specified via --image=, see above. If not\nspecified defaults to the \"*\" policy, i.e. all recognized file systems in the image are\nused.\n" }, { "name": "--seed=", "content": "Takes a UUID as argument or the special value random. If a UUID is specified the UUIDs to\nassign to partitions and the partition table itself are derived via cryptographic hashing\nfrom it. If not specified it is attempted to read the machine ID from the host (or more\nprecisely, the root directory configured via --root=) and use it as seed instead, falling\nback to a randomized seed otherwise. Use --seed=random to force a randomized seed.\nExplicitly specifying the seed may be used to generated strictly reproducible partition\ntables.\n\nAdded in version 245.\n" }, { "name": "--pretty=", "content": "Takes a boolean argument. If this switch is not specified, it defaults to on when called\nfrom an interactive terminal and off otherwise. Controls whether to show a user friendly\ntable and graphic illustrating the changes applied.\n\nAdded in version 245.\n" }, { "name": "--definitions=", "content": "Takes a file system path. If specified the *.conf files are read from the specified\ndirectory instead of searching in /usr/lib/repart.d/*.conf, /etc/repart.d/*.conf,\n/run/repart.d/*.conf.\n\nThis parameter can be specified multiple times.\n\nAdded in version 245.\n" }, { "name": "--key-file=", "content": "Takes a file system path. Configures the encryption key to use when setting up LUKS2\nvolumes configured with the Encrypt=key-file setting in partition files. Should refer to\na regular file containing the key, or an AFUNIX stream socket in the file system. In the\nlatter case a connection is made to it and the key read from it. If this switch is not\nspecified the empty key (i.e. zero length key) is used. This behaviour is useful for\nsetting up encrypted partitions during early first boot that receive their user-supplied\npassword only in a later setup step.\n\nAdded in version 247.\n" }, { "name": "--private-key=", "content": "Takes a file system path. Configures the signing key to use when creating verity\nsignature partitions with the Verity=signature setting in partition files.\n\nAdded in version 252.\n" }, { "name": "--certificate=", "content": "Takes a file system path. Configures the PEM encoded X.509 certificate to use when\ncreating verity signature partitions with the Verity=signature setting in partition\nfiles.\n\nAdded in version 252.\n\n--tpm2-device=, --tpm2-pcrs=\nConfigures the TPM2 device and list of PCRs to use for LUKS2 volumes configured with the\nEncrypt=tpm2 option. These options take the same parameters as the identically named\noptions to systemd-cryptenroll(1) and have the same effect on partitions where TPM2\nenrollment is requested.\n\nAdded in version 248.\n\n--tpm2-device-key= [PATH], --tpm2-seal-key-handle= [HANDLE]\nConfigures a TPM2 SRK key to bind encryption to. See systemd-cryptenroll(1) for details\non this option.\n\nAdded in version 255.\n\n--tpm2-public-key= [PATH], --tpm2-public-key-pcrs= [PCR...]\nConfigures a TPM2 signed PCR policy to bind encryption to. See systemd-cryptenroll(1) for\ndetails on these two options.\n\nAdded in version 252.\n\n--tpm2-pcrlock= [PATH]\nConfigures a TPM2 pcrlock policy to bind encryption to. See systemd-cryptenroll(1) for\ndetails on this option.\n\nAdded in version 255.\n\n--split= [BOOL]\nEnables generation of split artifacts from partitions configured with SplitName=. If\nenabled, for each partition with SplitName= set, a separate output file containing just\nthe contents of that partition is generated. The output filename consists of the loopback\nfilename suffixed with the name configured with SplitName=. If the loopback filename ends\nwith \".raw\", the suffix is inserted before the \".raw\" extension instead.\n\nNote that --split is independent from --dry-run. Even if --dry-run is enabled, split\nartifacts will still be generated from an existing image if --split is enabled.\n\nAdded in version 252.\n\n--include-partitions= [PARTITION...], --exclude-partitions= [PARTITION...]\nThese options specify which partition types systemd-repart should operate on. If\n--include-partitions= is used, all partitions that aren't specified are excluded. If\n--exclude-partitions= is used, all partitions that are specified are excluded. Both\noptions take a comma separated list of GPT partition type UUIDs or identifiers (see Type=\nin repart.d(5)).\n\nAdded in version 253.\n\n--defer-partitions= [PARTITION...]\nThis option specifies for which partition types systemd-repart should defer. All\npartitions that are deferred using this option are still taken into account when\ncalculating the sizes and offsets of other partitions, but aren't actually written to the\ndisk image. The net effect of this option is that if you run systemd-repart again without\nthis option, the missing partitions will be added as if they had not been deferred the\nfirst time systemd-repart was executed.\n\nAdded in version 253.\n\n--sector-size= [BYTES]\nThis option allows configuring the sector size of the image produced by systemd-repart.\nIt takes a value that is a power of \"2\" between \"512\" and \"4096\". This option is useful\nwhen building images for disks that use a different sector size as the disk on which the\nimage is produced.\n\nAdded in version 253.\n\n--architecture= [ARCH]\nThis option allows overriding the architecture used for architecture specific partition\ntypes. For example, if set to \"arm64\" a partition type of \"root-x86-64\" referenced in\nrepart.d/ drop-ins will be patched dynamically to refer to \"root-arm64\" instead. Takes\none of \"alpha\", \"arc\", \"arm\", \"arm64\", \"ia64\", \"loongarch64\", \"mips-le\", \"mips64-le\",\n\"parisc\", \"ppc\", \"ppc64\", \"ppc64-le\", \"riscv32\", \"riscv64\", \"s390\", \"s390x\", \"tilegx\",\n\"x86\" or \"x86-64\".\n\nAdded in version 254.\n\n--offline= [BOOL]\nInstructs systemd-repart to build the image offline. Takes a boolean or \"auto\". Defaults\nto \"auto\". If enabled, the image is built without using loop devices. This is useful to\nbuild images unprivileged or when loop devices are not available. If disabled, the image\nis always built using loop devices. If \"auto\", systemd-repart will build the image online\nif possible and fall back to building the image offline if loop devices are not available\nor cannot be accessed due to missing permissions.\n\nAdded in version 254.\n\n--copy-from= [IMAGE]\nInstructs systemd-repart to synthesize partition definitions from the partition table in\nthe given image. This option can be specified multiple times to synthesize definitions\nfrom each of the given images. The generated definitions will copy the partitions into\nthe destination partition table. The copied partitions will have the same size, metadata\nand contents but might have a different partition number and might be located at a\ndifferent offset in the destination partition table. These definitions can be combined\nwith partition definitions read from regular partition definition files. The synthesized\ndefinitions take precedence over the definitions read from partition definition files.\n\nAdded in version 255.\n\n--copy-source=PATH, -s PATH\nSpecifies a source directory all CopyFiles= source paths shall be considered relative to.\nThis is similar to --root=, but exclusively applies to the CopyFiles= setting. If --root=\nand --copy-source= are used in combination the former applies as usual, except for\nCopyFiles= where the latter takes precedence.\n\nAdded in version 255.\n\n--make-ddi=TYPE\nTakes one of \"sysext\", \"confext\" or \"portable\". Generates a Discoverable Disk Image (DDI)\nfor a system extension (sysext, see systemd-sysext(8) for details), configuration\nextension (confext) or portable service[1]. The generated image will consist of a signed\nVerity \"erofs\" file system as root partition. In this mode of operation the partition\ndefinitions in /usr/lib/repart.d/*.conf and related directories are not read, and\n--definitions= is not supported, as appropriate definitions for the selected DDI class\nwill be chosen automatically.\n\nMust be used in conjunction with --copy-source= to specify the file hierarchy to populate\nthe DDI with. The specified directory should contain an etc/ subdirectory if \"confext\" is\nselected. If \"sysext\" is selected it should contain either a usr/ or opt/ directory, or\nboth. If \"portable\" is used a full OS file hierarchy can be provided.\n\nThis option implies --empty=create, --size=auto and --seed=random (the latter two can be\noverridden).\n\nThe private key and certificate for signing the DDI must be specified via the\n--private-key= and --certificate= switches.\n\nAdded in version 255.\n" }, { "name": "-S -C -P", "content": "Shortcuts for --make-ddi=sysext, --make-ddi=confext, --make-ddi=portable, respectively.\n\nAdded in version 255.\n", "flag": "-P" }, { "name": "-h --help", "content": "Print a short help text and exit.\n", "flag": "-h", "long": "--help" }, { "name": "--version", "content": "Print a short version string and exit.\n", "long": "--version" }, { "name": "--no-pager", "content": "Do not pipe output into a pager.\n", "long": "--no-pager" }, { "name": "--no-legend", "content": "Do not print the legend, i.e. column headers and the footer with hints.\n\n--json=MODE\nShows output formatted as JSON. Expects one of \"short\" (for the shortest possible output\nwithout any redundant whitespace or line breaks), \"pretty\" (for a pretty version of the\nsame, with indentation and line breaks) or \"off\" (to turn off JSON output, the default).\n", "long": "--no-legend" } ] }, "EXIT STATUS": { "content": "On success, 0 is returned, a non-zero failure code otherwise.\n", "subsections": [] }, "EXAMPLE": { "content": "", "subsections": [ { "name": "Example 1. Generate a configuration extension image", "content": "The following creates a configuration extension DDI (confext) for an /etc/motd update.\n\nmkdir tree tree/etc tree/etc/extension-release.d\necho \"Hello World\" > tree/etc/motd\ncat > tree/etc/extension-release.d/extension-release.my-motd < tree/etc/motd", "cat > tree/etc/extension-release.d/extension-release.my-motd <