Recommended /boot partition size for Lanzaboote

Help
1

I want to install Lanzaboote to enable Secure Boot, however the README says:

The downside of systemd-stub is that it requires the kernel and initrd to be packed into the UKI, which makes it pretty large. As we need one UKI per NixOS configuration, systems with many configurations quickly run out of the limited disk space in the ESP.

Currently, I have the following in /boot/EFI/nixos, which means I can comfortably fit around ten initrds in the 512M partition:

-rwxr-xr-x 1 root root  34M Jul 20 20:59 yxjz6vs4qi7kc6h0b13mrvq3077wp6yr-initrd-linux-6.4.3-initrd.efi
-rwxr-xr-x 1 root root  34M Jul 20 20:59 dazz2lk6xs9vwxc4i4i19g9p2z3ig78c-initrd-linux-6.4.2-initrd.efi
-rwxr-xr-x 1 root root  34M Jul 20 20:59 gc58cz9zsm50q6k8wlhfb9jddbl99r4j-initrd-linux-6.4.3-initrd.efi
-rwxr-xr-x 1 root root  28M Jul 20 20:59 0kcmbm7v0sn89j67mvnrn43n0yvhshr9-initrd-linux-6.4-initrd.efi
-rwxr-xr-x 1 root root  28M Jul 20 20:59 hz52li4dgm79cjzz00hfm7p86ifwm9fi-initrd-linux-6.4.1-initrd.efi
-rwxr-xr-x 1 root root  28M Jul 20 20:59 pi32xq1zjv2ikycvj6b8717ya586k8r7-initrd-linux-6.3.9-initrd.efi
-rwxr-xr-x 1 root root 9.6M Jul 20 20:59 wyfm45xz5m6wc552fb95sbb89m2a715v-linux-6.4.2-bzImage.efi
-rwxr-xr-x 1 root root 9.6M Jul 20 20:59 cdc691fy6qkswsv0m2d3f9cranw9yi6y-linux-6.4.3-bzImage.efi
-rwxr-xr-x 1 root root 9.6M Jul 20 20:59 k573myj5qjp5s36jb9vw3lmr957jmpwz-linux-6.4.3-bzImage.efi
-rwxr-xr-x 1 root root 9.6M Jul 20 20:59 n46z891rpl7nr1z8zn3qh6rr4ds0567c-linux-6.4.1-bzImage.efi
-rwxr-xr-x 1 root root 9.6M Jul 20 20:59 figbdbi0l5awrgiw83limrfydvk1n73x-linux-6.4-bzImage.efi
-rwxr-xr-x 1 root root 9.5M Jul 20 20:59 y4g3an18rsa9svip7kyjj649pmsc1nvz-linux-6.3.9-bzImage.efi

How does the size of the apps increase when using Lanzaboote? How big should I make the /boot partition if I want to be able to fit similar number of NixOS generations?

2

It’s pretty close to exactly the same, with one extra caveat: You need about 100K for the stub for every individual generation.

3

The comparison, at least for me, was between:

  • grub, with a tiny ESP that pretty much just held grub, with kernels and initrd’s in a separate boot partition
  • systemd-boot and lanzaboote, where everything moved to the ESP.

In my case it was pretty easy, I just got rid of the zfs bpool and remade the ESP over the combined space of both. It would have been a little more complex if I’d made partitions in a different order originally.

4

Honestly, 512MiB has worked for me fine.