# Experimental Debian cloud images transition to mkosi and Btrfs

> **Key takeaway:** A new experimental approach replaces Debian's FAI-based cloud image tooling with a declarative mkosi-based workflow using Btrfs and systemd-boot.

**Published:** 2026-11-10T07:00:00+00:00 
**Source:** Planet Debian (Developer Blogs) 
**Category:** distro-planet 
**Canonical URL:** https://fosswire.org/news/experimental-debian-cloud-images-transition-to-mkosi-and-btr.html 

## Summary
A developer has launched an experimental project to modernize how Debian cloud and VM images are constructed. The current official method uses the debian-cloud-images utility and Fully Automatic Installation (FAI) to generate images for providers like AWS, Azure, and GCP. This new implementation seeks to replace that workflow with mkosi, a tool that allows for fully declarative image builds using INI-format configuration files.

The experiment focuses on moving away from legacy BIOS/MBR support in favor of a pure UEFI architecture. By utilizing systemd-boot and Unified Kernel Images (UKIs), the project aims to reduce the complexity associated with GRUB2. The initial phase has successfully verified functional parity with official Debian Trixie profiles for generic cloud environments.

## Technical architecture and roadmap
- **Filesystem and Compression:** The implementation adopts Btrfs as the root filesystem to enable transparent zstd:1 compression, subvolumes, and snapshot-based atomic rollbacks.
- **Bootloader Modernization:** The project replaces GRUB2 with systemd-boot and Unified Kernel Images (UKIs), intentionally dropping legacy BIOS/CSM support to streamline cloud-native UEFI environments.
- **Declarative Build Process:** Using mkosi and the Antigravity (agy) tool, the build process is converted into modular profiles that minimize the need for manual post-installation shell scripts.
- **Future Immutability Roadmap:** Planned development phases include implementing dm-verity for immutable images, integrating Secure Boot with signed UKIs, and using systemd-sysext to decouple cloud vendor agents into separate system extensions.

## Why it matters
If adopted, this shift could provide Debian cloud users with more reliable, atomic OS upgrades via Btrfs snapshots and improved security through dm-verity and signed UKIs. It also offers a blueprint for using declarative tooling to build consistent images for both cloud environments and bare-metal hardware.