Three Single-Boot Arch Variants: Btrfs, LUKS, or Both

arch linux

linux

installation

btrfs

luks

snapper

grub

mkinitcpio

zram

single-boot

Three complete, standalone single-boot Arch Linux install procedures: Arch + Btrfs subvolumes (no encryption), Arch + LUKS (no Btrfs), and Arch + LUKS + Btrfs (snapshot-ready encrypted single-boot). Use the tab switcher to pick the variant you want. Each tab is fully self-contained, ISO verification through first-boot reboot, so you never have to leave the tab you picked or cross-reference another article.

Author

Evanns Morales

Published

May 18, 2026

If something doesn’t work, go to the source

These three procedures are reasoned, copy-pasteable runbooks, but disks, firmware, and package versions vary, and the moment something doesn’t match what you see on screen, the canonical references beat any blog. Keep these open in another tab while you install:

mkinitcpio — initramfs hook configuration
cryptsetup — LUKS container management
btrfs — subvolumes, snapshots, mount options
Arch wiki: Installation guide — the master checklist
Arch wiki: dm-crypt/Encrypting an entire system — the LUKS variants
Arch wiki: Btrfs — the Btrfs variants

If a command’s output diverges from what a step says to expect, stop and reconcile it against the wiki before pressing on, that’s the difference between a clean install and an afternoon in emergency mode.

How to use this article

Pick the tab that matches the install you want:

Arch + Btrfs — a plain (unencrypted) install whose root is Btrfs with snapper-ready subvolumes, so you get bootable snapshots and rollback after a bad upgrade.
Arch + LUKS — a plain ext4 install with the whole root wrapped in a LUKS2 container, so the data is encrypted at rest behind a boot-time passphrase.
Arch + LUKS + Btrfs — both: an encrypted root and Btrfs subvolumes, with zram for everyday swap and a NoCOW swap file for hibernation.

Each tab is fully self-contained: it walks you from verifying the ISO all the way to the first-boot check, with every command in between. You never have to jump to another article or another tab, so there’s deliberate repetition between the tabs, that’s the point. All three assume a UEFI machine and a single NVMe disk (/dev/nvme0n1); substitute your own device path everywhere it appears.

A plain, unencrypted Arch install whose root filesystem is Btrfs with proper subvolumes instead of ext4. That buys you bootable snapshots via snapper + grub-btrfs, copy-on-write compression (compress=zstd:3), and the ability to roll the whole system back to a known-good state after a bad upgrade, with no passphrase prompt at boot.

Verify the ISO, then boot the live USB

On a machine you trust, grab the ISO, its .sig, and sha256sums.txt from the Arch download page, then verify both the checksum and the signature:

cd ~/Downloads/Arch
sha256sum -c sha256sums.txt        # expect: archlinux-…-x86_64.iso: OK
gpg --auto-key-locate clear,wkd -v --locate-external-key pierre@archlinux.org
gpg --verify archlinux-2026.05.01-x86_64.iso.sig archlinux-2026.05.01-x86_64.iso
# expect: Good signature from "Pierre Schmitz <pierre@archlinux.org>"

The “key’s User ID is not certified” warning is expected for a one-off personal install, the signature itself is still valid. Flash the ISO to a USB stick (balenaEtcher, or dd if you’re careful with of=), boot the target machine from it, and pick the default install entry. Confirm you booted in UEFI mode:

cat /sys/firmware/efi/fw_platform_size   # 64 (or 32 on old hardware); a missing file means BIOS mode

Get online and sync the clock

iwctl                 # then inside: station wlan0 connect "My SSID"   (skip if you're on wired DHCP)
ping -c 5 ping.archlinux.org
timedatectl set-ntp true
loadkeys us
timedatectl set-timezone America/New_York   # substitute your zone

Identify the disk you’re about to wipe, these examples use /dev/nvme0n1:

lsblk

Partition layout

Three partitions, the root partition will hold Btrfs subvolumes:

Partition	Size	Filesystem	Mount	Purpose
`p1`	1 GiB	FAT32	`/boot`	UEFI EFI System Partition
`p2`	8 GiB	swap	`[SWAP]`	Swap (no zram in this variant; add it later if you want)
`p3`	rest	Btrfs	`/`, `/home`, `/.snapshots`, `/var/log`	Root with subvolumes

cfdisk /dev/nvme0n1

Inside cfdisk, move with ↑/↓ (or vim j/k) and Enter to choose. Press d on every existing partition to delete it (nothing is committed until w), then n to create each new one. Every partition starts as Linux filesystem; to change the type press t and pick from the list:

1 GiB, then t → EFI System
8 GiB, then t → Linux swap
remainder, leave as Linux filesystem (default)

Press w, type yes, then format:

mkfs.fat -F32 /dev/nvme0n1p1
mkswap /dev/nvme0n1p2
mkfs.btrfs -L arch /dev/nvme0n1p3

Create subvolumes

mount /dev/nvme0n1p3 /mnt
btrfs subvolume create /mnt/@
btrfs subvolume create /mnt/@home
btrfs subvolume create /mnt/@snapshots
btrfs subvolume create /mnt/@var_log
umount /mnt

The four-subvolume layout is the snapper-friendly standard: @ is root, @home is /home, @snapshots holds the snapshots themselves (must be a subvolume, not a directory, so snapper can roll back without recursive trouble), and @var_log keeps logs out of any root snapshots you take.

Mount subvolumes with the right options

mount -o subvol=@,compress=zstd:3,noatime /dev/nvme0n1p3 /mnt
mkdir -p /mnt/{boot,home,.snapshots,var/log}
mount -o subvol=@home,compress=zstd:3,noatime      /dev/nvme0n1p3 /mnt/home
mount -o subvol=@snapshots,compress=zstd:3,noatime /dev/nvme0n1p3 /mnt/.snapshots
mount -o subvol=@var_log,compress=zstd:3,noatime   /dev/nvme0n1p3 /mnt/var/log
mount /dev/nvme0n1p1 /mnt/boot
swapon /dev/nvme0n1p2

compress=zstd:3 is the level the Arch wiki recommends, good ratio, low CPU. noatime prevents needless metadata churn on every read.

Pacstrap + fstab

pacstrap -K /mnt base base-devel linux linux-firmware linux-headers \
  btrfs-progs grub efibootmgr networkmanager \
  vim nano sudo git man-db man-pages texinfo intel-ucode
genfstab -U /mnt >> /mnt/etc/fstab

The Btrfs-specific package is btrfs-progs. Swap intel-ucode for amd-ucode on an AMD CPU. genfstab -U detects the subvolume mount options correctly and emits four subvol=@… lines plus the EFI and swap entries. Sanity-check:

grep -E 'subvol=|UUID=' /mnt/etc/fstab   # expect four subvol=@… lines with compress=zstd:3,noatime

Inside the chroot — base config

arch-chroot /mnt

Set locale, time, hostname, root password, and your user:

ln -sf /usr/share/zoneinfo/America/New_York /etc/localtime   # substitute your zone
hwclock --systohc

sed -i 's/^#en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' /etc/locale.gen   # or edit by hand
locale-gen
echo "LANG=en_US.UTF-8" > /etc/locale.conf
echo "KEYMAP=us" > /etc/vconsole.conf

echo "archbox" > /etc/hostname            # substitute your hostname

passwd                                    # root password
useradd -m -g users -G wheel user         # substitute your username
passwd user

EDITOR=vim visudo                         # uncomment:  %wheel ALL=(ALL:ALL) ALL
systemctl enable NetworkManager

`mkinitcpio` and GRUB

/etc/mkinitcpio.conf needs btrfs added so the initramfs can mount a Btrfs root:

BINARIES=(btrfs)
HOOKS=(base udev autodetect microcode modconf kms keyboard keymap consolefont block filesystems fsck)

The default HOOKS= line already covers a Btrfs root, no encryption hook is needed because there’s no LUKS layer. Rebuild:

mkinitcpio -P

GRUB on a Btrfs root needs no kernel-cmdline changes vs. a plain ext4 install, Btrfs is detected and mounted automatically from the root device’s UUID:

grub-install --target=x86_64-efi --efi-directory=/boot --bootloader-id=GRUB
grub-mkconfig -o /boot/grub/grub.cfg

Snapper + grub-btrfs (the payoff)

Still inside the chroot:

pacman -S snapper grub-btrfs snap-pac
snapper -c root create-config /
systemctl enable snapper-timeline.timer snapper-cleanup.timer
systemctl enable grub-btrfsd.service

snap-pac is the pacman hook that takes pre+post snapshots around every pacman transaction, so every pacman -Syu is reversible. grub-btrfsd watches @snapshots and rebuilds the GRUB menu so you can boot into a snapshot.

Verify, exit, reboot

exit                          # leave chroot
umount -R /mnt
swapoff -a
reboot

After first boot:

findmnt -t btrfs -o TARGET,SOURCE,OPTIONS
# expect 4 rows: /, /home, /.snapshots, /var/log — all with subvol=@…,compress=zstd:3
sudo snapper -c root list
# expect at least the post-install snapshot

If both look right, the variant is working as designed.

A plain ext4 install whose root partition is wrapped in a LUKS2 container, so the data on disk is encrypted at rest. A boot-time passphrase prompt is the only addition to the user-visible flow, no Btrfs, no subvolumes, no snapshots.

Verify the ISO, then boot the live USB

On a machine you trust, grab the ISO, its .sig, and sha256sums.txt from the Arch download page, then verify both the checksum and the signature:

cd ~/Downloads/Arch
sha256sum -c sha256sums.txt        # expect: archlinux-…-x86_64.iso: OK
gpg --auto-key-locate clear,wkd -v --locate-external-key pierre@archlinux.org
gpg --verify archlinux-2026.05.01-x86_64.iso.sig archlinux-2026.05.01-x86_64.iso
# expect: Good signature from "Pierre Schmitz <pierre@archlinux.org>"

cat /sys/firmware/efi/fw_platform_size   # 64 (or 32 on old hardware); a missing file means BIOS mode

Get online and sync the clock

iwctl                 # then inside: station wlan0 connect "My SSID"   (skip if you're on wired DHCP)
ping -c 5 ping.archlinux.org
timedatectl set-ntp true
loadkeys us
timedatectl set-timezone America/New_York   # substitute your zone

Identify the disk you’re about to wipe, these examples use /dev/nvme0n1:

lsblk

Partition layout

The root partition is a LUKS container, not a raw filesystem:

Partition	Size	Filesystem	Mount	Purpose
`p1`	1 GiB	FAT32	`/boot`	UEFI ESP (must stay unencrypted — GRUB has to read it)
`p2`	8 GiB	swap	`[SWAP]`	Plain swap (no hibernation; see note)
`p3`	rest	LUKS2 → ext4	`/`	Encrypted root

Two notes on the swap partition:

This variant assumes an unencrypted plain swap partition, swap-only, no hibernation. If you want hibernation-safe encrypted swap, the clean pattern is a NoCOW swap file inside the encrypted root, which is exactly what the Arch + LUKS + Btrfs tab on this page does, hop over there if hibernation matters to you.
The simplest 2026 pattern is to skip the swap partition entirely and use zram. If you’d rather do that, omit p2 below and add zram-generator after first boot.

Partition:

cfdisk /dev/nvme0n1

Inside cfdisk, move with ↑/↓ (or vim j/k) and Enter to choose. Press d on every existing partition, then n to create each new one; press t to set a type from the list:

1 GiB, then t → EFI System
8 GiB, then t → Linux swap
remainder, leave as Linux filesystem (it becomes the LUKS container)

Press w, type yes.

Format and open the LUKS container

Create the LUKS2 container on the root partition, then open it:

cryptsetup luksFormat --type luks2 /dev/nvme0n1p3
# Type YES, then enter a strong passphrase twice.
cryptsetup open /dev/nvme0n1p3 cryptroot

Now /dev/mapper/cryptroot is the unlocked block device. Format ext4 inside it (and the EFI + swap partitions outside it):

mkfs.fat -F32 /dev/nvme0n1p1
mkswap /dev/nvme0n1p2
mkfs.ext4 -L arch /dev/mapper/cryptroot

The mapper name cryptroot matters

You’ll reference this name three times: here in cryptsetup open, in the GRUB cmdline (rd.luks.name=…=cryptroot), and as /dev/mapper/cryptroot in the kernel root= parameter. They have to match exactly. A typo here is the most common reason the install boots into emergency mode.

Mount, pacstrap, fstab

mount /dev/mapper/cryptroot /mnt
mkdir -p /mnt/boot
mount /dev/nvme0n1p1 /mnt/boot
swapon /dev/nvme0n1p2

pacstrap -K /mnt base base-devel linux linux-firmware linux-headers \
  cryptsetup grub efibootmgr networkmanager \
  vim nano sudo git man-db man-pages texinfo intel-ucode

genfstab -U /mnt >> /mnt/etc/fstab

The LUKS-specific package is cryptsetup (so the running system can re-open the container after boot, even though the initramfs already opened it). Swap intel-ucode for amd-ucode on an AMD CPU. genfstab -U writes /dev/mapper/cryptroot as the root device using its UUID, that’s fine, the initramfs hook below does the actual unlocking.

Inside the chroot — base config

arch-chroot /mnt

Set locale, time, hostname, root password, and your user:

ln -sf /usr/share/zoneinfo/America/New_York /etc/localtime   # substitute your zone
hwclock --systohc

sed -i 's/^#en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' /etc/locale.gen   # or edit by hand
locale-gen
echo "LANG=en_US.UTF-8" > /etc/locale.conf
echo "KEYMAP=us" > /etc/vconsole.conf

echo "archbox" > /etc/hostname            # substitute your hostname

passwd                                    # root password
useradd -m -g users -G wheel user         # substitute your username
passwd user

EDITOR=vim visudo                         # uncomment:  %wheel ALL=(ALL:ALL) ALL
systemctl enable NetworkManager

`mkinitcpio`, GRUB cmdline, crypttab

The critical edit is /etc/mkinitcpio.conf. Pick one of two valid hook layouts (the modern systemd sd-encrypt path is recommended):

# Modern (systemd-based) — pairs with kernel cmdline rd.luks.name=…
HOOKS=(base systemd autodetect microcode modconf kms keyboard sd-vconsole block sd-encrypt filesystems fsck)

Or the legacy busybox path:

# Legacy (busybox-based) — pairs with kernel cmdline cryptdevice=…
HOOKS=(base udev autodetect microcode modconf kms keyboard keymap consolefont block encrypt filesystems fsck)

The two are equivalent in outcome but use different kernel cmdline syntax (below). Once chosen, rebuild:

mkinitcpio -P

Get the partition UUID of the LUKS container (not the mapper UUID):

blkid /dev/nvme0n1p3 -s UUID -o value      # this is <LUKS-UUID> below

For sd-encrypt, set the GRUB cmdline in /etc/default/grub:

GRUB_CMDLINE_LINUX_DEFAULT="quiet loglevel=3 rd.luks.name=<LUKS-UUID>=cryptroot root=/dev/mapper/cryptroot rw"

For the legacy encrypt hook instead:

GRUB_CMDLINE_LINUX_DEFAULT="quiet loglevel=3 cryptdevice=UUID=<LUKS-UUID>:cryptroot root=/dev/mapper/cryptroot rw"

GRUB_ENABLE_CRYPTODISK=y, when you need it

This setting tells GRUB itself to handle the LUKS prompt before the kernel even loads. It’s required only if you put /boot inside the LUKS container (rare). In this variant /boot is its own unencrypted FAT32 partition, so the kernel loads in cleartext, then prompts for LUKS to unlock the rootfs. No GRUB_ENABLE_CRYPTODISK=y is needed here, leave it commented out.

Install GRUB:

grub-install --target=x86_64-efi --efi-directory=/boot --bootloader-id=GRUB
grub-mkconfig -o /boot/grub/grub.cfg

If you used the sd-encrypt hook, an /etc/crypttab.initramfs entry makes the configuration discoverable post-install (optional but recommended):

# /etc/crypttab.initramfs
cryptroot UUID=<LUKS-UUID> none luks

Re-run mkinitcpio -P if you add it, so it’s copied into the initramfs.

Verify, exit, reboot

exit
umount -R /mnt
swapoff -a
cryptsetup close cryptroot
reboot

Expected boot sequence: GRUB menu → kernel loads → “Please enter passphrase for disk … (cryptroot):” → ext4 root mounts → login. After login:

sudo cryptsetup status cryptroot   # active LUKS2 mapping pointing at /dev/nvme0n1p3
lsblk -f                           # nvme0n1p3 = crypto_LUKS, mapper cryptroot = ext4 mounted at /

The full encrypted single-boot: LUKS2 underneath, Btrfs subvolumes on top, zram for everyday swap, a NoCOW Btrfs swap file for hibernation, and snapper + grub-btrfs from day one. It stops on the console, the desktop layer is your call (Hyprland, GNOME, Plasma, sway, dwm, …).

Verify the ISO, then boot the live USB

On a machine you trust, grab the ISO, its .sig, and sha256sums.txt from the Arch download page, then verify both the checksum and the signature:

cd ~/Downloads/Arch
sha256sum -c sha256sums.txt        # expect: archlinux-…-x86_64.iso: OK
gpg --auto-key-locate clear,wkd -v --locate-external-key pierre@archlinux.org
gpg --verify archlinux-2026.05.01-x86_64.iso.sig archlinux-2026.05.01-x86_64.iso
# expect: Good signature from "Pierre Schmitz <pierre@archlinux.org>"

cat /sys/firmware/efi/fw_platform_size   # 64 (or 32 on old hardware); a missing file means BIOS mode

Get online and sync the clock

iwctl                 # then inside: station wlan0 connect "My SSID"   (skip if you're on wired DHCP)
ping -c 5 ping.archlinux.org
timedatectl set-ntp true
loadkeys us
timedatectl set-timezone America/New_York   # substitute your zone

Identify the disk you’re about to wipe, these examples use /dev/nvme0n1:

lsblk

Partition layout

Just two partitions, no separate swap partition (zram + a NoCOW swap file inside @swap cover both everyday compression and hibernation):

Partition	Size	Filesystem	Mount	Purpose
`p1`	1 GiB	FAT32	`/boot`	UEFI ESP
`p2`	rest	LUKS2 → Btrfs	`/`, `/home`, `/.snapshots`, `/var/log`, `/swap`	Encrypted root with 5 subvolumes

Partition:

cfdisk /dev/nvme0n1

Inside cfdisk, move with ↑/↓ (or vim j/k) and Enter to choose. Press d on every existing partition, then n to create each new one; press t to set a type from the list:

1 GiB, then t → EFI System
remainder, leave as Linux filesystem (it becomes the LUKS container)

Press w, type yes.

Format, open, lay out subvolumes

mkfs.fat -F32 /dev/nvme0n1p1
cryptsetup luksFormat --type luks2 /dev/nvme0n1p2
cryptsetup open /dev/nvme0n1p2 cryptroot
mkfs.btrfs -L arch /dev/mapper/cryptroot

mount /dev/mapper/cryptroot /mnt
for sv in @ @home @snapshots @var_log @swap; do
  btrfs subvolume create "/mnt/$sv"
done
umount /mnt

Mount with the right options

mount -o subvol=@,compress=zstd:3,noatime /dev/mapper/cryptroot /mnt
mkdir -p /mnt/{boot,home,.snapshots,var/log,swap}
mount -o subvol=@home,compress=zstd:3,noatime      /dev/mapper/cryptroot /mnt/home
mount -o subvol=@snapshots,compress=zstd:3,noatime /dev/mapper/cryptroot /mnt/.snapshots
mount -o subvol=@var_log,compress=zstd:3,noatime   /dev/mapper/cryptroot /mnt/var/log
mount -o subvol=@swap,noatime                      /dev/mapper/cryptroot /mnt/swap
mount /dev/nvme0n1p1 /mnt/boot

@swap is mounted without compress, a swap file can’t live on a compressed subvolume.

Pacstrap + fstab

pacstrap -K /mnt base base-devel linux linux-firmware linux-headers \
  btrfs-progs cryptsetup grub efibootmgr networkmanager \
  snapper snap-pac grub-btrfs zram-generator \
  vim nano sudo git man-db man-pages texinfo intel-ucode

genfstab -U /mnt >> /mnt/etc/fstab

Swap intel-ucode for amd-ucode on an AMD CPU.

Inside the chroot — base config

arch-chroot /mnt

Set locale, time, hostname, root password, and your user:

ln -sf /usr/share/zoneinfo/America/New_York /etc/localtime   # substitute your zone
hwclock --systohc

sed -i 's/^#en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' /etc/locale.gen   # or edit by hand
locale-gen
echo "LANG=en_US.UTF-8" > /etc/locale.conf
echo "KEYMAP=us" > /etc/vconsole.conf

echo "archbox" > /etc/hostname            # substitute your hostname

passwd                                    # root password
useradd -m -g users -G wheel user         # substitute your username
passwd user

EDITOR=vim visudo                         # uncomment:  %wheel ALL=(ALL:ALL) ALL
systemctl enable NetworkManager

`mkinitcpio.conf`

BINARIES=(btrfs)
HOOKS=(base systemd autodetect microcode modconf kms keyboard sd-vconsole block sd-encrypt filesystems fsck)

mkinitcpio -P

Swap file for hibernation (NoCOW, inside `@swap`)

touch /swap/swapfile
chattr +C /swap/swapfile         # disable copy-on-write (required before any data is written)
chmod 600 /swap/swapfile
fallocate -l 20G /swap/swapfile  # size ≥ RAM for full hibernation
mkswap /swap/swapfile
# Don't `swapon` from inside the chroot — add the fstab entry instead:
echo "/swap/swapfile none swap defaults,pri=-2 0 0" >> /etc/fstab

Find the resume offset for hibernation:

btrfs inspect-internal map-swapfile -r /swap/swapfile
# Save the printed offset — paste it into the GRUB cmdline below as resume_offset=<OFFSET>.

`zram-generator` for everyday compressed swap

cat > /etc/systemd/zram-generator.conf <<'EOF'
[zram0]
zram-size = ram / 2
compression-algorithm = zstd
swap-priority = 100
EOF

zram comes up at boot at priority 100, higher than the swap file’s pri=-2, so the kernel uses zram first and falls through to the swap file only under memory pressure or hibernation.

GRUB

Get the partition UUID of the LUKS container:

blkid /dev/nvme0n1p2 -s UUID -o value      # this is <LUKS-UUID> below

Set the cmdline in /etc/default/grub (<OFFSET> is the number map-swapfile printed above):

GRUB_CMDLINE_LINUX_DEFAULT="quiet loglevel=3 rd.luks.name=<LUKS-UUID>=cryptroot root=/dev/mapper/cryptroot rootflags=subvol=@ rw resume=/dev/mapper/cryptroot resume_offset=<OFFSET>"

grub-install --target=x86_64-efi --efi-directory=/boot --bootloader-id=GRUB
grub-mkconfig -o /boot/grub/grub.cfg

snapper + grub-btrfs

snapper -c root create-config /
chown :wheel /.snapshots && chmod 750 /.snapshots
systemctl enable snapper-timeline.timer snapper-cleanup.timer
systemctl enable grub-btrfsd.service

snap-pac is already installed and active, it’ll start taking pre/post snapshots around every pacman transaction automatically.

Verify, exit, reboot

exit
umount -R /mnt
cryptsetup close cryptroot
reboot

Expected boot: GRUB → passphrase prompt → Btrfs root mounts → login. After login:

sudo cryptsetup status cryptroot           # LUKS2 mapping active
findmnt -t btrfs -o TARGET,SOURCE,OPTIONS  # five subvolumes mounted
swapon --show                              # zram0 priority 100, swap file priority -2
sudo snapper -c root list                  # at least the post-install snapshot
sudo systemctl hibernate                   # hibernation works (re-test after a few uses)

Next: pick a desktop layer

This tab leaves you with an encrypted, snapshot-able, hibernation-ready single-boot Arch system, on the console. The desktop is its own piece of work:

Path A → Custom Hyprland (upcoming)

A Hyprland setup picked piece by piece, your bar, your terminal, your keybinds, your theme, with no project-bundle layer on top. Slower to “first screenshot” but every component is one you chose. Dashed in the upcoming section on the Tech Zone landing.

Path B → Something else entirely

For GNOME, Plasma, sway, dwm, or anything else, install the relevant gnome / plasma / sway / dwm group with pacman. The install layer this tab leaves you with is desktop-agnostic, nothing about the LUKS+Btrfs+snapper stack assumes a particular compositor.

Why one article with three tabs?

These three procedures share most of their steps, ISO verification, partitioning mechanics, the base-system config inside the chroot, and differ only in the parts a reader choosing between them most wants to compare: the formatting step, the subvolume layout, the mkinitcpio hooks, the GRUB cmdline. A tab switcher puts those differences a single click apart, while keeping each tab a complete, copy-pasteable run from start to finish.

If you’d rather have a variant as its own standalone file, each tab is already self-contained, copy a tab’s content into a new article and it still makes sense end to end.

How to use this article

Verify the ISO, then boot the live USB

Get online and sync the clock

Partition layout

Create subvolumes

Mount subvolumes with the right options

Pacstrap + fstab

Inside the chroot — base config

mkinitcpio and GRUB

Snapper + grub-btrfs (the payoff)

Verify, exit, reboot

Verify the ISO, then boot the live USB

Get online and sync the clock

Partition layout

Format and open the LUKS container

Mount, pacstrap, fstab

Inside the chroot — base config

mkinitcpio, GRUB cmdline, crypttab

Verify, exit, reboot

Verify the ISO, then boot the live USB

Get online and sync the clock

Partition layout

Format, open, lay out subvolumes

Mount with the right options

Pacstrap + fstab

Inside the chroot — base config

mkinitcpio.conf

Swap file for hibernation (NoCOW, inside @swap)

zram-generator for everyday compressed swap

GRUB

snapper + grub-btrfs

Verify, exit, reboot

Next: pick a desktop layer

Why one article with three tabs?

`mkinitcpio` and GRUB

`mkinitcpio`, GRUB cmdline, crypttab

`mkinitcpio.conf`

Swap file for hibernation (NoCOW, inside `@swap`)

`zram-generator` for everyday compressed swap