netboot.xyz - Network Boot and PXE Server

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## netboot.xyz - Self-Hosted Network Boot Server

netboot.xyz is an open-source network boot toolkit that pairs an iPXE bootloader with a curated, continuously maintained menu tree covering well over a hundred operating systems and utilities. Machines on your network power on and boot straight into a live desktop, a rescue shell, a disk utility, or a full OS installer - entirely over the network, without carrying a USB stick to the rack.

This AMI delivers the official netboot.xyz 3.0.2 local instance packaged natively with real systemd services and no container layer, ready to serve boot menus within minutes of launch.

## What This Is (and What It Is Not)

This is a self-hosted boot menu and asset server for machines that can reach it on the network: a lab, an on-premises network connected over VPN or AWS Direct Connect, or other instances in the same VPC. You point a client machine's network boot (or your DHCP server's next-server option) at this instance and it serves the iPXE menu over TFTP and HTTP.

It is not a way to PXE-boot arbitrary hosts across the public internet. TFTP over the open internet is unusual and boot clients cannot authenticate, so the boot plane is meant to run on a network you control.

Running your own instance means:

• Your machines boot from infrastructure you control
• They keep working when your internet link does not
• You can mirror images locally so provisioning runs at LAN speed instead of pulling gigabytes from the internet for every machine

## Two Planes, Two Security Postures

Management plane (authenticated): The netboot.xyz web admin UI decides what your machines boot. Upstream ships this UI with no login of its own, so this image binds it to the loopback interface, fronts it with an authenticating reverse proxy, and generates a fresh admin password unique to each instance on first boot - written to a root-only file. No shared or default credential exists anywhere in the image.

Boot plane (anonymous): TFTP on 69/udp plus menus and mirrored assets over HTTP. A machine powering on has no way to present credentials, so scope the boot plane to your own subnets with the instance security group.

## Application Stack

• nginx fronts the stack on port 80
• Node.js admin app bound to loopback behind HTTP Basic Auth
• dnsmasq-based TFTP serves boot files on 69/udp
• Health endpoint answers anonymously for load-balancer and uptime checks

Every upstream artifact - the menu tree, boot loaders, endpoints file, and admin application - is verified against a pinned checksum at build time. The image is hardened and fully patched.

## Getting Started

1. Launch the instance in your VPC

2. Read the per-instance admin password from the credentials file over SSH

3. Open the admin UI in a browser to browse the menu tree, add local menu overrides, and mirror installer images

4. Point a client's network boot at the instance - the menu appears

For a detailed walkthrough including recommended security-group rules (TFTP 69/udp and HTTP 80/tcp scoped to internal subnets), see the paired deploy guide.

## Use Cases

• Lab and data-centre provisioning: A private network boot server for bare metal and virtual machines, eliminating hand-carried media
• Rescue and diagnostics on tap: An always-available environment with disk utilities, memory testers, and recovery shells for technicians
• Local mirror for repeatable installs: Mirror ISO images locally so network installs run at LAN speed across many machines

## Open-Source Community

netboot.xyz is a well-established open-source project with an active contributor community. This AMI packages the upstream release as a production-ready appliance so you benefit from community-driven updates without maintaining the build pipeline yourself.

## cloudimg Support

24/7 technical support by email and chat. Our engineers help with deployment, scoping the boot plane with security groups, connecting on-premises networks over VPN or Direct Connect, mirroring assets, and upgrade planning.

All product and company names are trademarks or registered trademarks of their respective holders. netboot.xyz is published under the Apache License 2.0. Use of the name identifies the software and does not imply affiliation with or endorsement by the netboot.xyz project.