Gola Bootlace: Install Any Operating System Over the Network, No USB Stick Needed
Date Published
Gola Bootlace is a free, open-source program that turns a folder of ISO files into a boot menu for every PC on your network. Plug a PC into the network cable, choose "boot from network", pick Windows 11, Ubuntu or a rescue tool from the menu, and it starts. No USB stick, and no drawer full of them. It is for technicians, workshops, offices and home labs that install or repair many PCs.
Gola uses Bootlace internally for its own installations. It is free and open source, and it is still young (before version 1.0): we are looking for testers and contributors. You will find how to help at the end of this post.
Why we built it
Installing and repairing computers is our daily work, so we know the USB stick routine well: find the right stick, find out it holds last year's Windows, rewrite it, wait, plug it in, wait again. Do that for twenty PCs and ten different systems and you end up with a drawer of sticks, half of them out of date.
Booting from the network is the old fix, and every modern PC supports it. What we wanted was a version a workshop technician can run without being a network engineer: drop ISO files in a folder, see them in a menu, start them exactly as they are. We could not find a single program that does that for Windows and Linux alike, so we wrote it, and we are releasing it as open source so that anyone who installs PCs can use it, check it and improve it.
Where the name comes from
A bootlace fastens a boot, and a PC "boots" when it starts. Bootlace laces up a computer's start-up over the network: the PC pulls on the lace and the system comes up, with no USB stick.
Our tools are named after textile crafts, weaving and sewing, which are living crafts in Tunisia. NTLoom is the loom, Shuttle is the part of the loom that carries the thread across, Stitch joins the pieces into one garment, Bootlace laces up a computer's start-up over the network, Bobbin is the spool that holds several threads at once, so one USB stick carries several installers, and Kit is the technician's toolkit.
What makes it different
• One folder instead of a drawer. Add an ISO by copying the file in, remove it by deleting the file. Nothing is unpacked, edited or written to the PC's disks: the ISO starts as it is.
• Windows and Linux in the same menu. Windows 10, 11 and Server install straight from the network; most Linux installers, live systems and rescue tools start from the same list, on UEFI and older BIOS PCs alike.
• Nothing to change on the router. Bootlace answers only PCs that ask to network-boot and leaves the network's own DHCP server alone. Stop the program and nothing is left behind on the PCs.
• Secure Boot is built in. The signed boot files travel inside the program: nothing to download and no key to enrol in any PC. Windows and Ubuntu also have a route through the firmware's own boot manager.
• Unattended installs. Keep answer files for Debian, Ubuntu, Red Hat, openSUSE and Windows on one page and attach one to an ISO or to a single PC.
• It recognises ISOs it has never seen. An ISO that Bootlace does not know by name is not refused: it reads the ISO's own boot menus to work out what it is and, failing that, hands it to the PC as a network CD-ROM.
• You can check it works before you walk to the PC. A one-click self-test asks the server for what a PC asks for, and a search finds other servers that would answer PXE too.
• Light. One program file of 16 MB (a 42 MB Docker image), about 15 to 20 MB of memory when idle, and a measured minimum of 256 MB of memory and one core for the container. No database and nothing else to install.
• Open source, signed releases. GPL-3.0-or-later, with instructions to check the signature of every download.
How a PC boots from Bootlace
Bootlace runs on one computer that stays on: a small server, a spare PC, a Proxmox container. A PC on the same network asks to boot from the network (this is called PXE) and the steps below follow.
The same menu reaches every kind of PC, whatever its firmware:
Every feature
Systems it starts
• Windows 10, Windows 11 and Windows Server. Setup reads its installation files from a small read-only share that the server runs itself, so the PC installs straight from the network.
• Most Linux installers and live systems: Ubuntu, Debian, Fedora, Arch, Alpine, Kali, Proxmox VE, TrueNAS and many more, and rescue and maintenance tools such as SystemRescue, Clonezilla, GParted, Rescuezilla and memory tests.
• Live systems read the ISO from the server as they go (as a network disk, or an iSCSI CD) instead of copying it into the PC's memory, so the PC does not need room for the whole ISO.
• Debian and Kali installers install over the network: Bootlace gives the installer a CD it can find, so a netinst ISO installs to the end.
• ISOs it does not know are recognised from their own boot menus; failing that, the PC gets the ISO as a network CD-ROM.
• Disk images and packed files: .iso, .img, .raw, and packed .xz, .gz, .zst, .bz2 and .zip files (unpacked once, on request, with a check of the free disk space).
• FreeBSD starts too, on an experimental basis.
We only mark an ISO as working after we have seen it reach its installer or desktop in our test lab. The list of what we tried, with the results, is public: the compatibility list. Some do not work yet (pfSense on UEFI, for example) and the list says so.
Windows installs
• Skip the Windows 11 Setup checks you choose: TPM 2.0, Secure Boot, 4 GB of memory, supported processor, 64 GB of storage. Nothing is skipped unless ticked, and the page says Windows then runs without a promise of updates or support from Microsoft.
• Local account at the first start for Windows 11, which no longer offers a way past its network page.
• Drivers for Windows Setup. Put driver packages in a folder of the library and they are added to the copy of Windows' start-up image that is handed out, so Setup sees a disk or network card it did not know. The ISO itself is never changed.
• A clear failure screen. If Setup cannot reach the share because the PC's network card has no driver, the screen lists the devices without a driver and says where a driver package goes.
• Windows answer files (autounattend.xml) per PC or per ISO, with the PC's name filled in.
Unattended installs
The Unattended page keeps answer files, the files an installer reads so that it asks nothing: Debian preseed, Ubuntu autoinstall, Red Hat kickstart, openSUSE AutoYaST and Windows autounattend.xml. Each template says at the top that it erases the disk.
• Attach a file to an ISO, or to one PC (a PC's own choice wins); attaching asks for a confirmation, because every PC that then starts that ISO installs without asking.
• One file serves many PCs: the PC's name, address, serial and so on are filled in for the PC that asks.
• Passwords in a file are shown as stars, and the page warns when a line holds a password in plain text. The templates ask for password hashes.
• A file is given only to a PC that asked for the menu in the last two hours, and a limited number of times. An installer cannot log in, so the page says plainly that the file is not secret from the local network.
Secure Boot
Secure Boot (a firmware setting) normally blocks the programs a network boot starts. Bootlace has three answers. Built in: the iPXE project's signed shim and iPXE are part of the program, the default of a new installation, with nothing to enrol. Your own key: a folder with a shim and an iPXE you signed yourself, for those who want to look after their own key. Off. A choice of which PCs are sent through it (every 64-bit UEFI PC, or only the ones you mark) is made on the Server page and applies from the next boot, with no restart. A rule can also start Windows or Ubuntu with the firmware's own boot manager. The program checks its built-in files against a manifest every time it starts.
The menu a PC sees
• A picture menu on UEFI PCs, with the Gola Bootlace logo; a text menu on BIOS PCs. Long lists are shown a page at a time.
• Other ways to start an ISO: the entries of an ISO's own boot menu (safe graphics, an OEM install, a rescue mode, check the disc) are offered next to the usual start. On the ISOs page you can hide or rename an entry, add arguments to it, or choose which one starts by default.
• What starts by itself: nothing, an ISO, or the PC's own disk, after a waiting time you set. After an installation restarts a PC, "Boot from this PC's own disk" brings it back to its new system.
• A boot password per ISO, so that a menu anyone at the PC can use does not start a disk wipe by accident.
• A failed start does not strand the PC: it comes back to the menu with a message instead of going silently to its disk.
• Answers PCs that can only boot over HTTP (UEFI HTTP boot).
• The colour of the highlighted line, and patterns that keep chosen files out of the menu.
Your PCs
• A list of every PC that asked for a menu, with its model, address and what it did last, searchable and paged. A PC that only asked for a boot file is labelled, so you can tell when Secure Boot may be refusing iPXE.
• Names you give to PCs (a PC can suggest one with its host name or asset tag), and a history of what the server saw for each PC, downloadable for all PCs as a CSV file.
• Wake-on-LAN from the list.
• Rules per PC: show the menu, boot from its own disk, or start one ISO without asking.
• Rules per kind of PC, by model, manufacturer or platform ("every HP boots from its own disk").
• Kernel options per PC: extra arguments, a verbose start-up and a serial console, for one PC only.
• Forget a PC you no longer need. PCs not seen for 90 days (a setting) are forgotten by themselves.
Your ISOs
• Rename an ISO in the menu, hide it, choose what starts by itself, and see the exact commands a PC receives.
• Debugging switches: verbose start-up, serial console, and a debug shell that stops the start-up so you can look around.
The library
• Folders: keep ISOs in sub-folders and make new ones from the page.
• Add files three ways: upload from the browser (an interrupted upload resumes where it stopped), let the server download a file from a web address and check its checksum, or just copy files into the folder.
• Rename, move, new folder, delete. An ISO keeps its menu name, hidden flag and rules when renamed or moved; nothing is ever replaced, and delete is never recursive.
• It protects the disk and the server: a file whose first bytes do not match its name is refused as soon as they arrive, free-space reserve is kept, and a duplicate by name, address, size or content is pointed out.
• A cache that cleans itself: unpacked images and the prepared Windows start-up files are kept once and the least recently used are removed when the place is full; leftovers are cleaned up by themselves.
Know it works before you walk to the PC
• Self-test: with one click the server asks for what a PC asks for, one step at a time: the menu, the ISO download, TFTP, the Windows share and the network disk.
• Look for other PXE or DHCP-boot servers on the network, the most common reason a network boot fails.
• Library speed test, which says how fast the library's disk reads and writes.
• Backup and restore of the settings, with a copy kept in the library, so a new container given the same library can pick them up.
• Services you can start and stop from the page, each with its state and any error.
The management page
Everything is managed from a web page on the server (Dashboard, Server, Library, ISOs, PCs, Menu, Unattended, Log and Account); once the program runs, there is no command line to use.
• A first-start guide in four steps (your own password, the library, who may use the server, the checks).
• A live log with a filter and a download button, and an option to also keep it in a file.
• A password made up at the first start; five wrong passwords lock that address out for five minutes.
Safe by design
• Read-only: the web server, the network disk, the iSCSI target and the Windows share never write to an ISO.
• Local network only: every service refuses addresses that are not private; other networks, such as a VPN's, are added by hand.
• Hardened readers: the ISO and boot-menu readers and the menu script were tested with fuzzing, which found and fixed several crashes, and names from files are cleaned before they reach a menu.
Run it in a few minutes
The quickest way, if you have Proxmox: run this one command on the Proxmox host. It makes a small Debian container, installs Bootlace in it and prints its address and password. Later, type update in the container to update it: it lists what is new and goes back to the old version if the new one does not answer.
1bash -c "$(curl -fsSL https://raw.githubusercontent.com/ghazichaieb/gola-bootlace/main/tools/proxmox/bootlace-lxc.sh)"
No Proxmox? Pick what fits the computer you have: all the ways give the same program and the same web page.
• Docker (on a Linux host): the image ghazichaieb/gola-bootlace with host networking, for amd64 and arm64. The README has a ready-made compose file.
• A Linux package (amd64 or arm64, a Raspberry Pi included): download the .deb or .rpm from the releases page and run apt install ./bootlace-*.deb (dnf install for the .rpm); it installs a systemd service.
• Windows: unzip it and run bootlace.exe serve -iso-dir D:\isos for a quick job. It runs only while its window is open.
The program has three commands: bootlace serve runs the server, bootlace inspect tells you how the server would start an ISO file, and bootlace health is the health check. Every option can also be set as a BOOTLACE_<NAME> environment variable.
Then restart a PC and choose boot from network (usually F12, F11 or Esc at power-on): the menu appears. The first time, Bootlace makes up a password for the web page and shows it once in its log.
How to get it
Bootlace is free and open source (GPL-3.0-or-later). Download version 0.5.1 for Linux or Windows from the releases page, pull the Docker image from Docker Hub, or use the Proxmox command above. Every release is signed, with instructions to check the signature.
• Source code and issues: github.com/ghazichaieb/gola-bootlace
• Documentation: the web interface, how it works, what it needs, Secure Boot
Good to know
• It is early. It was tested in a lab of virtual machines (Proxmox and Hyper-V) and on a handful of real PCs, and some real PCs do not work yet: two PCs with a Realtek network chip never accept the boot offer in UEFI mode (the same ASUS motherboard works in legacy BIOS mode), and a recent laptop whose firmware trusts only Windows' own boot code refuses the Secure Boot shim. That is exactly why we need testers.
• The PC needs a cable. Network boot does not work over Wi-Fi.
• Secure Boot: the built-in route works for ISOs with a signed kernel, and on firmware that trusts Microsoft's third-party certificate. ARM64 PCs are not started yet.
• Windows ISOs use port 445. A Windows server already uses it for its own file sharing: use another port or run Bootlace on Linux, in a container or on Proxmox.
• Some things are experimental: FreeBSD, pfSense and OPNsense are not confirmed on UEFI real PCs, and UEFI HTTP boot has been checked on the wire but not yet on real firmware. Windows Setup shows its classic dialog when started this way.
• Not covered: persistence for live systems, IPv6 network boot, and imaging or multicast. Bootlace does not host or download ISOs for you.
• A network install is as fast as the network and the library's disk. Gigabit is fine; the minimum is 256 MB of memory and one core.
• The library folder must be writable: Bootlace keeps a hidden .bootlace folder in it.
• It is for a local network. Its network disk and iSCSI services have no login and the web page is not encrypted, so never forward its ports to the internet; use a VPN.
• The web interface is in English only.
• A system run from the network does not behave exactly like one started from a disc: the network has to stay up, and a few features that need the stick itself (Tails's persistent storage, for example) are missing. This page lists them.
Open source: try it, break it, improve it
We would love your help, whatever your level:
• Test it on your own hardware and tell us what happened, good or bad: which PC or motherboard, UEFI or BIOS, which ISO.
• Report ISOs that do not start, or that start differently from what you expect: open an issue with the name of the ISO and what you saw.
• Contribute: fixes, support for another system, documentation, translations of the web interface. Pull requests are welcome, and the contributing guide explains how.
• Spread the word to anyone who installs PCs for a living or for fun.
Would you like it set up for your office or workshop, or want us to handle the installations for you? Get in touch.