Automated KVM VM Deployment with PXE Boot and Kickstart

Deploying virtual machines one at a time through an interactive installer is a workflow that does not scale. If you manage more than a handful of KVM guests, you already know the pain of clicking through the same prompts over and over. PXE boot combined with a kickstart file eliminates that entirely. You power on a VM, it pulls a boot image from the network, reads an answer file, and installs itself without any manual input.

This guide walks through every piece of that pipeline on a RHEL 10 / Rocky Linux 10 / AlmaLinux 10 host. By the end you will have a working PXE environment that can deploy new KVM guests in minutes with zero interaction.

What PXE Boot Is and Why It Matters for VM Deployments

PXE (Preboot Execution Environment) is a standard that allows a machine to boot from the network instead of a local disk. The machine’s firmware broadcasts a DHCP request, receives an IP address along with the filename of a network boot program, downloads that program over TFTP, and executes it. From there the boot program can load a kernel, an initrd, and any parameters you specify, including a pointer to a kickstart file.

For KVM environments this is particularly useful because libvirt’s virt-install supports PXE boot natively. You can script the creation of a VM and have it fully installed and configured without ever touching a console. Combine that with kickstart and you get repeatable, identical builds every time.

The main reasons to set this up:

• Consistent builds across every VM, no configuration drift from manual installs
• Speed. A scripted PXE install finishes faster than walking through Anaconda by hand
• Scalability. Deploy ten or a hundred VMs with the same workflow
• Auditability. The kickstart file is a plain text record of exactly what was installed and configured

Prerequisites

Before starting, make sure you have the following in place:

• A working KVM host running RHEL 10, Rocky Linux 10, or AlmaLinux 10 with libvirt, qemu-kvm, and virt-install installed
• A DHCP server (we will use dnsmasq, which handles both DHCP and TFTP in one process)
• A TFTP server (provided by dnsmasq)
• An HTTP server (we will use Apache httpd to serve the kickstart file and the installation tree)
• A Rocky Linux 10 or AlmaLinux 10 DVD ISO downloaded to the host
• A dedicated network or bridge for PXE traffic. Using an isolated libvirt bridge avoids conflicts with your production DHCP

The examples here use Rocky Linux 10, but every step applies identically to AlmaLinux 10 and RHEL 10. Swap the ISO and the repository paths and everything else stays the same.

Install and Configure dnsmasq for DHCP and TFTP

dnsmasq is a lightweight service that can act as a DHCP server, TFTP server, and DNS forwarder all in one. For a PXE setup on a KVM host it is the simplest option because you only need to manage a single configuration file.

Install dnsmasq:

sudo dnf install -y dnsmasq

Create the TFTP root directory and the PXE configuration directory:

sudo mkdir -p /var/lib/tftpboot/pxelinux.cfg

You need the PXELINUX boot loader. Install syslinux-tftpboot to get it:

sudo dnf install -y syslinux-tftpboot

Copy the required boot files into the TFTP root:

sudo cp /tftpboot/pxelinux.0 /var/lib/tftpboot/
sudo cp /tftpboot/ldlinux.c32 /var/lib/tftpboot/
sudo cp /tftpboot/menu.c32 /var/lib/tftpboot/
sudo cp /tftpboot/libutil.c32 /var/lib/tftpboot/

Now configure dnsmasq. Back up the default configuration and create a clean one:

sudo cp /etc/dnsmasq.conf /etc/dnsmasq.conf.bak

Open /etc/dnsmasq.conf in your editor and replace the contents with the following. Adjust the interface name, IP range, and gateway to match your environment:

# Listen only on the PXE bridge interface
interface=virbr1
bind-interfaces

# DHCP range and lease time
dhcp-range=192.168.100.100,192.168.100.200,255.255.255.0,12h

# Default gateway
dhcp-option=3,192.168.100.1

# DNS server
dhcp-option=6,192.168.100.1

# PXE boot settings
dhcp-boot=pxelinux.0
enable-tftp
tftp-root=/var/lib/tftpboot

# Logging for troubleshooting
log-dhcp
log-queries

The interface=virbr1 line limits dnsmasq to a specific bridge. If you are using the default libvirt bridge (virbr0), note that libvirt runs its own dnsmasq instance on that interface. It is better to create a separate bridge for PXE to avoid conflicts.

Create the isolated network in libvirt. Save the following XML to a file called /tmp/pxe-net.xml:

<network>
  <name>pxe-net</name>
  <bridge name="virbr1"/>
  <ip address="192.168.100.1" netmask="255.255.255.0"/>
</network>

Define and start the network. Note that we intentionally omit a <dhcp> block here because dnsmasq will handle DHCP separately:

sudo virsh net-define /tmp/pxe-net.xml
sudo virsh net-start pxe-net
sudo virsh net-autostart pxe-net

Enable and start dnsmasq:

sudo systemctl enable --now dnsmasq

Open the firewall for DHCP, TFTP, and DNS:

sudo firewall-cmd --add-service=dhcp --permanent
sudo firewall-cmd --add-service=tftp --permanent
sudo firewall-cmd --add-service=dns --permanent
sudo firewall-cmd --reload

Set Up HTTP Server for Kickstart Files and ISO Content

The kickstart file and the installation media need to be accessible over HTTP. The installer fetches packages from the HTTP-hosted repository tree, and it reads the kickstart file from a URL you specify in the boot parameters.

Install Apache:

sudo dnf install -y httpd

Create directories for the installation tree and kickstart files:

sudo mkdir -p /var/www/html/rocky10
sudo mkdir -p /var/www/html/ks

Enable and start Apache:

sudo systemctl enable --now httpd

Open the firewall for HTTP:

sudo firewall-cmd --add-service=http --permanent
sudo firewall-cmd --reload

Mount and Extract the Rocky Linux 10 ISO

Download the Rocky Linux 10 DVD ISO if you have not already. Place it somewhere convenient on the host, for example /var/lib/libvirt/images/.

Mount the ISO to the HTTP server’s document root so Anaconda can pull packages from it during installation:

sudo mount -o loop /var/lib/libvirt/images/Rocky-10.0-x86_64-dvd.iso /var/www/html/rocky10

To make the mount persistent across reboots, add an entry to /etc/fstab:

/var/lib/libvirt/images/Rocky-10.0-x86_64-dvd.iso  /var/www/html/rocky10  iso9660  loop,ro  0 0

Copy the PXE boot kernel and initrd from the mounted ISO into the TFTP root so the PXE loader can access them:

sudo cp /var/www/html/rocky10/images/pxeboot/vmlinuz /var/lib/tftpboot/
sudo cp /var/www/html/rocky10/images/pxeboot/initrd.img /var/lib/tftpboot/

Verify the files are in place:

ls -lh /var/lib/tftpboot/

You should see pxelinux.0, ldlinux.c32, menu.c32, libutil.c32, vmlinuz, and initrd.img in that directory.

Write a Kickstart File

The kickstart file is where you define everything about the installation: disk layout, packages, user accounts, network settings, and any post-install scripts. Anaconda reads this file and executes the installation without prompting for input.

Create the file at /var/www/html/ks/rocky10.ks. Below is a production-ready example. Read through each section and adjust it for your environment:

# Rocky Linux 10 Kickstart Configuration
# Tested with Rocky Linux 10 / AlmaLinux 10 / RHEL 10

# Use text mode installation
text

# Installation source (HTTP)
url --url="http://192.168.100.1/rocky10/"

# Keyboard and language
keyboard --xlayouts='us'
lang en_US.UTF-8

# Network configuration (DHCP on first interface)
network --bootproto=dhcp --device=link --activate --onboot=on
network --hostname=rocky10-vm

# Root password (generate your own hash with: python3 -c 'import crypt; print(crypt.crypt("YourPassword", crypt.mksalt(crypt.METHOD_SHA512)))')
rootpw --iscrypted $6$rounds=4096$randomsalt$hashedpasswordhere

# Create a non-root user
user --name=sysadmin --groups=wheel --iscrypted --password=$6$rounds=4096$randomsalt$hashedpasswordhere

# System timezone
timezone America/New_York --utc

# Disable the Setup Agent on first boot
firstboot --disabled

# SELinux enforcing
selinux --enforcing

# Firewall configuration
firewall --enabled --ssh

# Bootloader configuration
bootloader --location=mbr --append="crashkernel=auto"

# Clear all partitions and create new ones
clearpart --all --initlabel

# Partition layout
autopart --type=lvm

# If you prefer a manual partition layout, comment out autopart and use something like:
# part /boot --fstype=xfs --size=1024
# part /boot/efi --fstype=efi --size=600
# part pv.01 --size=1 --grow
# volgroup vg_root pv.01
# logvol / --vgname=vg_root --name=lv_root --fstype=xfs --size=20480
# logvol /var --vgname=vg_root --name=lv_var --fstype=xfs --size=10240
# logvol /tmp --vgname=vg_root --name=lv_tmp --fstype=xfs --size=5120
# logvol swap --vgname=vg_root --name=lv_swap --size=4096

# Package selection
%packages
@^minimal-environment
@standard
vim-enhanced
tmux
bash-completion
chrony
rsync
tar
wget
curl
net-tools
bind-utils
policycoreutils-python-utils
%end

# Post-installation script
%post --log=/root/ks-post.log

# Enable and start chronyd
systemctl enable chronyd

# Allow wheel group to use sudo without password (optional, remove for stricter setups)
echo "%wheel ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/wheel-nopasswd
chmod 0440 /etc/sudoers.d/wheel-nopasswd

# Set up SSH key for sysadmin user (replace with your actual public key)
mkdir -p /home/sysadmin/.ssh
chmod 700 /home/sysadmin/.ssh
echo "ssh-ed25519 AAAA...your-public-key-here sysadmin@management" > /home/sysadmin/.ssh/authorized_keys
chmod 600 /home/sysadmin/.ssh/authorized_keys
chown -R sysadmin:sysadmin /home/sysadmin/.ssh

# Disable root SSH login
sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config

# Clean up
dnf clean all

%end

# Reboot after installation
reboot

A few things to note about this kickstart file:

• The url directive points to the HTTP-hosted ISO content. Make sure the IP matches your KVM host’s address on the PXE bridge
• Passwords are hashed. Never put plaintext passwords in a kickstart file. Generate a proper SHA-512 hash before pasting it in
• The %post section runs after packages are installed. This is where you bake in SSH keys, sudoers rules, or any other first-boot configuration
• RHEL 10 and its derivatives use xfs as the default filesystem. The autopart directive handles this automatically

Set proper permissions on the kickstart file:

sudo chmod 644 /var/www/html/ks/rocky10.ks

Verify it is accessible from the network:

curl -s -o /dev/null -w "%{http_code}" http://192.168.100.1/ks/rocky10.ks

You should get a 200 response.

Configure the PXE Boot Menu

The PXE boot menu is defined in /var/lib/tftpboot/pxelinux.cfg/default. This file tells pxelinux what kernel to load, what initrd to use, and what boot parameters to pass, including the kickstart URL.

Create the default PXE configuration file:

sudo tee /var/lib/tftpboot/pxelinux.cfg/default <<'EOF'
UI menu.c32
PROMPT 0
TIMEOUT 300
ONTIMEOUT rocky10

MENU TITLE PXE Boot Menu - KVM Automated Deployment

LABEL rocky10
    MENU LABEL Install Rocky Linux 10 (Automated)
    KERNEL vmlinuz
    APPEND initrd=initrd.img inst.repo=http://192.168.100.1/rocky10/ inst.ks=http://192.168.100.1/ks/rocky10.ks ip=dhcp

LABEL rocky10-manual
    MENU LABEL Install Rocky Linux 10 (Manual)
    KERNEL vmlinuz
    APPEND initrd=initrd.img inst.repo=http://192.168.100.1/rocky10/ ip=dhcp

LABEL local
    MENU LABEL Boot from local disk
    LOCALBOOT 0
EOF

Key details about this configuration:

• UI menu.c32 loads the simple menu system so you get a text-based menu on the PXE console
• TIMEOUT 300 waits 30 seconds (value is in tenths of a second) before auto-selecting the default entry
• ONTIMEOUT rocky10 means unattended VMs will automatically start the kickstart installation after the timeout
• inst.ks= tells Anaconda where to fetch the kickstart file
• inst.repo= points to the HTTP-hosted installation tree
• ip=dhcp tells the installer to configure networking via DHCP during the install process

Create VMs with virt-install Using PXE Boot

With the PXE infrastructure in place, you can now create VMs that boot from the network and install themselves. The virt-install command below creates a VM and tells it to PXE boot on the pxe-net network:

sudo virt-install \
  --name rocky10-vm01 \
  --ram 2048 \
  --vcpus 2 \
  --disk path=/var/lib/libvirt/images/rocky10-vm01.qcow2,size=40,format=qcow2 \
  --os-variant rocky10 \
  --network network=pxe-net \
  --pxe \
  --graphics vnc,listen=0.0.0.0 \
  --noautoconsole

Breaking down the important flags:

• --pxe tells the VM to boot from the network
• --network network=pxe-net connects the VM to the bridge where dnsmasq is listening
• --os-variant rocky10 optimizes the VM settings for Rocky Linux 10. Run osinfo-query os to see all available variants. If rocky10 is not yet listed in your version of osinfo-db, use rhel10 or generic
• --noautoconsole returns control to the terminal immediately so you can monitor the install separately

To watch the installation progress, connect to the VM’s console:

sudo virsh console rocky10-vm01

Or if you prefer a graphical view through VNC:

sudo virsh vncdisplay rocky10-vm01

If you want to script the creation of multiple VMs, a simple loop does the job:

for i in 01 02 03 04 05; do
  sudo virt-install \
    --name rocky10-vm${i} \
    --ram 2048 \
    --vcpus 2 \
    --disk path=/var/lib/libvirt/images/rocky10-vm${i}.qcow2,size=40,format=qcow2 \
    --os-variant rocky10 \
    --network network=pxe-net \
    --pxe \
    --graphics vnc,listen=0.0.0.0 \
    --noautoconsole
done

All five VMs will boot, grab a DHCP lease, pull the PXE boot program, and install themselves from the kickstart file in parallel.

Test the Automated Installation

Before rolling this out at scale, run through a single VM deployment and verify each step works.

First, check that dnsmasq is running and listening on the right interface:

sudo systemctl status dnsmasq
ss -ulnp | grep :67
ss -ulnp | grep :69

Confirm the HTTP server is serving the installation tree:

curl -s http://192.168.100.1/rocky10/.treeinfo | head -20

Check that the kickstart file is accessible:

curl -s http://192.168.100.1/ks/rocky10.ks | head -5

Now create a test VM and watch its console:

sudo virt-install \
  --name test-pxe \
  --ram 2048 \
  --vcpus 2 \
  --disk path=/var/lib/libvirt/images/test-pxe.qcow2,size=20,format=qcow2 \
  --os-variant rocky10 \
  --network network=pxe-net \
  --pxe \
  --graphics vnc,listen=0.0.0.0 \
  --console pty,target_type=serial

You should see the VM pull a DHCP lease, download the PXE boot program, display the boot menu, and after the timeout (or immediately if you press Enter on the default option) begin the automated installation.

Monitor the dnsmasq log for DHCP and TFTP activity:

sudo journalctl -u dnsmasq -f

Once the installation finishes, the VM will reboot. Log in with the credentials you defined in the kickstart file and verify the configuration:

hostnamectl
cat /etc/os-release
df -h
ip addr show

After confirming everything works, clean up the test VM:

sudo virsh destroy test-pxe
sudo virsh undefine test-pxe --remove-all-storage

Advanced: Multiple OS Support in PXE Menu

A real environment usually needs to support more than one operating system or version. You can extend the PXE menu to offer multiple options by organizing the TFTP root into per-OS directories and adding menu entries for each.

Create directories for each OS under the TFTP root:

sudo mkdir -p /var/lib/tftpboot/rocky10
sudo mkdir -p /var/lib/tftpboot/alma10
sudo mkdir -p /var/lib/tftpboot/rhel10

Copy the kernel and initrd for each distribution into its respective directory. For example, after mounting the AlmaLinux 10 ISO at /var/www/html/alma10:

sudo cp /var/www/html/alma10/images/pxeboot/vmlinuz /var/lib/tftpboot/alma10/
sudo cp /var/www/html/alma10/images/pxeboot/initrd.img /var/lib/tftpboot/alma10/

Update the PXE default configuration to include all available operating systems:

UI menu.c32
PROMPT 0
TIMEOUT 300
ONTIMEOUT rocky10

MENU TITLE PXE Boot Menu - KVM Automated Deployment

MENU SEPARATOR

MENU BEGIN Rocky Linux
  MENU TITLE Rocky Linux Options

  LABEL rocky10
      MENU LABEL Install Rocky Linux 10 (Automated)
      KERNEL rocky10/vmlinuz
      APPEND initrd=rocky10/initrd.img inst.repo=http://192.168.100.1/rocky10/ inst.ks=http://192.168.100.1/ks/rocky10.ks ip=dhcp

  LABEL rocky10-manual
      MENU LABEL Install Rocky Linux 10 (Manual)
      KERNEL rocky10/vmlinuz
      APPEND initrd=rocky10/initrd.img inst.repo=http://192.168.100.1/rocky10/ ip=dhcp

  MENU END
MENU END

MENU BEGIN AlmaLinux
  MENU TITLE AlmaLinux Options

  LABEL alma10
      MENU LABEL Install AlmaLinux 10 (Automated)
      KERNEL alma10/vmlinuz
      APPEND initrd=alma10/initrd.img inst.repo=http://192.168.100.1/alma10/ inst.ks=http://192.168.100.1/ks/alma10.ks ip=dhcp

  LABEL alma10-manual
      MENU LABEL Install AlmaLinux 10 (Manual)
      KERNEL alma10/vmlinuz
      APPEND initrd=alma10/initrd.img inst.repo=http://192.168.100.1/alma10/ ip=dhcp

  MENU END
MENU END

LABEL local
    MENU LABEL Boot from local disk
    LOCALBOOT 0

Each distribution gets its own submenu. You can nest as deep as you want and add entries for different kickstart profiles (minimal, web server, database server) under each OS.

Create separate kickstart files for each distribution. The files will be nearly identical; only the url line and any distribution-specific package names need to change:

sudo cp /var/www/html/ks/rocky10.ks /var/www/html/ks/alma10.ks
sudo sed -i 's|rocky10|alma10|g' /var/www/html/ks/alma10.ks

Troubleshooting Common Issues

PXE boot has several moving parts. When something breaks, the symptoms can be vague. Here are the most common problems and how to fix them.

DHCP Not Offering an Address

Symptom: The VM sits at “PXE-E51: No DHCP or proxyDHCP offers were received” or similar.

Check these first:

• Make sure dnsmasq is running: sudo systemctl status dnsmasq
• Verify the VM is on the correct network: sudo virsh domiflist rocky10-vm01. The network should be pxe-net
• Confirm dnsmasq is bound to the right interface. Check the log: sudo journalctl -u dnsmasq | grep "listening"
• Look for a conflicting DHCP server. If libvirt’s default network also runs on the same subnet, the two DHCP servers will fight. Either shut down the default network or use a different subnet for PXE
• Check the firewall: sudo firewall-cmd --list-services. The dhcp service must be open on the zone associated with virbr1

TFTP Timeout or File Not Found

Symptom: The VM gets a DHCP address but then fails with “PXE-T01: File not found” or “PXE-E32: TFTP open timeout”.

Check these:

• Verify the TFTP root directory is correct in dnsmasq.conf and that the files exist: ls -la /var/lib/tftpboot/
• Make sure pxelinux.0 is present and the filename in dhcp-boot= matches exactly
• Check file permissions. The dnsmasq process needs read access to everything in the TFTP root
• Test TFTP manually from another machine: tftp 192.168.100.1 -c get pxelinux.0
• Look at the dnsmasq log for TFTP errors: sudo journalctl -u dnsmasq | grep -i tftp
• Confirm the firewall allows TFTP (UDP port 69)

Kickstart File Not Found

Symptom: The kernel and initrd load, Anaconda starts, but then it fails with an error about not being able to fetch the kickstart file.

Check these:

• Verify the URL in the PXE config’s APPEND line is correct and reachable from the VM’s network
• Test from the KVM host: curl http://192.168.100.1/ks/rocky10.ks
• Make sure Apache is running: sudo systemctl status httpd
• Check Apache’s access log for the request: sudo tail -f /var/log/httpd/access_log
• If SELinux is enforcing, check for denials: sudo ausearch -m avc -ts recent. You may need to adjust the SELinux context on the kickstart file: sudo restorecon -Rv /var/www/html/
• Confirm there are no typos in inst.ks=. A wrong path or port will cause a silent failure where Anaconda drops to an interactive prompt instead

Installation Starts but Fails to Fetch Packages

Symptom: Anaconda starts with the kickstart file but fails when trying to download RPMs.

Check these:

• Confirm the ISO is mounted and the installation tree is accessible: curl http://192.168.100.1/rocky10/.treeinfo
• Make sure the url directive in the kickstart file matches the actual HTTP path to the mounted ISO
• If using a minimal ISO instead of the DVD ISO, it will not contain all packages. Use the DVD ISO or point the url at an online mirror instead
• Check that the mounted ISO has not been unmounted. Loop mounts do not always survive reboots unless you added the fstab entry

VM Boots from Disk Instead of PXE After Installation

Symptom: After the first successful install and reboot, the VM PXE boots again and starts reinstalling.

Fix: This happens because the VM’s boot order still prioritizes network boot. After the installation finishes, change the boot order to boot from disk first:

sudo virsh destroy rocky10-vm01
sudo virt-xml rocky10-vm01 --edit --boot hd,network
sudo virsh start rocky10-vm01

Alternatively, the “Boot from local disk” entry in the PXE menu handles this if you set ONTIMEOUT local instead of ONTIMEOUT rocky10 after your initial deployments are done.

Wrapping Up

You now have a fully working PXE boot environment on your KVM host that can deploy Rocky Linux 10, AlmaLinux 10, or RHEL 10 virtual machines without any manual interaction. The pieces fit together in a straightforward way: dnsmasq handles DHCP and TFTP, Apache serves the installation tree and kickstart files, and virt-install creates VMs that boot from the network.

From here you can build on this foundation. Add more kickstart profiles for different server roles. Integrate with Ansible to run post-install configuration that goes beyond what kickstart’s %post section can handle. Use MAC-based kickstart files (name them by MAC address under pxelinux.cfg/) to assign specific configurations to specific VMs. Or move to iPXE for HTTP-based boot loading instead of TFTP, which performs better on busy networks.

The point is that this setup gives you a repeatable, scriptable, hands-off deployment pipeline for KVM guests. Once it works, you will not want to go back to manual installs.