How to Install Operating Systems over the Network with netboot.xyz (Never Make a USB Stick Again)

Every reinstall, every memtest, every "let's try a different distro" starts with finding a USB stick and writing an image to it (tutorial 1). With PXE boot, a machine asks the network for something to boot instead, and netboot.xyz answers with a menu: Ubuntu, Debian, Fedora, Windows installers, memtest86+, GParted, Clonezilla, rescue tools — streamed from the internet or from ISOs you keep on the server. One container plus two DHCP options, and every PC in the house can boot into any of it from a menu.

mkdir -p ~/docker/netboot/{config,assets} && cd ~/docker/netboot
nano compose.yaml

services:
netbootxyz:
image: ghcr.io/netbootxyz/netbootxyz:latest
container_name: netbootxyz
ports:
- "3000:3000"
- "69:69/udp"
- "8080:80"
environment:
MENU_VERSION: ""
NGINX_PORT: 80
WEB_APP_PORT: 3000
volumes:
- ./config:/config
- ./assets:/assets
restart: unless-stopped

docker compose up -d
sudo ufw allow from 192.168.1.0/24 to any port 69 proto udp
sudo ufw allow from 192.168.1.0/24 to any port 8080 proto tcp

The web UI at http://192.168.1.50:3000 shows the menus and lets you download assets.

Clients need two DHCP options: the TFTP server (next-server, 66) and the boot filename (67), different for BIOS and UEFI.

Pi-hole as DHCP (tutorial 144): create /etc/dnsmasq.d/10-pxe.conf inside the Pi-hole container (mount a folder as /etc/dnsmasq.d):

dhcp-match=set:bios,option:client-arch,0
dhcp-boot=tag:bios,netboot.xyz.kpxe,,192.168.1.50
dhcp-match=set:efi64,option:client-arch,7
dhcp-match=set:efi64,option:client-arch,9
dhcp-boot=tag:efi64,netboot.xyz.efi,,192.168.1.50

Restart Pi-hole.

Router DHCP: OpenWrt, OPNsense, pfSense, UniFi and MikroTik all have "network boot" / "TFTP server" fields: server 192.168.1.50, file netboot.xyz.efi (and .kpxe for legacy if there's a second field). ISP routers usually can't — another reason for 144.

On any PC: power on, boot menu (F12 / F11 / Esc), choose Network / PXE / IPv4 boot. Or in the BIOS, put network boot first for a lab machine. Within seconds the netboot.xyz menu appears: Linux installs → Ubuntu → 24.04 LTS → install, and the Ubuntu installer loads over the network. Laptops without Ethernet: a USB-Ethernet adapter, or iPXE's Wi-Fi is not an option — PXE is wired.

Windows and some large images can't stream straight from the internet; host them locally. Put the Windows ISO's contents on a Samba share (31), and follow netboot.xyz's Windows guide: it boots WinPE from ./assets and runs setup from the share. For Linux ISOs you'd rather not download each time, the web UI → Local Assets fetches them into ./assets and the menu uses the local copy automatically.

Menus in the web UI edits the iPXE menus. Add an entry for your own Ubuntu autoinstall (a user-data file served from 8080 → a fully unattended install that matches tutorial 1), or for a rescue image you've built. Changes are live on the next boot.

memtest86+ on a flaky machine without hunting for a stick (117), GParted or Clonezilla for cloning (74), a rescue shell for a server that won't boot (75), trying a distro on the spare PC, reinstalling the kids' laptop, and a lab of VMs (81) that all boot from the same menu.

Client says "PXE-E53: No boot filename received". DHCP options not set, or the client is on a VLAN whose DHCP doesn't have them.

"TFTP open timeout". Port 69/udp blocked, or next-server wrong. tftp 192.168.1.50 -c get netboot.xyz.efi from another Linux box to test.

Menu loads but installers fail to download. The client needs internet for streamed images; or use local assets.

UEFI machine boots the BIOS file (or vice versa). The arch-matching dnsmasq lines; routers with a single filename field need .efi for modern machines.

Secure Boot blocks it. netboot.xyz's EFI isn't signed; disable Secure Boot for the session.

One container, two DHCP options, F12 → Network. Installers, memtest and rescue tools from a menu on every machine in the house, local ISOs for the big ones, and a drawer of USB sticks you can finally repurpose.