DebGen

DebGen generates Debian and Ubuntu root filesystems.

Modes

DebGen picks a backend automatically:

• rootless — uses mmdebstrap in a user namespace. Needs no privileges and no sudo. Chosen when DebGen is not run as root and mmdebstrap is present.
• root — uses debootstrap, as DebGen always has. Chosen when running as root, or forced with -S.

Force either with -R / --rootless or -S / --root.

Rootless is the better default for automated builds. Device nodes cannot be created in a user namespace and are not created — nothing needs them, since devtmpfs provides them at boot.

Requirements

Mode	Needs
rootless	mmdebstrap, a kernel with unprivileged user namespaces, and /etc/subuid + /etc/subgid entries for your user
root	debootstrap, qemu-user-static for foreign architectures, and root

Usage

./DebGen.sh                                    # Debian stable, amd64
./DebGen.sh -a arm64 -r trixie -o OUTPUT -f
./DebGen.sh -a arm64 -r trixie -p pkgs.list -n mybox
./DebGen.sh --help

Output is <out>/<dist>-<rel>-<arch>-<date>.tar.gz.

Arguments

Short	Long	Meaning
-a	--arch	Target architecture
-d	--dist	debian or ubuntu
-r	--rel	Release / suite
-m	--mirror	Download mirror
-o	--out	Output directory
-n	--hostname	Hostname to set
-P	--password	Root password; prompts if omitted and interactive
-f	--force	Overwrite existing output
-p	--pkgs	File listing extra packages
-R	--rootless	Force rootless mode
-S	--root	Force root mode
-h	--help	Help

Notes

Root password

Set it with -P / --password, or leave it off and DebGen prompts (twice, with echo disabled) when it has a terminal. With neither — a script, a CI job, a build system — the account is left locked rather than given a default, so an image cannot ship with a password that is public knowledge.

./DebGen.sh -a arm64 -r trixie -P 'hunter2'      # unattended
./DebGen.sh -a arm64 -r trixie                   # prompts

License

GNU GPL v3.0. Copyright (C) 2019-2026 Corey Moyer cronmod.dev@gmail.com