I didn’t find much guidance on how to set up MicroOS on my Raspberry Pi 5, and figuring it out wasn’t trivial, so I want to share how I did it.

My goal is to get a minimal installation of MicroOS on the Pi without needing to plug a keyboard and monitor into it, mainly because I didn’t have the micro HDMI to HDMI cable the new Pis require.

MicroOS has a premade ISO images for the Pi, so we just pick that and flash it on the SD card:

sha256sum -c ./openSUSE-MicroOS.aarch64-ContainerHost-RaspberryPi.raw.xz.sha256
xzcat openSUSE-MicroOS.aarch64-ContainerHost-RaspberryPi.raw.xz | sudo dd of=/dev/sda bs=4M status=progress

Then we need to enable sshd, create a user, and add an SSH key, automatically, when the Pi boots for the first time. MicroOS has a tool for this called combustion. It basically looks for a shell script on some drive and executes it in a transaction, producing a new snapshot the Pi will boot into after a reboot.

The combustion script is typically put on a separate USB stick, BUT the Pi currently (2026) does not look for USB devices soon enough for the boot process to find it. It therefore fails to find anything and runs the JeOS setup TUI, which I don’t want since I dont have that HDMI cable…

To solve this, we must put the shell script on the SD card itself. The easiest way is to put it directly on the boot partition and change the boot partition label to ‘COMBUSTION’:

fatlabel /dev/sda1 COMBUSTION
mount /dev/sda1 /mnt/
mkdir -p /mnt/combustion/
cp the-combustion-script.sh /mnt/combustion/script

Note that the label is uppercase because the boot filesystem is FAT. This won’t break anything since the fstab mounts drives based on their UUID, not on their label.

Then we unmount, sync, and stick the SD card in the Pi, sshd should start listening in no more than ~5 minutes.

Feel free to adapt my combustion script for your needs:

#!/bin/bash

mount /var
mount /home

# Configuring user: root ...
passwd -l root
usermod -s /sbin/nologin root

# Configuring user: prokop ...
useradd -m -s /bin/bash prokop

# Configure SSH keys for prokop
mkdir -m 700 -p /home/prokop/.ssh
echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMY0/DKivPtnP/c56SCp3klOcR0ls9DC7tzz0KdT3HKM prokop@rdck.dev" > /home/prokop/.ssh/authorized_keys

# Set correct ownership, permissions, AND SELinux contexts
chown -R prokop:prokop "/home/prokop/.ssh"
chmod 600 "/home/prokop/.ssh/authorized_keys"
restorecon -R "/home/prokop/.ssh"

# Prokop can sudo
echo "prokop ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/prokop
chmod 440 /etc/sudoers.d/prokop

# Hostname
echo "experiler" > /etc/hostname
chmod 644 /etc/hostname

# Language
echo "LANG=en_US.UTF-8" > /etc/locale.conf
chmod 644 /etc/locale.conf

# Network settings 
mkdir -p /etc/NetworkManager/system-connections/
cat >/etc/NetworkManager/system-connections/Universal.nmconnection <<-EOF
[connection]
id=Universal
type=ethernet

[ipv4]
dns-search=
method=auto

[ipv6]
dns-search=
addr-gen-mode=eui64
method=auto
EOF
chmod 600 /etc/NetworkManager/system-connections/Universal.nmconnection

# Network settings 
mkdir -p /etc/NetworkManager/conf.d/
cat >/etc/NetworkManager/conf.d/noauto.conf  <<-EOF
[main]
# Do not do automatic (DHCP/SLAAC) configuration on ethernet devices
# with no other matching connections.
no-auto-default=*
EOF
chmod 644 /etc/NetworkManager/conf.d/noauto.conf

# Lock down sshd
mkdir -p /etc/ssh/sshd_config.d/
cat > /etc/ssh/sshd_config.d/10-hardened.conf <<-EOF
PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
AllowUsers prokop
EOF
chmod 644 /etc/ssh/sshd_config.d/10-hardened.conf

# start Service sshd.service
systemctl enable sshd.service

# Explicitly stop jeos-firstboot from blocking the boot process
systemctl mask jeos-firstboot.service

# Keyboard
test -f /etc/vconsole.conf && FONT=$(grep ^FONT= /etc/vconsole.conf)
systemd-firstboot --force --keymap=us
test -n "$FONT" && echo "$FONT" >> /etc/vconsole.conf

# Timezone
systemd-firstboot --force --timezone=Europe/Prague

## Reboot after setup
cat > /etc/systemd/system/firstbootreboot.service <<-EOF
[Unit]
Description=First Boot Reboot

[Service]
Type=oneshot
ExecStart=rm /etc/systemd/system/firstbootreboot.service
ExecStart=rm /etc/systemd/system/default.target.wants/firstbootreboot.service
ExecStart=systemctl reboot

[Install]
WantedBy=default.target
EOF
systemctl enable firstbootreboot.service

umount /var
umount /home

I generated it with an online tool but made lots of edits to make it actually work. Some parts (such as the JeOS service masking) are the result of me debugging it for way too long. I don’t feel like figuring out which parts can be deleted, some probably can be.