Create a Multi-Boot USB with Ventoy on Linux

A drawer of USB sticks, one per installer, stops being useful fast. The Debian stick is two point releases old, the rescue ISO is on a stick nobody can find, and every new image means another round of dd. Ventoy replaces that drawer with one stick. You install it once, then copy ISO files onto it like any other file, and it builds a boot menu from whatever it finds there at boot time.

Original content from computingforgeeks.com - post 95931

We built a Ventoy stick on Ubuntu 26.04 in October 2026, updated it in place from 1.1.17 to 1.1.18, and booted it in a VM under legacy BIOS and under UEFI with Secure Boot on. That last part catches people out, because Ventoy 1.1.14 moved to a new signing key, so even machines that trusted an older Ventoy stick have to be told about it once. This guide covers the install, the boot menu, the Secure Boot enrolment, updates and the ISOs that refused to boot.

What Ventoy writes to the stick

The layout matters because it decides what an update can and cannot touch. Ventoy turns the stick into two partitions, and knowing which is which saves you from formatting the wrong one later:

• Partition 1, exFAT, labelled Ventoy: almost the whole stick. Your ISO files go here, in any folder layout you like, and the files can be larger than 4 GB.
• Partition 2, FAT, labelled VTOYEFI, 32 MB: the Ventoy bootloaders for BIOS and UEFI, plus the Secure Boot certificate covered below. You never write to it by hand.

Because your ISOs live on their own partition, an update rewrites the boot code and VTOYEFI and leaves them alone. Only an install, -i the first time or a forced -I later, wipes the stick, so do the destructive part once and plan to keep the stick for years.

The download and its checksum

We pull the release from GitHub rather than a mirror, so the checksum file and the tarball come from the same place. Ventoy publishes a Linux tarball and a sha256.txt file with every GitHub release. Ask the GitHub API for the latest version number, so the commands keep working when a new release lands:

VER=$(curl -s https://api.github.com/repos/ventoy/Ventoy/releases/latest | grep -m1 '"tag_name"' | cut -d'"' -f4 | tr -d v)
echo "Latest Ventoy: $VER"

On 18 October 2026 that returned the release from 9 October. Pinning the version in a variable also means every later command names the same release, so a mixed download cannot happen:

Latest Ventoy: 1.1.18

Download the tarball and the checksum file into your home directory, check the hash, and unpack. A bootloader is the one piece of software that runs before anything else on the machine, so we would not skip the checksum step for convenience:

cd ~
wget "https://github.com/ventoy/Ventoy/releases/download/v${VER}/ventoy-${VER}-linux.tar.gz"
wget "https://github.com/ventoy/Ventoy/releases/download/v${VER}/sha256.txt" -O sha256-${VER}.txt
grep "ventoy-${VER}-linux.tar.gz" sha256-${VER}.txt | sha256sum -c -
tar xzf ventoy-${VER}-linux.tar.gz

sha256sum compares the file against the line from the release’s own checksum list. The check must print OK. Anything else means a broken or tampered download, so delete it and fetch it again:

ventoy-1.1.18-linux.tar.gz: OK

Keep the work in your home directory rather than /tmp. On Ubuntu 26.04 /tmp is a RAM-backed tmpfs that is emptied at every reboot, and on our 2 GB test VM it was capped at 982 MB, too small to stage a single Debian ISO alongside anything else.

The right target disk

The install wipes the whole target disk, so this is the step to slow down on. Every mistake with Ventoy is the same mistake: writing to the wrong disk. List the block devices with their model and transport before you plug anything else in:

lsblk -o NAME,SIZE,TYPE,MODEL,SERIAL,TRAN

A real stick shows usb in the TRAN column and the vendor’s model name. Our lab used an 8 GB virtual disk on a VM, which is why it shows up as a QEMU disk with an empty TRAN column. The disk carrying the operating system is vda:

NAME     SIZE TYPE MODEL         SERIAL    TRAN
sda        8G disk QEMU HARDDISK VTOYUSB01
sr0        4M rom  QEMU DVD-ROM  QM00003   ata
vda       30G disk                         virtio
├─vda1  28.9G part                         virtio
├─vda13 1023M part                         virtio
├─vda14    4M part                         virtio
└─vda15  106M part                         virtio

Ventoy needs the disk device, because it rewrites the partition table. Run the installer from the unpacked directory with -i and the whole disk, not a partition. It asks twice before writing and then wipes the stick. We installed 1.1.17 at this point on purpose, so we could test an in-place update to 1.1.18 later, which is why the next outputs show 1.1.17:

cd ~/ventoy-${VER}
sudo ./Ventoy2Disk.sh -i /dev/sda

The output names the disk, the model and the size again, which is your last chance to stop. On Ubuntu 26.04 it also printed a mknod: File exists line from the new Rust coreutils, which is harmless because the partition device already existed:

Disk : /dev/sda
Model: QEMU QEMU HARDDISK (scsi)
Size : 8 GiB
Style: MBR

Attention:
You will install Ventoy to /dev/sda.
All the data on the disk /dev/sda will be lost!!!

Create partitions on /dev/sda by parted in MBR style ...
Done
create efi fat fs /dev/sda2 ...
mknod: File exists (os error 17)
Format partition 1 /dev/sda1 ...
mkexfatfs 1.3.0
File system created successfully.
mkexfatfs success
writing data to disk ...
sync data ...
esp partition processing ...

Install Ventoy to /dev/sda successfully finished.

Confirm what landed on the stick with the list option. Secure Boot support is on by default in current releases, so older guides that tell you to add -s are describing a flag you no longer need:

sudo ./Ventoy2Disk.sh -l /dev/sda

Our stick reported MBR with Secure Boot support enabled. MBR is the default because it boots on the widest range of old and new firmware, so we only switch to GPT when a disk or a machine demands it:

Ventoy Version in Disk: 1.1.17
Disk Partition Style  : MBR
Secure Boot Support   : YES

The options worth knowing come straight from the script’s own help. We would pick them at install time, because partition style and reserved space cannot change without a reinstall:

Option	What it does	When we would use it
-i	Install, refuses if Ventoy is already there	Every first install
-I	Force install, wipes an existing Ventoy stick	Starting over from scratch
-u	Update the bootloader, keeps the ISOs	Every new Ventoy release
-l	Show the version and settings on the stick	Before and after updates
-g	GPT instead of MBR	Disks over 2 TB, or firmware that wants GPT
-s / -S	Enable or disable Secure Boot support (enabled by default)	-S only if you never boot with Secure Boot
-r SIZE_MiB	Leave free space at the end of the disk	A second partition for files on the same stick
-L	Label of the exFAT partition	Telling several sticks apart

For a typical stick the defaults are right, so -i on its own is all most readers need.

ISO files on the stick

Download each ISO with its checksum file, the same as Ventoy itself, because a corrupted ISO only shows itself halfway through an install. This fetches the current Debian 13 netinst into your home directory and checks it against Debian’s SHA256SUMS:

cd ~
D=$(curl -s https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/SHA256SUMS | grep -m1 'netinst.iso$' | awk '{print $2}')
wget https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/$D
curl -s https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/SHA256SUMS | grep " $D\$" | sha256sum -c -

Ours was the 13.7.0 image, and the check printed debian-13.7.0-amd64-netinst.iso: OK. Then mount the first partition and copy the ISO onto it. Folders are fine, and we used one for installers and one for tools:

sudo mkdir -p /mnt/ventoy
sudo mount /dev/sda1 /mnt/ventoy
sudo mkdir -p /mnt/ventoy/linux /mnt/ventoy/tools
sudo cp ~/debian-*-netinst.iso /mnt/ventoy/linux/
sync
sudo umount /mnt/ventoy

Run sync and unmount before you pull the stick. Writes to a USB stick are cached, and an ISO that was still being written when you unplugged can boot into an installer that fails halfway through, which is far harder to diagnose than a missing file. Before the Debian ISO went on, the 66 MB Alpine image and the 2.4 MB netboot.xyz image took 69 MB of the 8 GB, so even a small stick holds a useful kit.

The boot menu on legacy BIOS

Nothing about the stick changes between machines, so the same menu appears on every PC you plug it into. Boot the target machine from the stick through its one-time boot menu (often F12, F11 or Esc) and Ventoy lists every ISO it found. The footer shows the version and the firmware mode, here 1.1.18 BIOS:

The default list view flattens your folders into one list. Press F3 for the tree view if you keep many ISOs in folders. Selecting an ISO opens Ventoy’s secondary boot menu before anything boots (the VTOY_SECONDARY_BOOT_MENU setting turns it off):

Each mode loads the ISO a different way, so a failure in one does not mean the ISO is broken. Normal mode is the one to use first. The other entries exist for ISOs that fail in normal mode, and File checksum lets you verify an ISO on the stick itself before you trust it with an install:

• Boot in normal mode: Ventoy’s default, which works for most Linux and Windows ISOs.
• Boot in grub2 mode: an alternative boot method Ventoy offers for Linux ISOs that fail in normal mode.
• Boot in memdisk mode: loads the entire ISO into RAM first, only for small images that do not need to mount the ISO again after boot.
• File checksum: offers to hash the ISO on the stick so you can compare it with the publisher’s value.

Secure Boot and the new Ventoy key

Most PCs sold in the last few years ship with Secure Boot on, so this is the screen most people hit first. Ventoy’s first stage is a shim signed through Microsoft’s third-party CA, but the Ventoy bootloader behind it is signed with Ventoy’s own key, which shim does not trust yet. On our OVMF test machine with Microsoft’s keys enrolled, the first UEFI boot stopped here:

This is expected and happens once per machine for each Ventoy key. Press Enter on OK, and shim offers “Press any key to perform MOK management” with a countdown of about ten seconds. Ventoy’s guide then shows a menu with Continue boot, Enroll key from disk and Enroll hash from disk. Choose “Enroll key from disk”, select the VTOYEFI partition, pick ENROLL_THIS_KEY_IN_MOKMANAGER.cer, confirm with Continue and then Yes, and reboot.

That file is the certificate you are adding, so inspect it from Linux before you trust it. Copy it to your home directory while you are there, because the second enrolment method below needs it:

sudo mkdir -p /mnt/vtoyefi
sudo mount -o ro /dev/sda2 /mnt/vtoyefi
openssl x509 -inform der -in /mnt/vtoyefi/ENROLL_THIS_KEY_IN_MOKMANAGER.cer -noout -subject -dates
cp /mnt/vtoyefi/ENROLL_THIS_KEY_IN_MOKMANAGER.cer ~/
sudo umount /mnt/vtoyefi

It is the Ventoy root CA created in June 2026. Ventoy has offered Secure Boot support for years, but release 1.1.14 switched to this new key, so a machine that trusted an older Ventoy stick asks once more:

subject=CN=Ventoy Secure Boot Root CA, O=Ventoy, C=CN
notBefore=Jun 20 12:31:50 2026 GMT
notAfter=May 27 12:31:50 2126 GMT

In our VM, the key presses at the stick’s own MOK prompt kept landing back on the error screen, so we did not get its menu on screen. We enrolled the same certificate a second way instead. It works on any machine whose installed Linux boots through shim with Secure Boot on, because that shim starts MokManager on the next boot. If you are enrolling a different machine from the one you built the stick on, mount VTOYEFI there and copy the certificate to its home directory first. mokutil then queues the key and asks for a one-time password:

sudo mokutil --import ~/ENROLL_THIS_KEY_IN_MOKMANAGER.cer
sudo mokutil --list-new | grep Subject:

On the next boot, press a key inside the countdown, or the request is dropped and you have to queue it again. If you keep missing the window, run sudo mokutil --timeout -1 as a separate command after the import to turn the countdown off. The distribution’s MokManager then lists “Enroll MOK” for the queued key, next to the entries the stick offers:

Choose Enroll MOK, then Continue, and answer Yes to this confirmation. Type the password you set with mokutil and reboot:

With the key enrolled and Secure Boot still on, the stick booted straight to the Ventoy menu, now labelled 1.1.18 UEFI. Shim now accepts the Ventoy bootloader because its key sits in the MOK list, so no further prompts appear on that machine:

We also booted an ISO through it. The Debian 13 netinst loaded its UEFI installer menu and started the installer with Secure Boot enabled:

Know what that enrolment means before you roll it out. Ventoy’s default policy bypasses Secure Boot checks for the files it boots, so once its key is trusted, any EFI file you boot through Ventoy on that machine runs unchecked. If you want Ventoy to follow the normal Secure Boot policy, add this to ventoy/ventoy.json on the first partition:

{
    "control": [
        { "VTOY_SECURE_BOOT_POLICY": "1" }
    ]
}

Per Ventoy’s documentation, images that fail the check then no longer boot under Secure Boot, which is the point. To withdraw trust from a machine later, Ventoy documents removing the enrolled key in its delete key guide. If the blue screen never appears and the firmware shows a generic boot failure instead, Ventoy’s documentation says some machines need “Allow Microsoft 3rd Party UEFI CA” enabled in the firmware setup. The fallback on any machine is to turn Secure Boot off for the session, at the cost of the protection it gives you.

Updates that keep your ISOs

Updates are where Ventoy saves the most time, because the ISOs never need copying again, and you run one whenever a newer release than the one on your stick lands. A Ventoy update rewrites the boot code and the VTOYEFI partition and leaves partition 1 alone. We installed 1.1.17, added the ISOs, and then updated to 1.1.18 from its own unpacked directory with -u, which asks for a y before it starts:

cd ~/ventoy-${VER}
sudo ./Ventoy2Disk.sh -u /dev/sda
sudo ./Ventoy2Disk.sh -l /dev/sda

The script states up front that the first partition is safe, and the list option confirms the new version. Run -l before and after every update, so you know which release a stick carries when someone reports a boot problem:

Upgrade operation is safe, all the data in the 1st partition (iso files and other) will be unchanged!

esp partition processing ...

Update Ventoy on /dev/sda successfully finished.
Ventoy Version in Disk: 1.1.18
Disk Partition Style  : MBR
Secure Boot Support   : YES

Both ISOs were still in their folders afterwards. Updating from a release older than 1.1.14 means each Secure Boot machine asks for the enrolment once more, so plan that update for a time when you can sit at those machines.

VentoyWeb for a browser install

Not everyone wants to drive a disk-wiping script from a terminal. The tarball also ships VentoyWeb.sh, a small web server that gives the same install and update functions in a browser. It listens on localhost only, which is the right default for a tool that wipes disks:

cd ~/ventoy-${VER}
sudo ./VentoyWeb.sh

It prints the address to open and keeps running until you press Ctrl+C. Because it runs as root, stop it as soon as you are done instead of leaving it in the background:

===============================================================
  Ventoy Server 1.1.18 is running ...
  Please open your browser and visit http://127.0.0.1:24680
===============================================================

The page shows the version in the package, the version on the selected device, and Install and Update buttons. Our virtual test disk did not appear in its Device list, because the page lists USB devices by default. The Option menu has “Show All Devices” for other disks, and the command-line script installed to the same disk without complaint:

To listen on another address and port, the 1.1.18 script takes -H with an IPv4 address and a lowercase -p for the port, for example sudo ./VentoyWeb.sh -H 10.0.1.50 -p 8080. The Ventoy web page shows an uppercase -P, which the script ignores, leaving the server on 24680. Anything other than localhost exposes a disk-wiping service to your network without a password, so we would only use it on an isolated lab network, never on a shared one.

ISOs that will not boot

Not every ISO works with Ventoy, and the failure looks like a broken image even when the file is fine. The Alpine 3.24 virt ISO is a good example in our VM. It started, then its initramfs could not mount the boot media and dropped into an emergency shell. Ventoy’s tested list covers Alpine’s standard and extended images, not the virt one:

Memdisk mode ended at the same “Mounting boot media failed” shell, which is expected: Ventoy’s memdisk mode only suits images that do not mount the ISO again after boot, and Alpine’s initramfs does exactly that. The Debian netinst on the same stick booted and started its installer under UEFI with Secure Boot, so the stick itself was fine. When an ISO fails like this, work through the options in order:

1. Use File checksum from Ventoy’s per-ISO menu and compare it with the publisher’s hash.
2. Try grub2 mode, then memdisk mode for small images.
3. Try another edition of the same distribution, such as Alpine’s standard ISO instead of the virt one.
4. Check the ISO against Ventoy’s tested list before you blame the stick.

For a one-off install where Ventoy will not cooperate, write that single ISO to a spare stick the traditional way, as covered in our guide to creating a bootable USB on Linux and macOS. Windows installers have their own quirks, which our bootable Windows USB guide covers.

A stick for the whole team

Once the stick works, the cost of keeping it useful is small, and most of it is deciding who owns it. On a team that rebuilds machines regularly, we would keep the stick’s contents in a shared folder with the checksums next to each ISO and treat the stick as a copy, not the source. These are the decisions that keep it trustworthy:

• One owner and a monthly refresh: replace installers when a point release lands, so nobody installs Debian 13.5 and then spends an hour on updates.
• Secure Boot enrolment at hand-out: enrol the Ventoy key on each machine the first time the stick meets it, note which machines have it, and set VTOY_SECURE_BOOT_POLICY to 1 unless you accept the default bypass.
• Update with -u, never reinstall: a reinstall wipes the ISOs and costs you the copy time, while an update takes seconds.
• A network fallback: a small netboot.xyz ISO on the stick, or our netboot.xyz server guide for the whole LAN, covers the installer you forgot to copy.

A 64 GB stick holds a full set of desktop and server installers with room for a Windows image, and the only recurring cost is the time to copy new ISOs. When the stick finally boots the machine, our walkthroughs to install Debian step by step and install Ubuntu 26.04 LTS pick up from the installer’s first screen.