Mastering the Minimalist Approach: Installing Debian Linux with Only What You Need

Anyone building stable production infrastructure on Debian quickly discovers that less is more. Pre-built desktops ship with non-essential daemons, questionable default configs, and an attack surface begging for trouble. If you want clean audit trails and predictable performance, start with a barebones system—then layer only the tools you trust.

Why Minimal?

• Performance: Reduced memory footprint; faster boot.
• Security: Fewer entry points, fewer packages to patch.
• Control: Configure each component, avoid vendor assumptions.

Side note: Debugging systemd units is easier when you know exactly which processes should exist.

1. Start with a Netinstall ISO

Debian’s netinst image (≈300 MB) is purpose-built for minimalist deployment. It fetches only the base system via the network—no extra desktop environments or pre-installed office kits.

Tip: Always confirm SHA256 of the ISO. Tampered netinst media is a known attack vector.

2. Boot & Run the Installer

Boot from the written USB or CD. The graphical and text installers accept the same options—use whichever is faster for you. At the language/locale/network steps, nothing unusual.

When you reach “Software selection” (tasksel):

[ ] Debian desktop environment
[ ] GNOME
[ ] Xfce
[ ] KDE
[ ] ...others...
[ ] web server
[ ] print server
[ ] SSH server (optional, see below)
[✔] standard system utilities

Uncheck everything except “standard system utilities”.
This eliminates X, desktop managers, cups, Apache, and other services.

Note: If you intend true isolation (e.g., a container host), you can even deselect “standard system utilities”—but expect to install coretools manually.

3. Partitioning Basics

For workstations, one root (/) partition is fine. On server hardware, set up LVM or RAID as required:

• / (20-40 GB suffices unless building with local sources)
• swap (optional with ≥8GB RAM; rely on zram if memory constrained)
• /home (separate only if users store data locally)
• EFI partition for UEFI boot

Debian’s guided partitioners handle UEFI quirks automatically, but double-check for accidental DOS partitions (MBR) on NVMe media.

4. First Boot: Where’s My Desktop?

Text mode login. If you see a blinking graphical interface, tasksel wasn’t truly empty—restart from scratch, or use apt remove gdm3 lightdm <...> as needed.

Update APT:

sudo apt update
sudo apt full-upgrade

Known issue: If you didn’t set up an admin user and can’t sudo, log in as root; run adduser newadmin && usermod -aG sudo newadmin.

5. Selective Package Installation

Add only what you need.

Minimal GUI Example:

sudo apt install xorg xinit openbox
echo "exec openbox-session" > ~/.xinitrc
startx

Advanced: For a graphical login, look into slim or configure systemd to launch X automatically. Not all lightweight display managers play well with Wayland—stick to X11 for maximal compatibility.

SSH: Install only if required. If hostile firewall conditions, bind only to private interfaces via /etc/ssh/sshd_config.

sudo apt install openssh-server
sudo systemctl enable ssh --now

6. Keep It Lean: Disable Unneeded Services

Check enabled units:

systemctl list-unit-files --state=enabled
# Example output:
# getty@tty1.service enabled
# networking.service enabled
# systemd-timesyncd.service enabled
# ...

Stop and disable what you don’t need. (Print server on a headless build? Remove it.)

sudo systemctl disable cups
sudo apt purge cups*

Monitor system state:

htop
# or, text mode:
top

7. Non-Obvious Tips & Gotchas

• Tasksel stores choices at /var/log/installer/—review if you suspect accidental desktop install.
• Debian “standard system utilities” brings in time sync and logrotate; trim further if running custom logging or using container orchestration.
• Want micro-footprints? Evaluate Alpine or Arch, but lose apt’s stability guarantees.
• Build post-install automation: Save a list of installed packages via dpkg --get-selections > pkglist.txt.

Final Notes

Minimal Debian isn’t about asceticism—it’s disciplined, incremental construction. Every package is a dependency risk, an update obligation, and a potential audit finding. By controlling the ground floor of your system, you own its resilience.

Faster boots, smaller security images, less accidental entropy. You trade handholding for clarity. That’s the point.

Questions about edge-case hardware? Observed different behavior with Debian 12 (Bookworm) netinst? Share anomalies below—others will face the same.