Advanced Omarchy Installation Modes

Understand free-space, prepare-for-another-owner, cidata unattended, and unencrypted Omarchy installation modes with their security and recovery boundaries.

Beyond a full-disk install, the Omarchy ISO supports free-space installation, preparation for another owner, unattended installation, and a special unencrypted mode. Each solves a different problem. Verify backups and recovery media before any disk operation.

Free-space installation

Free-space mode installs Omarchy into unallocated space and can coexist with Windows or another OS. Prepare it by:

Saving recovery keys and proving the backup inside the old system.
Turning off BitLocker and Fast Startup on Windows.
Shrinking the volume with the old system's disk tool, leaving unallocated space.
Booting the official ISO in UEFI mode.
Identifying the target by vendor, capacity, and partition layout.

Do not format EFI, Windows, or recovery partitions. See the dual-boot guide for the complete risk model.

Prepare a machine for another owner

When setting up hardware for family, an employee, or a buyer, do not choose credentials on their behalf. The current installer allows Ctrl + C on its first keyboard screen to select preparation for another owner. Installation completes, while keyboard, username, account password, and encryption password are deferred to first boot.

Before handoff, verify that installation finished and the device reaches the first-owner flow. Do not create a temporary personal account and describe that as a clean handoff. An existing device also requires the official reset and data-boundary procedure.

Unattended installation

When the installer finds a second drive labeled cidata with configuration files, it can skip the wizard. This targets VMs, Packer or Proxmox images, and fleets. Key files include:

File	Purpose
`user_configuration.json`	Disk, host, timezone, and keyboard
`user_credentials.json`	Username and password hash
`authorized_keys`	Optional SSH public keys
`tailscale_authkey`	Optional Tailscale join token
`defer-provisioning`	Defer account setup to the final owner

The safest starting point is one interactive installation in an isolated VM, followed by copying the structure the current installer actually generated. Do not guess JSON fields from an old post.

Treat cidata as sensitive

Encryption configuration can carry a disk passphrase in plaintext, and a Tailscale key grants network access. Restrict access, set expiry where possible, destroy the media after use, and never commit it to Git.

“Unattended” is not always zero-touch: an encrypted machine still needs its LUKS passphrase at first boot. When SSH keys are included, verify the firewall and remote-access boundary.

Unencrypted installation

Full-disk encryption is the official default and the responsible baseline for portable or losable computers. Consider no encryption only for protected remote hardware, a disposable VM, or a system explicitly containing no sensitive data. The current manual exposes this alternative through Ctrl + C at disk-format confirmation.

Without encryption, physical access exposes the data directly. Boot convenience alone is not a sufficient reason; remote infrastructure deserves a deliberate key and boot design.

Manual Arch conversion and install scripts

Older Omarchy guides often begin with Arch and run an installation script, while the current official path is the ISO. Do not run an old script on a working Arch workstation unless the present release explicitly supports that conversion. It may replace repositories, bootloader, user configuration, and desktop packages.

If research is necessary, take a VM snapshot, read the script and release tag, list every package, repository, service, boot, and user-file change, then decide whether the tradeoff is acceptable.

Validate the result

Boot and unlock normally.
Ensure the final owner—not the installer—completes personal setup.
Verify network, SSH, and Tailscale access boundaries.
Confirm UEFI and snapshot entries.
Remove leftover cidata media, tokens, and installer logs.
Prove backups and recovery are reachable from another device.

Sources: Omarchy Getting Started, Unattended Installs, and Dual Boot Install.