ISO

Add .tar.zst packages on the install iso (rad should install to custom root, a la pacstrap)
Add limine, (mtools?) and parted to install iso
Add dosfstools, efibootmgr and gptfdisk to install iso
Do not add microcode or firmware to live iso?
Modify /etc/issue and add date and username and pass: https://www.linuxfromscratch.org/blfs/view/svn/postlfs/logon.html
makewhatis /usr/share/man to update man-pages
Prefer cat to dd

Live

sleep is essential to avoid race conditions; unfortunately rootdelay and rootwait are not available in live environments
Mounting a device /dev/sda is type iso9660
Mounting a partition /dev/sda3 is type hfsplus
If detected as /dev/sr0 it is type iso9660
if detected as hard drive (usb) it is type hfsplus
xorriso requires -hfsplus -apm-block-size 2048 to work on a bootable USB (Hybrid setup) (default on grub-mkrescue)
Avoid rEFInd (fork of rEFIt from macOS)
Avoid EFI editors like efibootmgr, bcfg and kesboot (mess motherboard’s NVRAM and EFI)
EFI/BOOT should be under / and not under /boot (xorriso)
Recommended size of /boot and ESP: https://www.rodsbooks.com/efi-bootloaders/principles.html
vfat vs fat32 vs fat for ESP partition: https://uefi.org/specifications
Volume ID should be in capital letters according to ISO 9660 (GLAUCUS) (ECMA-119 demands ASCII characters out of A-Z0-9_)
Suse removed bios support from iso
Do not further compress the iso with zstd if the fs is already compressed by EROFS or SquashFS
After mounting overlay all previous mounts need to be moved using mount --move to identical mountpoints inside the overlay, otherwise switch_root will error out with failed to unlink and directory not empty
ISOs should be hybrid; can be written directly to CD/DVD/BD media OR to USB sticks
Distributions with good ISOs include Arch and eweOS
Distributions with not so great ISOs include Chimera and Void
Do not forget to generate the initramfs before generating the iso
Do not forget to have dash installed before generating the initramfs
Let the kernel use the defaults for its command-line parameters (e.g. loglevel and ro/rw)
fakeroot can be used instead of sudo for generating images, managing mounts and make installs for DESTDIRs that require root

Software

cdrtools (includes mkisofs)
libburnia (includes libisoburn, xorriso and cdrskin)
mkisofs (part of cdrtools, people switched to xorriso, license?)
xorrecord (emulation of cdrecord by xorriso)
xorrisofs (emulation of mkisofs by xorriso)

Excluded

cdrdao (GUI)
cdrecord (deprecated version of cdrtools)
cdrkit (deprecated fork of cdrtools, Mr. Schilling says it sucks, filled with bugs and license concerns)
cdw (GUI)
dvd+rw-tools (deprecated, aka growisofs, does not deal with CDs)
genisofs
genisoimage (deprecated, fork of mkisofs, from cdrkit)
wodim (deprecated, fork of cdrecord, from cdrkit)

ISO 9660 Extensions (relax limitations)

Apple ISO 9660 Extensions (file characteristics specific to the classic Mac OS and macOS, such as resource forks, file backup date and more)
El Torito (enables CDs to be bootable)
Joliet (Unicode, allowing non-Latin scripts to be used)
Rock Ridge (Unix-style permissions and longer names)

Booster

Does not support live environments
e1000 provides internet access inside QEMU, and has been added to the default booster configuration
After install, booster should be rerun to generate a native non-universal build

GRUB

Do not use --disable-shim-lock to disable shim_lock as it would render the iso not bootable when Secure Boot is enabled
Arch images do not support Secure Boot; disable Secure Boot to boot the install medium, and if desired, it can be set up after install
you can’t use more than 300k files on an ISO, which is why we have to disable hfsplus when creating ISO: -hfsplus off (This does not work with xorriso in grub-mkrescue)
-r enables Rock Ridge and changes file ownership to 0; using sudo without -r does not change file ownership
grub-mkrescue runs xorriso:

xorriso \
  -as mkisofs \
  -graft-points \
  --modification-date=2024053120334500 \
  -b boot/grub/i386-pc/eltorito.img \
  -no-emul-boot \
  -boot-load-size 4 \
  -boot-info-table \
  --grub2 \
  -boot-info \
  --grub2-mbr /usr/lib/grub/i386-pc/boot_hybrid.img \
  -hfsplus -apm-block-size 2048 \
  -hfsplus-file-creator-type chrp tbxj /System/Library/CoreServices/.disk_label \
  -hfs-bless-by i /System/Library/CoreServices/boot.efi \
  --efi-boot efi.img \
  -efi-boot-part \
  --efi-boot-image \
  --protective-msdos-label \
  -o glaucus.iso \
  -r /tmp/grub.yu5TLx \
  --sort-weight 0 / \
  --sort-weight 1 \
  /boot iso $APPENDED_OPTIONS

Previous grub-mkrescue command to generate glaucus iso

# `-boot-info-table` can only be used when an argument is passed with `-b`
# `-R` is enabled by default by `xorrisofs`
# `-pad` is enabled by default by `xorrisofs`
# `-cache-inodes` is a relic from `genisoimage`, ignored by `xorriso`
# `-hfsplus off` does not work with `grub-mkrescue`
# `-no-hfs` does not work with `grub-mkrescue`
# `-d`, `-omit-period` violates iso9660
# `-N`, `-omit-version-number` violates iso9660
# `-max-iso9660-filenames` violates iso9660
# `-relaxed-filenames` violates iso9660
# `-allow-lowercase` violates iso9660

grub-mkrescue \
  --compress=no \
  --fonts="" \
  --locales="" \
  --themes="" \
  -v \
  --core-compress=none \
  -o glaucus.iso \
  --product-name glaucus \
  --product-version glaucus \
  $1 \
  -A glaucus \
  -iso-level 3 \
  -J \
  -joliet-long \
  -l \
  -pad \
  -publisher glaucus \
  -p glaucus \
  -R \
  -r \
  -V GLAUCUS \
  -vv

fstab

The number before last in the table structure is an outdated backup method and should not be used (kept 0)
The last number in the table is the File System Check Order: (second digit). 0 means that fsck will not check the filesystem. Numbers higher than this represent the check order. The root filesystem should be set to 1 and other partitions set to 2.
Consider the following fstab for EROFS/overlayfs:

/iso/fs /media/fs-ro erofs   defaults,loop                                                                        0 0
overlay /            overlay defaults,lowerdir=/media/fs-ro,upperdir=/media/fs-rw/upper,workdir=/media/fs-rw/work 0 0

OverlayFS (rw)

lower should be ro
upper and work should be rw in a tmpfs space like /run and not in something like /media (cdrom can be kept in /media though)
switch_root is responsible for moving proc, dev and sys to the new root

Alpine

Uses grub for efi and isolinux for bios
SquashFS inside boot called modloop is mounted on /.modloop using /dev/loop0
tmpfs mounted on / for rw
Installs packages in apks directory

Arch

systemd-boot for efi and isolinux for bios

Kiss

no rootfs; either the initramfs is being used directly or packages are being extracted at boot time?
requires at least 2 GB of RAM to boot to extract all the packages
ram on / type tmpfs
base install packages in pkgs

Misc

perl adds 83M to the iso if provided

ISO

Live

Software

Excluded

ISO 9660 Extensions (relax limitations)

Booster

GRUB

fstab

OverlayFS (rw)

Alpine

Arch

Kiss

Misc

References