diff --git a/metropolis/node/build/genosrelease/BUILD.bazel b/metropolis/node/build/genosrelease/BUILD.bazel
index bd66e56..bae7f1d 100644
--- a/metropolis/node/build/genosrelease/BUILD.bazel
+++ b/metropolis/node/build/genosrelease/BUILD.bazel
@@ -11,5 +11,5 @@
 go_binary(
     name = "genosrelease",
     embed = [":go_default_library"],
-    visibility = ["//metropolis/node:__pkg__"],
+    visibility = ["//metropolis/node:__subpackages__"],
 )
diff --git a/metropolis/node/installer/BUILD.bazel b/metropolis/node/installer/BUILD.bazel
new file mode 100644
index 0000000..f69ecbe
--- /dev/null
+++ b/metropolis/node/installer/BUILD.bazel
@@ -0,0 +1,47 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
+load("//metropolis/node/build:def.bzl", "node_initramfs")
+load("//metropolis/node/build/genosrelease:defs.bzl", "os_release")
+load("//metropolis/node/build:efi.bzl", "efi_unified_kernel_image")
+
+go_library(
+    name = "go_default_library",
+    srcs = ["main.go"],
+    importpath = "source.monogon.dev/metropolis/node/installer",
+    visibility = ["//visibility:private"],
+    deps = [
+        "//metropolis/node/build/mkimage/osimage:go_default_library",
+        "//metropolis/pkg/efivarfs:go_default_library",
+        "//metropolis/pkg/sysfs:go_default_library",
+        "@org_golang_x_sys//unix:go_default_library",
+    ],
+)
+
+go_binary(
+    name = "installer",
+    embed = [":go_default_library"],
+    visibility = ["//visibility:private"],
+)
+
+node_initramfs(
+    name = "initramfs",
+    files = {
+        "//metropolis/node/installer": "/init",
+    },
+    visibility = ["//visibility:private"],
+)
+
+os_release(
+    name = "installer-release-info",
+    os_id = "metropolis-installer",
+    os_name = "Metropolis Installer",
+    stamp_var = "STABLE_METROPOLIS_version",
+)
+
+efi_unified_kernel_image(
+    name = "kernel",
+    cmdline = "console=ttyS0",
+    initramfs = ":initramfs",
+    kernel = "//third_party/linux",
+    os_release = ":installer-release-info",
+    visibility = ["//visibility:public"],
+)
diff --git a/metropolis/node/installer/main.go b/metropolis/node/installer/main.go
new file mode 100644
index 0000000..356247a
--- /dev/null
+++ b/metropolis/node/installer/main.go
@@ -0,0 +1,281 @@
+// Copyright 2020 The Monogon Project Authors.
+//
+// SPDX-License-Identifier: Apache-2.0
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Installer creates a Metropolis image at a suitable block device based on the
+// installer bundle present in the installation medium's ESP, after which it
+// reboots. It's meant to be used as an init process.
+package main
+
+import (
+	"fmt"
+	"io"
+	"log"
+	"os"
+	"path/filepath"
+	"strings"
+	"syscall"
+
+	"golang.org/x/sys/unix"
+	"source.monogon.dev/metropolis/node/build/mkimage/osimage"
+	"source.monogon.dev/metropolis/pkg/efivarfs"
+	"source.monogon.dev/metropolis/pkg/sysfs"
+)
+
+const mib = 1024 * 1024
+
+// mountPseudoFS mounts efivarfs, devtmpfs and sysfs, used by the installer in
+// the block device discovery stage.
+func mountPseudoFS() error {
+	for _, m := range []struct {
+		dir   string
+		fs    string
+		flags uintptr
+	}{
+		{"/sys", "sysfs", unix.MS_NOEXEC | unix.MS_NOSUID | unix.MS_NODEV},
+		{efivarfs.Path, "efivarfs", unix.MS_NOEXEC | unix.MS_NOSUID | unix.MS_NODEV},
+		{"/dev", "devtmpfs", unix.MS_NOEXEC | unix.MS_NOSUID},
+	} {
+		if err := unix.Mkdir(m.dir, 0700); err != nil && !os.IsExist(err) {
+			return fmt.Errorf("couldn't create the mountpoint at %q: %w", m.dir, err)
+		}
+		if err := unix.Mount(m.fs, m.dir, m.fs, m.flags, ""); err != nil {
+			return fmt.Errorf("couldn't mount %q at %q: %w", m.fs, m.dir, err)
+		}
+	}
+	return nil
+}
+
+// mountInstallerESP mounts the filesystem the installer was loaded from based
+// on espPath, which must point to the appropriate partition block device. The
+// filesystem is mounted at /installer.
+func mountInstallerESP(espPath string) error {
+	// Create the mountpoint.
+	if err := unix.Mkdir("/installer", 0700); err != nil {
+		return fmt.Errorf("couldn't create the installer mountpoint: %w", err)
+	}
+	// Mount the filesystem.
+	if err := unix.Mount(espPath, "/installer", "vfat", unix.MS_NOEXEC|unix.MS_RDONLY, ""); err != nil {
+		return fmt.Errorf("couldn't mount the installer ESP (%q -> %q): %w", espPath, "/installer", err)
+	}
+	return nil
+}
+
+// findInstallableBlockDevices returns names of all the block devices suitable
+// for hosting a Metropolis installation, limited by the size expressed in
+// bytes minSize. The install medium espDev will be excluded from the result.
+func findInstallableBlockDevices(espDev string, minSize uint64) ([]string, error) {
+	// Use the partition's name to find and return the name of its parent
+	// device. It will be excluded from the list of suitable target devices.
+	srcDev, err := sysfs.ParentBlockDevice(espDev)
+	// Build the exclusion list containing forbidden handle prefixes.
+	exclude := []string{"dm-", "zram", "ram", "loop", srcDev}
+
+	// Get the block device handles by looking up directory contents.
+	const blkDirPath = "/sys/class/block"
+	blkDevs, err := os.ReadDir(blkDirPath)
+	if err != nil {
+		return nil, fmt.Errorf("couldn't read %q: %w", blkDirPath, err)
+	}
+	// Iterate over the handles, skipping any block device that either points to
+	// a partition, matches the exclusion list, or is smaller than minSize.
+	var suitable []string
+probeLoop:
+	for _, devInfo := range blkDevs {
+		// Skip devices according to the exclusion list.
+		for _, prefix := range exclude {
+			if strings.HasPrefix(devInfo.Name(), prefix) {
+				continue probeLoop
+			}
+		}
+
+		// Skip partition symlinks.
+		if _, err := os.Stat(filepath.Join(blkDirPath, devInfo.Name(), "partition")); err == nil {
+			continue
+		} else if !os.IsNotExist(err) {
+			return nil, fmt.Errorf("while probing sysfs: %w", err)
+		}
+
+		// Skip devices of insufficient size.
+		devPath := filepath.Join("/dev", devInfo.Name())
+		dev, err := os.Open(devPath)
+		if err != nil {
+			return nil, fmt.Errorf("couldn't open a block device at %q: %w", devPath, err)
+		}
+		size, err := unix.IoctlGetInt(int(dev.Fd()), unix.BLKGETSIZE64)
+		dev.Close()
+		if err != nil {
+			return nil, fmt.Errorf("couldn't probe the size of %q: %w", devPath, err)
+		}
+		if uint64(size) < minSize {
+			continue
+		}
+
+		suitable = append(suitable, devInfo.Name())
+	}
+	return suitable, nil
+}
+
+// rereadPartitionTable causes the kernel to read the partition table present
+// in the block device at blkdevPath. It may return an error.
+func rereadPartitionTable(blkdevPath string) error {
+	dev, err := os.Open(blkdevPath)
+	if err != nil {
+		return fmt.Errorf("couldn't open the block device at %q: %w", blkdevPath, err)
+	}
+	defer dev.Close()
+	ret, err := unix.IoctlRetInt(int(dev.Fd()), unix.BLKRRPART)
+	if err != nil {
+		return fmt.Errorf("while doing an ioctl: %w", err)
+	}
+	if syscall.Errno(ret) == unix.EINVAL {
+		return fmt.Errorf("got an EINVAL from BLKRRPART ioctl")
+	}
+	return nil
+}
+
+// initializeSystemPartition writes image contents to the node's system
+// partition using the block device abstraction layer as opposed to slower
+// go-diskfs. tgtBlkdev must contain a path pointing to the block device
+// associated with the system partition. It may return an error.
+func initializeSystemPartition(image io.Reader, tgtBlkdev string) error {
+	// Check that tgtBlkdev points at an actual block device.
+	info, err := os.Stat(tgtBlkdev)
+	if err != nil {
+		return fmt.Errorf("couldn't stat the system partition at %q: %w", tgtBlkdev, err)
+	}
+	if info.Mode()&os.ModeDevice == 0 {
+		return fmt.Errorf("system partition path %q doesn't point to a block device", tgtBlkdev)
+	}
+
+	// Get the system partition's file descriptor.
+	sys, err := os.OpenFile(tgtBlkdev, os.O_WRONLY, 0600)
+	if err != nil {
+		return fmt.Errorf("couldn't open the system partition at %q: %w", tgtBlkdev, err)
+	}
+	defer sys.Close()
+	// Copy the system partition contents. Use a bigger buffer to optimize disk
+	// writes.
+	buf := make([]byte, mib)
+	if _, err := io.CopyBuffer(sys, image, buf); err != nil {
+		return fmt.Errorf("couldn't copy partition contents: %w", err)
+	}
+	return nil
+}
+
+func main() {
+	// Mount sysfs, devtmpfs and efivarfs.
+	if err := mountPseudoFS(); err != nil {
+		log.Fatalf("while mounting pseudo-filesystems: %s", err.Error())
+	}
+	// Read the installer ESP UUID from efivarfs.
+	espUuid, err := efivarfs.ReadLoaderDevicePartUUID()
+	if err != nil {
+		log.Fatalf("while reading the installer ESP UUID: %s", err.Error())
+	}
+	// Look up the installer partition based on espUuid.
+	espDev, err := sysfs.DeviceByPartUUID(espUuid)
+	espPath := filepath.Join("/dev", espDev)
+	if err != nil {
+		log.Fatalf("while resolving the installer device handle: %s", err.Error())
+	}
+	// Mount the installer partition. The installer bundle will be read from it.
+	if err := mountInstallerESP(espPath); err != nil {
+		log.Fatalf("while mounting the installer ESP: %s", err.Error())
+	}
+
+	// Build the osimage parameters.
+	installParams := osimage.Params{
+		PartitionSize: osimage.PartitionSizeInfo{
+			// ESP is the size of the node ESP partition, expressed in mebibytes.
+			ESP: 128,
+			// System is the size of the node system partition, expressed in
+			// mebibytes.
+			System: 4096,
+			// Data must be nonzero in order for the data partition to be created.
+			// osimage will extend the data partition to fill all the available space
+			// whenever it's writing to block devices, such as now.
+			Data: 128,
+		},
+		// Due to a bug in go-diskfs causing slow writes, SystemImage is explicitly
+		// marked unused here, as system partition contents will be written using
+		// a workaround below instead.
+		// TODO(mateusz@monogon.tech): Address that bug either by patching go-diskfs
+		// or rewriting osimage.
+		SystemImage: nil,
+		// TODO(mateusz@monogon.tech): Plug in.
+		EFIPayload:     strings.NewReader("TODO"),
+		NodeParameters: strings.NewReader("TODO"),
+	}
+	// Calculate the minimum target size based on the installation parameters.
+	minSize := uint64((installParams.PartitionSize.ESP +
+		installParams.PartitionSize.System +
+		installParams.PartitionSize.Data + 1) * mib)
+
+	// Look for suitable block devices, given the minimum size.
+	blkDevs, err := findInstallableBlockDevices(espDev, minSize)
+	if err != nil {
+		log.Fatal(err.Error())
+	}
+	if len(blkDevs) == 0 {
+		log.Fatal("couldn't find a suitable block device.")
+	}
+	// Set the first suitable block device found as the installation target.
+	tgtBlkdevName := blkDevs[0]
+	// Update the osimage parameters with a path pointing at the target device.
+	tgtBlkdevPath := filepath.Join("/dev", tgtBlkdevName)
+	installParams.OutputPath = tgtBlkdevPath
+
+	// Use osimage to partition the target block device and set up its ESP.
+	// Create will return an EFI boot entry on success.
+	log.Printf("Installing to %s\n", tgtBlkdevPath)
+	be, err := osimage.Create(&installParams)
+	if err != nil {
+		log.Fatalf("while installing: %s", err.Error())
+	}
+	// The target device's partition table has just been updated. Re-read it to
+	// make the node system partition reachable through /dev.
+	if err := rereadPartitionTable(tgtBlkdevPath); err != nil {
+		log.Fatalf("while re-reading the partition table of %q: %s", tgtBlkdevPath, err.Error())
+	}
+	// Look up the node's system partition path to be later used in the
+	// initialization step. It's always the second partition, right after
+	// the ESP.
+	sysBlkdevName, err := sysfs.PartitionBlockDevice(tgtBlkdevName, 2)
+	if err != nil {
+		log.Fatalf("while looking up the system partition: %s", err.Error())
+	}
+	sysBlkdevPath := filepath.Join("/dev", sysBlkdevName)
+	// Copy the system partition contents.
+	contents := strings.NewReader("TODO") // TODO(mz): plug in
+	if err := initializeSystemPartition(contents, sysBlkdevPath); err != nil {
+		log.Fatalf("while initializing the system partition at %q: %s", sysBlkdevPath, err.Error())
+	}
+
+	// Create an EFI boot entry for Metropolis.
+	en, err := efivarfs.CreateBootEntry(be)
+	if err != nil {
+		log.Fatalf("while creating a boot entry: %s", err.Error())
+	}
+	// Erase the preexisting boot order, leaving Metropolis as the only option.
+	if err := efivarfs.SetBootOrder(&efivarfs.BootOrder{uint16(en)}); err != nil {
+		log.Fatalf("while adjusting the boot order: %s", err.Error())
+	}
+
+	// Reboot.
+	unix.Sync()
+	log.Print("Installation completed. Rebooting.")
+	unix.Reboot(unix.LINUX_REBOOT_CMD_RESTART)
+}
diff --git a/metropolis/pkg/sysfs/BUILD.bazel b/metropolis/pkg/sysfs/BUILD.bazel
index e7de943..87fa937 100644
--- a/metropolis/pkg/sysfs/BUILD.bazel
+++ b/metropolis/pkg/sysfs/BUILD.bazel
@@ -2,7 +2,10 @@
 
 go_library(
     name = "go_default_library",
-    srcs = ["uevents.go"],
+    srcs = [
+        "block.go",
+        "uevents.go",
+    ],
     importpath = "source.monogon.dev/metropolis/pkg/sysfs",
     visibility = ["//metropolis:__subpackages__"],
 )
diff --git a/metropolis/pkg/sysfs/block.go b/metropolis/pkg/sysfs/block.go
new file mode 100644
index 0000000..f253777
--- /dev/null
+++ b/metropolis/pkg/sysfs/block.go
@@ -0,0 +1,127 @@
+// Copyright 2020 The Monogon Project Authors.
+//
+// SPDX-License-Identifier: Apache-2.0
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Implementation included in this file was written with the aim of easing
+// integration with the interface exposed at /sys/class/block. It assumes sysfs
+// is already mounted at /sys.
+package sysfs
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+)
+
+// PartUUIDMap returns a mapping between partition UUIDs and block device
+// names based on information exposed by uevent. UUID keys of the returned
+// map are represented as lowercase strings.
+func PartUUIDMap() (map[string]string, error) {
+	m := make(map[string]string)
+	// Get a list of block device symlinks from sysfs.
+	const blkDirPath = "/sys/class/block"
+	blkDevs, err := os.ReadDir(blkDirPath)
+	if err != nil {
+		return m, fmt.Errorf("couldn't read %q: %w", blkDirPath, err)
+	}
+	// Iterate over block device symlinks present in blkDevs, creating a mapping
+	// in m for each device with both PARTUUID and DEVNAME keys present in their
+	// respective uevent files.
+	for _, devInfo := range blkDevs {
+		// Read the uevent file and transform it into a string->string map.
+		kv, err := ReadUevents(filepath.Join(blkDirPath, devInfo.Name(), "uevent"))
+		if err != nil {
+			return m, fmt.Errorf("while reading uevents: %w", err)
+		}
+		// Check that the required keys are present in the map.
+		if uuid, name := kv["PARTUUID"], kv["DEVNAME"]; uuid != "" && name != "" {
+			m[uuid] = name
+		}
+	}
+	return m, nil
+}
+
+// DeviceByPartUUID returns a block device name, given its corresponding
+// partition UUID.
+func DeviceByPartUUID(uuid string) (string, error) {
+	pm, err := PartUUIDMap()
+	if err != nil {
+		return "", err
+	}
+	if bdev, ok := pm[strings.ToLower(uuid)]; ok {
+		return bdev, nil
+	}
+	return "", fmt.Errorf("couldn't find a block device matching the partition UUID %q", uuid)
+}
+
+// ParentBlockDevice transforms the block device name of a partition, eg
+// "sda1", to the name of the block device hosting it, eg "sda".
+func ParentBlockDevice(dev string) (string, error) {
+	// Build a path pointing to a sysfs block device symlink.
+	partLink := filepath.Join("/sys/class/block", dev)
+	// Read the symlink at partLink. This should leave us with a path of the form
+	// (...)/sda/sdaN.
+	linkTgt, err := os.Readlink(partLink)
+	if err != nil {
+		return "", fmt.Errorf("couldn't read the block device symlink at %q: %w", partLink, err)
+	}
+	// Remove the last element from the path, leaving us with a path pointing to
+	// the block device containting the installer partition, of the form
+	// (...)/sda.
+	devPath := filepath.Dir(linkTgt)
+	// Get the last element of the path, leaving us with just the block device
+	// name, eg sda
+	devName := filepath.Base(devPath)
+	return devName, nil
+}
+
+// PartitionBlockDevice returns the name of a block device associated with the
+// partition at index in the containing block device dev, eg "nvme0n1pN" for
+// "nvme0n1" or "sdaN" for "sda".
+func PartitionBlockDevice(dev string, index int) (string, error) {
+	dp := filepath.Join("/sys/class/block", dev)
+	dir, err := os.ReadDir(dp)
+	if err != nil {
+		return "", err
+	}
+	for _, info := range dir {
+		// Skip non-directories
+		if !info.IsDir() {
+			continue
+		}
+		// Check whether the directory contains a file named 'partition'. If that's
+		// the case, read the partition index from it and compare it with the one
+		// supplied as a function parameter. If they're equal, return the directory
+		// name.
+		istr, err := os.ReadFile(filepath.Join(dp, info.Name(), "partition"))
+		if os.IsNotExist(err) {
+			continue
+		}
+		if err != nil {
+			return "", err
+		}
+		// istr holds a newline-terminated ASCII-encoded decimal number.
+		pi, err := strconv.Atoi(strings.TrimSuffix(string(istr), "\n"))
+		if err != nil {
+			return "", fmt.Errorf("failed to parse partition index: %w", err)
+		}
+		if pi == index {
+			return info.Name(), nil
+		}
+	}
+	return "", fmt.Errorf("couldn't find partition %d of %q", index, dev)
+}
diff --git a/metropolis/test/installer/BUILD.bazel b/metropolis/test/installer/BUILD.bazel
new file mode 100644
index 0000000..28ede12
--- /dev/null
+++ b/metropolis/test/installer/BUILD.bazel
@@ -0,0 +1,27 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+
+go_test(
+    name = "installer",
+    size = "small",
+    data = [
+        "//metropolis/node/installer:kernel",
+        "//third_party/edk2:firmware",
+        "@qemu//:qemu-x86_64-softmmu",
+    ],
+    embed = [":go_default_library"],
+    rundir = ".",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = ["main.go"],
+    importpath = "source.monogon.dev/metropolis/test/installer",
+    visibility = ["//visibility:private"],
+    deps = [
+        "//metropolis/cli/metroctl/core:go_default_library",
+        "//metropolis/node/build/mkimage/osimage:go_default_library",
+        "@com_github_diskfs_go_diskfs//:go_default_library",
+        "@com_github_diskfs_go_diskfs//disk:go_default_library",
+        "@com_github_diskfs_go_diskfs//partition/gpt:go_default_library",
+    ],
+)
diff --git a/metropolis/test/installer/main.go b/metropolis/test/installer/main.go
new file mode 100644
index 0000000..f31290d
--- /dev/null
+++ b/metropolis/test/installer/main.go
@@ -0,0 +1,266 @@
+// Copyright 2020 The Monogon Project Authors.
+//
+// SPDX-License-Identifier: Apache-2.0
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// This package runs the installer image in a VM provided with an empty block
+// device. It then examines the installer console output and the blok device to
+// determine whether the installation process completed without issue.
+package main
+
+import (
+	"bufio"
+	"bytes"
+	"fmt"
+	"io"
+	"log"
+	"os"
+	"os/exec"
+	"syscall"
+	"testing"
+
+	diskfs "github.com/diskfs/go-diskfs"
+	"github.com/diskfs/go-diskfs/disk"
+	"github.com/diskfs/go-diskfs/partition/gpt"
+	mctl "source.monogon.dev/metropolis/cli/metroctl/core"
+	osimage "source.monogon.dev/metropolis/node/build/mkimage/osimage"
+)
+
+const (
+	InstallerEFIPayload = "metropolis/node/installer/kernel.efi"
+	InstallerImage      = "metropolis/test/installer/installer.img"
+	NodeStorage         = "metropolis/test/installer/stor.img"
+)
+
+// runQemu starts a QEMU process and waits for it to finish. args is
+// concatenated to the list of predefined default arguments. It returns true if
+// expectedOutput is found in the serial port output. It may return an error.
+func runQemu(args []string, expectedOutput string) (bool, error) {
+	// Prepare the default parameter list.
+	defaultArgs := []string{
+		"-machine", "q35", "-accel", "kvm", "-nographic", "-nodefaults",
+		"-m", "512",
+		"-smp", "2",
+		"-cpu", "host",
+		"-drive", "if=pflash,format=raw,readonly,file=external/edk2/OVMF_CODE.fd",
+		"-drive", "if=pflash,format=raw,snapshot=on,file=external/edk2/OVMF_VARS.fd",
+		"-drive", "if=virtio,format=raw,snapshot=on,cache=unsafe,file=" + InstallerImage,
+		"-serial", "stdio",
+		"-no-reboot",
+	}
+	// Join the parameter lists and prepare the Qemu command, but don't run it
+	// just yet.
+	qemuArgs := append(defaultArgs, args...)
+	qemuCmd := exec.Command("external/qemu/qemu-x86_64-softmmu", qemuArgs...)
+
+	// Copy the stdout and stderr output so that it could be matched against
+	// expectedOutput later.
+	var outBuf, errBuf bytes.Buffer
+	outWriter := bufio.NewWriter(&outBuf)
+	errWriter := bufio.NewWriter(&errBuf)
+	qemuCmd.Stdout = io.MultiWriter(os.Stdout, outWriter)
+	qemuCmd.Stderr = io.MultiWriter(os.Stderr, errWriter)
+	if err := qemuCmd.Run(); err != nil {
+		return false, fmt.Errorf("couldn't start QEMU: %w", err)
+	}
+	outWriter.Flush()
+	errWriter.Flush()
+
+	// Try matching against expectedOutput and return the result.
+	result := bytes.Contains(outBuf.Bytes(), []byte(expectedOutput)) ||
+		bytes.Contains(errBuf.Bytes(), []byte(expectedOutput))
+	return result, nil
+}
+
+// getStorage creates a sparse file, given a size expressed in mebibytes, and
+// returns a path to that file. It may return an error.
+func getStorage(size int64) (string, error) {
+	image, err := os.Create(NodeStorage)
+	if err != nil {
+		return "", fmt.Errorf("couldn't create the block device image at %q: %w", NodeStorage, err)
+	}
+	if err := syscall.Ftruncate(int(image.Fd()), size*1024*1024); err != nil {
+		return "", fmt.Errorf("couldn't resize the block device image at %q: %w", NodeStorage, err)
+	}
+	image.Close()
+	return NodeStorage, nil
+}
+
+// qemuDriveParam returns QEMU parameters required to run it with a
+// raw-format image at path.
+func qemuDriveParam(path string) []string {
+	return []string{"-drive", "if=virtio,format=raw,snapshot=off,cache=unsafe,file=" + path}
+}
+
+// checkEspContents verifies the presence of the EFI payload inside of image's
+// first partition. It returns nil on success.
+func checkEspContents(image *disk.Disk) error {
+	// Get the ESP.
+	fs, err := image.GetFilesystem(1)
+	if err != nil {
+		return fmt.Errorf("couldn't read the installer ESP: %w", err)
+	}
+	// Make sure the EFI payload exists by attempting to open it.
+	efiPayload, err := fs.OpenFile(osimage.EFIPayloadPath, os.O_RDONLY)
+	if err != nil {
+		return fmt.Errorf("couldn't open the installer's EFI Payload at %q: %w", osimage.EFIPayloadPath, err)
+	}
+	efiPayload.Close()
+	return nil
+}
+
+func TestMain(m *testing.M) {
+	// Build the installer image with metroctl, given the EFI executable
+	// generated by Metropolis buildsystem. This mimics standard usage of
+	// metroctl CLI.
+	installer, err := os.Open(InstallerEFIPayload)
+	if err != nil {
+		log.Fatalf("Couldn't open the installer EFI executable at %q: %s", InstallerEFIPayload, err.Error())
+	}
+	info, err := installer.Stat()
+	if err != nil {
+		log.Fatalf("Couldn't stat the installer EFI executable: %s", err.Error())
+	}
+	iargs := mctl.MakeInstallerImageArgs{
+		Installer:     installer,
+		InstallerSize: uint64(info.Size()),
+		TargetPath:    InstallerImage,
+	}
+	if err := mctl.MakeInstallerImage(iargs); err != nil {
+		log.Fatalf("Couldn't create the installer image at %q: %s", InstallerImage, err.Error())
+	}
+	// With common dependencies set up, run the tests.
+	code := m.Run()
+	// Clean up.
+	os.Remove(InstallerImage)
+	os.Exit(code)
+}
+
+func TestInstallerImage(t *testing.T) {
+	// This test examines the installer image, making sure that the GPT and the
+	// ESP contents are in order.
+	image, err := diskfs.OpenWithMode(InstallerImage, diskfs.ReadOnly)
+	if err != nil {
+		t.Errorf("Couldn't open the installer image at %q: %s", InstallerImage, err.Error())
+	}
+	// Verify that GPT exists.
+	ti, err := image.GetPartitionTable()
+	if ti.Type() != "gpt" {
+		t.Error("Couldn't verify that the installer image contains a GPT.")
+	}
+	// Check that the first partition is likely to be a valid ESP.
+	pi := ti.GetPartitions()
+	esp := (pi[0]).(*gpt.Partition)
+	if esp.Start == 0 || esp.End == 0 {
+		t.Error("The installer's ESP GPT entry looks off.")
+	}
+	// Verify that the image contains only one partition.
+	second := (pi[1]).(*gpt.Partition)
+	if second.Name != "" || second.Start != 0 || second.End != 0 {
+		t.Error("It appears the installer image contains more than one partition.")
+	}
+	// Verify the ESP contents.
+	if err := checkEspContents(image); err != nil {
+		t.Error(err.Error())
+	}
+}
+
+func TestNoBlockDevices(t *testing.T) {
+	// No block devices are passed to QEMU aside from the install medium. Expect
+	// the installer to fail at the device probe stage rather than attempting to
+	// use the medium as the target device.
+	expectedOutput := "couldn't find a suitable block device"
+	result, err := runQemu(nil, expectedOutput)
+	if err != nil {
+		t.Error(err.Error())
+	}
+	if result != true {
+		t.Errorf("QEMU didn't produce the expected output %q", expectedOutput)
+	}
+}
+
+func TestBlockDeviceTooSmall(t *testing.T) {
+	// Prepare the block device the installer will install to. This time the
+	// target device is too small to host a Metropolis installation.
+	imagePath, err := getStorage(64)
+	defer os.Remove(imagePath)
+	if err != nil {
+		t.Errorf(err.Error())
+	}
+
+	// Run QEMU. Expect the installer to fail with a predefined error string.
+	expectedOutput := "couldn't find a suitable block device"
+	result, err := runQemu(qemuDriveParam(imagePath), expectedOutput)
+	if err != nil {
+		t.Error(err.Error())
+	}
+	if result != true {
+		t.Errorf("QEMU didn't produce the expected output %q", expectedOutput)
+	}
+}
+
+func TestInstall(t *testing.T) {
+	// Prepare the block device image the installer will install to.
+	storagePath, err := getStorage(4096 + 128 + 128 + 1)
+	defer os.Remove(storagePath)
+	if err != nil {
+		t.Errorf(err.Error())
+	}
+
+	// Run QEMU. Expect the installer to succeed.
+	expectedOutput := "Installation completed"
+	result, err := runQemu(qemuDriveParam(storagePath), expectedOutput)
+	if err != nil {
+		t.Error(err.Error())
+	}
+	if result != true {
+		t.Errorf("QEMU didn't produce the expected output %q", expectedOutput)
+	}
+
+	// Verify the resulting node image. Check whether the node GPT was created.
+	storage, err := diskfs.OpenWithMode(storagePath, diskfs.ReadOnly)
+	if err != nil {
+		t.Errorf("Couldn't open the resulting node image at %q: %s", storagePath, err.Error())
+	}
+	// Verify that GPT exists.
+	ti, err := storage.GetPartitionTable()
+	if ti.Type() != "gpt" {
+		t.Error("Couldn't verify that the resulting node image contains a GPT.")
+	}
+	// Check that the first partition is likely to be a valid ESP.
+	pi := ti.GetPartitions()
+	esp := (pi[0]).(*gpt.Partition)
+	if esp.Name != osimage.ESPVolumeLabel || esp.Start == 0 || esp.End == 0 {
+		t.Error("The node's ESP GPT entry looks off.")
+	}
+	// Verify the system partition's GPT entry.
+	system := (pi[1]).(*gpt.Partition)
+	if system.Name != osimage.SystemVolumeLabel || system.Start == 0 || system.End == 0 {
+		t.Error("The node's system partition GPT entry looks off.")
+	}
+	// Verify the data partition's GPT entry.
+	data := (pi[2]).(*gpt.Partition)
+	if data.Name != osimage.DataVolumeLabel || data.Start == 0 || data.End == 0 {
+		t.Errorf("The node's data partition GPT entry looks off.")
+	}
+	// Verify that there are no more partitions.
+	fourth := (pi[3]).(*gpt.Partition)
+	if fourth.Name != "" || fourth.Start != 0 || fourth.End != 0 {
+		t.Error("The resulting node image contains more partitions than expected.")
+	}
+	// Verify the ESP contents.
+	if err := checkEspContents(storage); err != nil {
+		t.Error(err.Error())
+	}
+}