diff --git a/Documentation/img/machine-lifecycle.png b/Documentation/img/machine-lifecycle.png
new file mode 100644
index 00000000..dd94e4dc
Binary files /dev/null and b/Documentation/img/machine-lifecycle.png differ
diff --git a/Documentation/machine-lifecycle.md b/Documentation/machine-lifecycle.md
new file mode 100644
index 00000000..10023df7
--- /dev/null
+++ b/Documentation/machine-lifecycle.md
@@ -0,0 +1,13 @@
+
+# Lifecycle of a Physical Machine
+
+A physical machine [network boots](network-booting.md) in an network boot environment created by [coreos/dnsmasq](../contrib/dnsmasq) or a custom DHCP/TFTP/DNS setup.
+
+`bootcfg` serves iPXE, GRUB, or Pixiecore boot configs via HTTP to machines matching attribute selectors (UUID, MAC, region, etc.). The referenced kernel and initrd images are fetched and booted with an initial Ignition config for installing CoreOS. CoreOS is installed to disk and the Ignition config for the machine is fetched from `bootcfg` before rebooting.
+
+The CoreOS machine boots (first boot from disk) and runs its Ignition config to provision its disk with systemd units, files, keys, etc. On subsequent reboots, systemd units may fetch dynamic metadata if needed. Ignition is not run again.
+
+CoreOS hosts should have automatic updates enabled and use a system like fleet or Kubernetes to run containers to tolerate node updates or failures without operator intervention. Use IPMI or vendor utilities to re-provision machines to change their role, rather than mutation.
+
+![Machine Lifecycle](img/machine-lifecycle.png)
+
diff --git a/README.md b/README.md
index c5d56b2a..10084888 100644
--- a/README.md
+++ b/README.md
@@ -8,10 +8,11 @@ CoreOS on Baremetal contains guides for network booting and configuring CoreOS c
 ## Guides
 
 * [Network Booting](Documentation/network-booting.md)
+* [Machine Lifecycle](Documentation/machine-lifecycle.md)
 
 ## bootcfg
 
-`bootcfg` is a HTTP and gRPC service that renders signed [Ignition configs](https://coreos.com/ignition/docs/latest/what-is-ignition.html), [cloud-configs](https://coreos.com/os/docs/latest/cloud-config.html), network boot configs, and metadata to machines based on attribute selectors (e.g. UUID, MAC, stage, region) to create CoreOS clusters. Network boot endpoints provide PXE, iPXE, GRUB, and Pixiecore support. `bootcfg` can run as an [ACI](https://github.com/appc/spec) with [rkt](https://coreos.com/rkt/docs/latest/), as a Docker container, or as a binary.
+`bootcfg` is a HTTP and gRPC service that renders signed [Ignition configs](https://coreos.com/ignition/docs/latest/what-is-ignition.html), [cloud-configs](https://coreos.com/os/docs/latest/cloud-config.html), network boot configs, and metadata to machines based on attribute labels (e.g. UUID, MAC, stage, region) to create CoreOS clusters. Network boot endpoints provide PXE, iPXE, GRUB, and Pixiecore support. `bootcfg` can run as an [ACI](https://github.com/appc/spec) with [rkt](https://coreos.com/rkt/docs/latest/), as a Docker container, or as a binary.
 
 * [Getting Started with rkt](Documentation/getting-started-rkt.md)
 * [Getting Started with Docker](Documentation/getting-started-docker.md)