• 5 Posts
  • 39 Comments
Joined 2 years ago
cake
Cake day: July 5th, 2023

help-circle










  • You can do encrypted swap as well. If you use the same passphrase you can install decrypt_keyctl and use it as described here. It will cache the passphrase and send it to every other LUKS volume that needs decrypting so you have to type it only once. This is what I’m currently using and my root is on ZFS on LUKS.

    Another option which I haven’t used is to have a small volume that only stores your LUKS keys as files, then your LUKS volumes reference those files as keys, then you decrypt only that volume with a passphrase upon boot.

    Another option is to use a swap file. I used to run Ubuntu LTS on LUKS on LVM. That is disk > EFI and LVM partitions > LVM volume boot, LVM volume for LUKS > root filesystem inside LUKS > swapfile in that root filesystem. Upon boot, GRUB is able to read the Linux kernel straight from the boot volume on LVM. Boots the kernel. You get a prompt to decrypt the LUKS volume where the root filesystem is. Once decrypted, the kernel can access the swapfile if it needs to resume from it. If I didn’t use ZFS, I’d be using this scheme as it’s superbly flexible. Growing the volumes and filesystems for larger storage is easy. Adding redundancy via LVMRAID is easy. Changing the swap size is easy. Hibernation works.









  • It’s more than a packaging format but yes. It includes all dependencies needed to run the main program in a container but the kernel. It’s a complete separate root filesystem. When you run it, as intended, a single process is started which loads all the things it needs from that filesystem. It’s isolated from the rest of the system unless you share resources with it, like directories or special devices. Obviously this results in larger packages but there is a clever way to save on that overhead with layering, so in practice while still significantly larger than single program deb files, it’s not nearly as bad as it sounds. The thing is that Flatpak and Snap also package dependencies to a different degree.