Hacker News Reader

I haven't tried it myself with encryption, but I can't see it making a difference. The bootloader, and initial ZFS setup will be what needs to be changed to facilitate encryption.

View on HN

Hmm, how/when/where would the ‘zfs load-key’ happen?

I only know how to use the systemd-ask-password hack to decrypt non-root datasets, but can’t get my head around how that would work with fully encrypted root dataset.

If you're using Arch, the zfs hook that comes with the archzfs package takes care of this:

https://github.com/archzfs/zfs-utils/blob/master/zfs-utils.i...

Presumably it would be like FreeBSD's GELI, where early boot stuff would need to detect that it's looking at an encrypted root and know to prompt. In theory, this is relatively straightforward- with boot environments, the zpool bootfs property indicates the root dataset, so I wouldn't think you need to look too far.

[edit: this is done in our loader, so presumably you'd use grub?]

Reply on news.ycombinator.com