Re: Partition table instead of LVM inside a LUKS container

"Brian J. Murrell" <[email protected]> Sun, 25 Feb 2024 10:36:38 -0500

Newsgroups	dev.linux.lists.cryptsetup
Message-ID	<[email protected]>

On Sun, 2024-02-25 at 16:14 +0100, Mistave wrote:
> Hello,

Hi.

> Just a request for some opinions and suggestions.

Since you asked about opinions… :-)

Note that I am not really going to answer your question directly but
rather wonder about motivations.

> In most online tutorials about encrypted linux setups it's
> recommended 
> to use LVM (and by that I mean tools like pvcreate, vgcreate and 
> lvcreate) on-top of a LUKS container to further partition the
> encrypted 
> block device.

I personally put LVM on every machine I build.  I only use partitions
as the vehicle to getting a bootable LVM-ized system.  That is
typically two partitions at most, one for the boot filesystem and one
for the LVM PV which is the rest of the disk.  I'd even dispense with
partitions entirely and use LVM on the whole disk (i.e. /dev/sda) if
GRUB could boot from LVM, which I have done in the past but it seems
frowned upon.

> However, my question is that, provided you are using a 
> full device encryption (e.g. "cryptsetup luksFormat /dev/sdb" and
> then 
> "cryptsetup open /dev/sdb container"), are there any negative effects
> of 
> simply skipping LVM and creating a partition table with partitions 
> directly on the new dm-crypt device?

The "negative effects" in my mind is the huge backwards step in time
and manageability of a system using partitions.  They are an antiquated
hack of yesteryear.  LVM makes the management of block devices so much
more wonderful.  Resizing, creating and destroying unlimited numbers of
block devices which you can build/destroy any time you want while the
system is running (assuming you do not do the other silly thing which
is creating one single large block device and putting absolutely
everything in it), etc.

So while I cannot comment on any experience with using partitions
inside of a LUKS container, I just couldn't imagine not using LVM.

What is your hesitance to using LVM?

Cheers,
b.

signature.asc (application/pgp-signature, 488 B)