3 ms·
As others, I'm running ZFS with native encryption on my daily driver Linux box (Arch). As others have said, I like the benefits, which are easy send/receive, e
by vladvasiliu 4y ago
As others, I'm running ZFS with native encryption on my daily driver Linux box (Arch).
As others have said, I like the benefits, which are easy send/receive, etc (but mind the bugs some other commenter mentioned).
I will also give a few drawbacks / points in favor of using LUKS.
In my case, Arch usually has up-to-date kernels. These are not always compatible with the latest stable OpenZFS release. Issues go from benign: ultra-high CPU usage so my 980 PRO ssd is slower than spinning rust to the module not compiling at all.
Another drawback is that booting with systemd in initramfs doesn't support zfs native encryption. There's no support for using a TPM [0]. So you have to type in your password every time you boot up the computer. If you want hibernation to work, you need a separate swap, encrypted separately, so that's two passwords to type in.
Systemd recently got support for TPM so can automatically decrypt devices. I have this set up on a separate machine (with ext4) and it's nice.
---
[0] I know not everyone likes the idea of automatically decrypting the drive, but that's another debate. If your threat model allows for this, it can be done with LUKS but not with ZFS.
- uniqueuid 4y agoThere recently was an issue where the deprecation of a kernel header (with version 5) lead to ZFS losing access to hardware accelerated (vectorized) checksums [1]. As far as I know, the issue is now resolved, but I haven't followed this closely. [1] https://github.com/openzfs/zfs/issues/8259 https://github.com/openzfs/zfs/issues/8259
- vladvasiliu 4y agoYes it's been resolved. It was around the time kernel 5.16 came out, but it took a while for the fix to land in stable. I actually followed this closely, since that's when I had got a new Laptop with a new SSD and when I tried to benchmark it, I was going crazy trying to find the culprit. Because an older PC with a slower ssd (and older kernel at the time of benchmarking) was something like 25 times faster.