3 ms·

In addition to what mustache_kimono said, there apparently seem to be issues with kernel functions moving / changing and breaking ZFS which then needs a while

In addition to what mustache_kimono said, there apparently seem to be issues with kernel functions moving / changing and breaking ZFS which then needs a while to catch up. For the latest reoccurrence of this, see https://github.com/openzfs/zfs/pull/15931 https://github.com/openzfs/zfs/pull/15931 for Linux 6.8 compatibility. There's also the fact that not everything is OOB compatible with ZFS. For example, newer versions of systemd have been able to use the TPM to unlock drives encrypted with LUKS. AFAIK it doesn't work with ZFS. I use ZFS on my daily driver Linux box and mostly love it, but as long as these things happen, I can see why people may want to try to find an in-kernel solution. I personally use Arch so expect for bleeding edge updates to not work perfectly right away. But I recall seeing folks complaining about issues on Fedora, too, which I expect to be a bit more conservative than Arch.

didntcheck 3y ago
LUKS and the associated systemd hook shouldn't care about the filesystem, right? It's just block layer But presumably you meant native ZFS encryption, which unfortunately is considered to be somewhat experimental and neglected, as I understand. Which surprised me, since I thought data at rest encryption would be pretty important for an "enterprise" filesystem Still, apparently lots of people successfully run ZFS on LUKS. It does mean you don't get zero-trust zfs send backups, but apparently that's where a lot of the bugs have been anyway
- vladvasiliu 3y ago
  Yes, I was talking about ZFS native encryption. > But presumably you meant native ZFS encryption, which unfortunately is considered to be somewhat experimental and neglected, as I understand. Which surprised me, since I thought data at rest encryption would be pretty important for an "enterprise" filesystem. Yeah, I've happened about someone saying something similar, but I've never seen anything about that from "official" sources. Wouldn't mind a link or something if you have one on hand. But there is the fact that this encryption scheme seems limited when compared to LUKS: there's no support for multiple passphrases or using anything more convenient, like say, a U2F token. > Still, apparently lots of people successfully run ZFS on LUKS. It does mean you don't get zero-trust zfs send backups, but apparently that's where a lot of the bugs have been anyway I'd say I'm one of those people, never had any issue with this in ~ten years of use. And, indeed, the main reason for using this on my laptop is being able to send the snapshots around without having to deal with another tool for managing encryption. Also, on my servers on which I run RAIDZ, having to configure LUKS on top of each drive is a PITA.

didntcheck 3y ago

LUKS and the associated systemd hook shouldn't care about the filesystem, right? It's just block layer But presumably you meant native ZFS encryption, which unfortunately is considered to be somewhat experimental and neglected, as I understand. Which surprised me, since I thought data at rest encryption would be pretty important for an "enterprise" filesystem Still, apparently lots of people successfully run ZFS on LUKS. It does mean you don't get zero-trust zfs send backups, but apparently that's where a lot of the bugs have been anyway

vladvasiliu 3y ago
Yes, I was talking about ZFS native encryption. > But presumably you meant native ZFS encryption, which unfortunately is considered to be somewhat experimental and neglected, as I understand. Which surprised me, since I thought data at rest encryption would be pretty important for an "enterprise" filesystem. Yeah, I've happened about someone saying something similar, but I've never seen anything about that from "official" sources. Wouldn't mind a link or something if you have one on hand. But there is the fact that this encryption scheme seems limited when compared to LUKS: there's no support for multiple passphrases or using anything more convenient, like say, a U2F token. > Still, apparently lots of people successfully run ZFS on LUKS. It does mean you don't get zero-trust zfs send backups, but apparently that's where a lot of the bugs have been anyway I'd say I'm one of those people, never had any issue with this in ~ten years of use. And, indeed, the main reason for using this on my laptop is being able to send the snapshots around without having to deal with another tool for managing encryption. Also, on my servers on which I run RAIDZ, having to configure LUKS on top of each drive is a PITA.