Alpine Linux - User contributions [en]

Comparison with other distros

2021-08-03T17:34:00Z

Begs: fix typo

Even if Alpine is designed to run from RAM, it has some similarities in package management with both Gentoo and Debian. This page outlines those similarities and differences, to help Debian and Gentoo users use Alpine.

The page was originally copied from: http://gentoo-wiki.com/TIP_Converting_from_or_to_Debian

= Package management =
Where Gentoo has portage and emerge; Debian has, among others, apt; Alpine uses apk-tools. This section compares how apk-tools is used, in comparison to apt-get/aptitude and emerge.

Note that Gentoo is source-based, just like ports in FreeBSD are, while Debian uses pre-compiled binaries. Alpine is compiled using Gentoo's portage, but Alpine itself uses its own apk-tools binary package which is more similar to FreeBSD's binary packages.

== Updating package database ==
Gentoo will update the build-from-source scripts and the updating of the database takes much more time than updating the database for Debian or Alpine.

'''Alpine'''
apk update

'''Gentoo'''
emaint sync -a

'''Debian'''
aptitude update

== Showing available updates ==
Show which packages have an update available:

'''Alpine'''
apk version -v
or:
apk version -v -l '<'

'''Gentoo'''
emerge --deep --update --pretend @world

'''Debian'''
aptitude upgrade --simulate

== Updating a particular package ==
'''Alpine'''
apk add -u package1 package2
or
apk upgrade package1 package2
'''Debian'''
aptitude install package1 package2
'''Gentoo'''
emerge --update package1 package2

== Installing packages ==
'''Alpine'''
apk add package1 package2

For source compile, see the [[Aports tree]] and the [[abuild]] tool.

'''Gentoo'''
emerge package1 package2
'''Debian'''
apt-get install package1 package2
Debian source compile:
apt-get build-dep package1
apt-get source package1
(optional: customize the build by modifying the debian/rules makefile)
(or set environmental variables like DEB_BUILD_OPTIONS)
(note that this will make your bug reports invalid to the maintainer)
dpkg-buildpackage -rfakeroot -uc -b
dpkg -i generatedpackagename
Simplified source compile:
apt-get build-dep package1
apt-get -b source package1
(the packages are automatically generated using the -b switch above)

'''Note:''' This process can be used to backport packages from testing and unstable by simply adding their respective source repositories to sources.list, which is similar to adding ~x86 to package.keywords in Gentoo. This is explored further in the "Architectures and repositories" section below.

== Reinstalling particular packages ==
'''Alpine'''
apk del package1 package2 && apk add package1 package2
or:
apk fix package1 package2
'''Gentoo'''
emerge --oneshot package1 package2
'''Debian'''
apt-get install --reinstall package1 package2

Note: You ''rarely'' need to reinstall a package on Debian

== Searching the package database ==
'''Alpine'''

Alpine will only search package names.
apk search searchword

'''Gentoo'''

To search the package names and descriptions:
emerge --searchdesc searchword
'''Note:''' On Gentoo, it's actually much better to install and use either the esearch package or the eix package to do a search. You use them like this:
eix searchword

or

esearch searchword

'''Debian'''

apt-cache search searchword
Both emerge and apt-cache search support regular expressions.

To get the long package information on Debian (searching only in package names):
apt-cache search --full --names-only searchword

== Removing packages ==
'''Alpine'''

apk del package1 package2
apk del will remove configuration files when the --purge flag is used. Make sure you have backups of your configuration files. (Using rcs might be an idea)

You will mostly like to take a quick look at the dependencies before you remove packages recursively.

To see dependencies for a package, use:
apk info -R package1 package2

To see if package is required by other packages (is a dependency for another packages), use:
apk info -r package1 package2

'''Gentoo'''
emerge --unmerge package1 package2 (Note: this is unsafe as it does not check dependencies)
emerge --depclean package1 package2 (This will check dependencies)

'''Debian'''
apt-get remove package1 package2
or to remove along with all configuration files
apt-get remove --purge package1 package2

== Only downloading packages ==
This can be useful e.g. if you're on a dial-up connection and want to download everything first and install later.

'''Alpine'''
apk fetch package1 package2
'''Gentoo'''
emerge --fetchonly package1 package2
'''Debian'''
apt-get install --download-only package1 package2

== Cleaning up downloaded packages ==
Compressed packages that were downloaded for installation can easily consume gigabytes of storage space.

'''Alpine'''

Alpine will clean up packages automatically.

'''Gentoo'''
rm -rf /var/cache/distfiles/*
To only remove outdated packages you will need to install the gentoolkit package and use eclean:
eclean distfiles
Cleaning temporary files from emerging packages:
rm -rf /var/tmp/portage/*

'''Debian'''
apt-get clean
Only remove outdated packages:
apt-get autoclean

==Reverse dependencies==

'''Alpine'''

apk-tools will take care of reverse dependencies.

'''Gentoo'''

Reverse dependencies are a major drawback of Gentoo's current portage implementation: It does not take care of them at all at the moment.
If you use the unsafe --unmerge argument, this means that you can uninstall packages needed by others without being warned about it. E.g. you can remove the X server package without portage warning you that KDE (which you have installed as well) depends on it. This way you can actually break your entire system (e.g. by removing glibc).

revdep-rebuild
can fix broken dependencies broken by
emerge --depclean

Recent versions of portage include library tracking and preservation with the preserved-libs feature. Portage will notify you to run {{Cmd| emerge @preserved-rebuild}} to help rebuild binaries that might otherwise become broken.

'''Debian'''

Reverse dependencies are taken care of by dpkg.

= Runlevel & Initscripts =
Runlevels work pretty conventionally on Debian (see details: [http://archive.fo/ZdZIz systemd]). On Alpine and Gentoo, they are a bit different.

== Directories and files ==
In '''Debian''', runlevels are named conventionally (0-6 and S). They are represented by directories in /etc/ called rc*.d (when the default sysv-rc boot loader package is installed; file-rc can be installed instead, and then the relevant file is runlevel.conf).

* /etc/rc0.d
* /etc/rc1.d
* /etc/rcS.d
* /etc/rc2.d
* /etc/rc3.d
* /etc/rc4.d
* /etc/rc5.d
* /etc/rc6.d

In '''Gentoo''', runlevels have the same names, but these are mapped to more self explanatory ones (in /etc/inittab): "boot", "default", "nonetwork", with the option to add more. The directories that represent them are in
/etc/runlevels/:
* /etc/runlevels/boot
* /etc/runlevels/default
* /etc/runlevels/nonetwork

In '''Gentoo''', if a service is not explicitly started in a runlevel, it is stopped when switching to that runlevel! There is no explicit stopping of runlevels as in Debian (/etc/rc?.d/K??service).

In '''both Debian and Gentoo''', which things are started (and stopped) in which runlevels is controlled by links in the runlevel directories to scripts in /etc/init.d/, e.g.:
'''Gentoo'''
$ ls -l /etc/runlevels/boot/hostname
lrwxrwxrwx 1 root root 20 Mar 25 2004 /etc/runlevels/boot/hostname -> /etc/init.d/hostname

'''Debian'''
$ ls -l rcS.d/S40hostname.sh
lrwxrwxrwx 1 root root 21 2004-11-07 00:19 rcS.d/S40hostname.sh -> ../init.d/hostname.sh

'''Alpine'''

In Alpine, runlevels work like they do in Gentoo:

* /etc/runlevels/boot
* /etc/runlevels/default
* /etc/runlevels/sysinit
* /etc/runlevels/nonetwork
* /etc/runlevels/shutdown

== Runlevel management ==
To manage which things to start in which runlevels, use the following commands:

'''Alpine'''

To see current status of services in runlevels, do:
rc-status
To add sshd to default runlevel, do:
rc-update add -k sshd default
The -k option will make sure sshd is stopped when shutting down or reboot.
To remove sshd from all runlevels do:
rc-update del sshd

'''Gentoo'''

rc-update
To add the cupsd to the default runlevel, do:
rc-update add cupsd default
To remove alsasound from the boot runlevel, do:
rc-update del alsasound boot
Also see this wiki page about [http://gentoo-wiki.com/Rc-update gentoo runlevel management with rc-update]

'''Debian'''

update-rc.d
Configure cupsd to be started in runlevels 2, 3, 4, 5, and stopped in 0, 1, 6, with sequence code 20:
update-rc.d cupsd start 20 2 3 4 5 . stop 20 0 1 6 .
or simply:
update-rc.d cupsd defaults
Remove cupsd from all runlevels:
update-rc.d -f cupsd remove

= Config Files =

== /etc/portage/make.conf and use flags ==
While in Gentoo there's a large number of configuration files which control the behaviour of the package management system, there are comparatively fewer in Debian, as there is no need to dictate how to compile software which is downloaded and tweak/alter it. In Gentoo, the file /etc/portage/make.conf is used for much configuration; this includes ''USE'' flags, which influence which elements of packages are compiled, and which libraries to build support for - common USE flags (USE or -USE to specifically negate support) include 'gtk gnome' for Gnome users (and a corresponding -qt -kde -arts) and 'qt kde arts' for KDE users. A Gentoo user's complete set of use flags may look something like this:

'''USE="-kde -arts -qt xv truetype bluetooth crypt slang readline gpm berkdb mmx gdbm tcpd pam libwww ssl nls ethereal perl python esd gif imlib sdl oggvorbis mpeg gnome gtk X motif opengl avi png tiff nptl pcmcia nptl ldap eds"'''

== Architectures and repositories ==
'''Gentoo'''

Also in /etc/portage/make.conf is the '''ACCEPT_KEYWORDS''' setting, with (for an X86-based processor) two settings, '''x86''' for stabler packages, and '''~x86''' for bleeding edge packages. It is however not recommended to make this change in /etc/portage/make.conf. Rather configure this per-package in /etc/portage/package.accept_keywords. It's enough to put a line into that file naming the package (for example 'app-foo/bar'). That file might look like this:

app-crypt/gpg-agent
app-text/docbook-xsl-stylesheets
=app-text/docbook-xml-dtd-4.3-r1

The last line says, that ''only'' version 4.3-r1 should be unmasked. Older and newer versions will still be ignored.

'''Note for non-x86 users:'''
The keywords '''x86''' and '''~x86''' can of course be replaced by '''sparc''' and '''~sparc''' for example.

'''Debian'''

Setting this in Debian is slightly more complicated, and is accomplished by setting different 'repositories' in ''/etc/apt/sources.list'' - along with which 'tree' to use for packages; in Debian, these are '''stable''', '''testing''', and '''unstable'''. An ''/etc/apt/sources.list'' file for a debian testing user may look something like this:

deb http://mirrors.kernel.org/debian testing main non-free contrib
deb ftp://ftp.nerim.net/debian-marillat testing main
deb http://security.debian.org testing/updates main contrib non-free

Alternatively, ''/etc/apt/sources.list'' can contain any number of repositories for any trees, and a default tree (this can be overridden using the -t switch on the command line) in ''/etc/apt/apt.conf'':

APT::Default-Release "testing";

Per-package settings go in ''/etc/apt/preferences'', somewhat like Gentoo's ''/etc/portage/package.keywords''.

== Network ==

'''Alpine'''

Alpine uses /etc/network/interfaces, just like Debian. The main reason is because this is the way busybox does it.

''/etc/network/interfaces'':
auto eth0
iface eth0 inet static
address 192.168.0.1
netmask 255.255.255.0
broadcast 192.168.0.255

auto eth0:0
iface eth0:0 inet static
address 192.168.1.1
netmask 255.255.255.0
broadcast 192.168.1.255
# etc.

'''Gentoo'''

''/etc/conf.d/net'':
config_eth0="192.168.1.100 netmask 255.255.255.0
192.168.2.100 netmask 255.255.255.0"
routes_eth0="default via 192.168.1.1"

Note that this has changed recently. For more information please refer to http://www.gentoo.org/doc/en/handbook/handbook-x86.xml?part=4

'''Debian'''

''/etc/network/interfaces'':
auto eth0
iface eth0 inet static
address 192.168.0.1
netmask 255.255.255.0
broadcast 192.168.0.255

auto eth0:0
iface eth0:0 inet static
address 192.168.1.1
netmask 255.255.255.0
broadcast 192.168.1.255
# etc.

= Comparison chart/Rosetta Stone =

This chart shows how some standard things are done in Alpine compared to other distributions.

{| cellpadding="5" border="1" class="wikitable"
|-
! Action
! Alpine ([http://wiki.alpinelinux.org/wiki/Alpine_Linux_package_management apk])
! Arch Linux ([https://wiki.archlinux.org/index.php/Pacman pacman])
! Gentoo ([http://www.gentoo.org/doc/en/handbook/handbook-x86.xml?part=2&chap=1 emerge])
! Debian/Ubuntu ([http://wiki.debian.org/Aptitude aptitute])
! Fedora/RHEL/SL/CentOS ([http://yum.baseurl.org/wiki/YumCommands yum])
|-
| Update package database
| {{Cmd| apk update}}
| {{Cmd| pacman -Sy}}
| {{Cmd| emerge --sync}}
| {{Cmd| aptitude update}}
| {{Cmd| yum update}}
|-
| Showing available updates
| {{Cmd| apk version -l '<'}}
| {{Cmd| pacman -Qu}}
| {{Cmd| emerge --deep --update --pretend @world}}
| {{Cmd| aptitude upgrade --simulate}}
| {{Cmd| yum list updates}}
|-
| Installing packages
| {{Cmd| apk add [package name]}}
| {{Cmd| pacman -S [package name]}}
| {{Cmd| emerge [package name]}}
| {{Cmd| aptitude install [package name]}}
| {{Cmd| yum install [package name]}}
|-
| Update all installed packages
| {{Cmd| apk upgrade -U -a}}
| {{Cmd| pacman -Su}}
| {{Cmd| emerge --update --deep @world}}
| {{Cmd| aptitude upgrade}}
| {{Cmd| yum update}}
|-
| Searching package database
| {{Cmd| apk search -v '[string]*'}}
| {{Cmd| pacman -Ss [string]}}
| {{Cmd| emerge --search [string]}}
| {{Cmd| aptitude search [string]}}
| {{Cmd| yum search [string]}}
|-
| Removing packages
| {{Cmd| apk del [package name]}}
| {{Cmd| pacman -R [package name]}}
| {{Cmd| emerge --depclean [package name]}}
| {{Cmd| aptitude remove [package name]}}
| {{Cmd| yum remove [package name]}}
|}

[[Category:Package Manager]]

Comparison with other distros

2021-08-03T17:32:11Z

Begs: /* Reinstalling a particular package */

Even if Alpine is designed to run from RAM, it has some similarities in package management with both Gentoo and Debian. This page outlines those similarities and differences, to help Debian and Gentoo users use Alpine.

The page was originally copied from: http://gentoo-wiki.com/TIP_Converting_from_or_to_Debian

= Package management =
Where Gentoo has portage and emerge; Debian has, among others, apt; Alpine uses apk-tools. This section compares how apk-tools is used, in comparison to apt-get/aptitude and emerge.

Note that Gentoo is source-based, just like ports in FreeBSD are, while Debian uses pre-compiled binaries. Alpine is compiled using Gentoo's portage, but Alpine itself uses its own apk-tools binary package which is more similar to FreeBSD's binary packages.

== Updating package database ==
Gentoo will update the build-from-source scripts and the updating of the database takes much more time than updating the database for Debian or Alpine.

'''Alpine'''
apk update

'''Gentoo'''
emaint sync -a

'''Debian'''
aptitude update

== Showing available updates ==
Show which packages have an update available:

'''Alpine'''
apk version -v
or:
apk version -v -l '<'

'''Gentoo'''
emerge --deep --update --pretend @world

'''Debian'''
aptitude upgrade --simulate

== Updating a particular package ==
'''Alpine'''
apk add -u package1 package2
or
apk upgrade package1 package2
'''Debian'''
aptitude install package1 package2
'''Gentoo'''
emerge --update package1 package2

== Installing packages ==
'''Alpine'''
apk add package1 package2

For source compile, see the [[Aports tree]] and the [[abuild]] tool.

'''Gentoo'''
emerge package1 package2
'''Debian'''
apt-get install package1 package2
Debian source compile:
apt-get build-dep package1
apt-get source package1
(optional: customize the build by modifying the debian/rules makefile)
(or set environmental variables like DEB_BUILD_OPTIONS)
(note that this will make your bug reports invalid to the maintainer)
dpkg-buildpackage -rfakeroot -uc -b
dpkg -i generatedpackagename
Simplified source compile:
apt-get build-dep package1
apt-get -b source package1
(the packages are automatically generated using the -b switch above)

'''Note:''' This process can be used to backport packages from testing and unstable by simply adding their respective source repositories to sources.list, which is similar to adding ~x86 to package.keywords in Gentoo. This is explored further in the "Architectures and repositories" section below.

== Reinstalling particular packages ==
'''Alpine'''
apk del package1 package2 && apk add package1 package2
or:
apk fix package1 package2
'''Gentoo'''
emerge --oneshot package1 package2
'''Debian'''
apt-get install --reinstall package1 package2

Note: You ''rarely'' need to reinstall a package on Debian

== Searching the package database ==
'''Alpine'''

Alpine will only search package names.
apk search searchword

'''Gentoo'''

To search the package names and descriptions:
emerge --searchdesc searchword
'''Note:''' On Gentoo, it's actually much better to install and use either the esearch package or the eix package to do a search. You use them like this:
eix searchword

or

esearch searchword

'''Debian'''

apt-cache search searchword
Both emerge and apt-cache search support regular expressions.

To get the long package information on Debian (searching only in package names):
apt-cache search --full --names-only searchword

== Removing packages ==
'''Alpine'''

apk del package1 package2
apk del will remove configuration files when the --purge flag is used. Make sure you have backups of your configuration files. (Using rcs might be an idea)

You will mostly like to take a quick look at the dependencies before you remove packages recursively.

To see dependencies for a package, use:
apk info -R package1 package2

To see if package is required by other packages (is a dependency for another packages), use:
apk info -r package1 package2

'''Gentoo'''
emerge --unmerge package1 package2 (Note: this is unsafe as it does not check dependencies)
emerge --depclean package1 package2 (This will check dependencies)

'''Debian'''
apt-get remove package1 package2
or to remove along with all configuration files
apt-get remove --purge package1 package2

== Only downloading packages ==
This can be useful e.g. if you're on a dial-up connection and want to download everything first and install later.

'''Alpine'''
apk fetch package1 package2
'''Gentoo'''
emerge --fetchonly package1 package2
'''Debian'''
apt-get install --download-only package1 package2

== Cleaning up downloaded packages ==
Compressed packages that were downloaded for installation can easily consume gigabytes of storage space.

'''Alpine'''

Alpine will clean up packages automatically.

'''Gentoo'''
rm -rf /var/cache/distfiles/*
To only remove outdated packages you will need to install the gentoolkit package and use eclean:
eclean distfiles
Cleaning temporary files from emerging packages:
rm -rf /var/tmp/portage/*

'''Debian'''
apt-get clean
Only remove outdated packages:
apt-get autoclean

==Reverse dependencies==

'''Alpine'''

apk-tools will take care of reverse dependencies.

'''Gentoo'''

Reverse dependencies are a major drawback of Gentoo's current portage implementation: It does not take care of them at all at the moment.
If you use the unsafe --unmerge argument, this means that you can uninstall packages needed by others without being warned about it. E.g. you can remove the X server package without portage warning you that KDE (which you have installed as well) depends on it. This way you can actually break your entire system (e.g. by removing glibc).

revdep-rebuild
can fix broken dependencies broken by
emerge --depclean

Recent versions of portage include library tracking and preservation with the preserved-libs feature. Portage will notify you to run {{Cmd| emerge @preserved-rebuild}} to help rebuild binaries that might otherwise become broken.

'''Debian'''

Reverse dependencies are taken care of by dpkg.

= Runlevel & Initscripts =
Runlevels work pretty conventionally on Debian (see details: [http://archive.fo/ZdZIz systemd]). On Alpine and Gentoo, they are a bit different.

== Directories and files ==
In '''Debian''', runlevels are named conventionally (0-6 and S). They are represented by directories in /etc/ called rc*.d (when the default sysv-rc boot loader package is installed; file-rc can be installed instead, and then the relevant file is runlevel.conf).

* /etc/rc0.d
* /etc/rc1.d
* /etc/rcS.d
* /etc/rc2.d
* /etc/rc3.d
* /etc/rc4.d
* /etc/rc5.d
* /etc/rc6.d

In '''Gentoo''', runlevels have the same names, but these are mapped to more self explanatory ones (in /etc/inittab): "boot", "default", "nonetwork", with the option to add more. The directories that represent them are in
/etc/runlevels/:
* /etc/runlevels/boot
* /etc/runlevels/default
* /etc/runlevels/nonetwork

In '''Gentoo''', if a service is not explicitly started in a runlevel, it is stopped when switching to that runlevel! There is no explicit stopping of runlevels as in Debian (/etc/rc?.d/K??service).

In '''both Debian and Gentoo''', which things are started (and stopped) in which runlevels is controlled by links in the runlevel directories to scripts in /etc/init.d/, e.g.:
'''Gentoo'''
$ ls -l /etc/runlevels/boot/hostname
lrwxrwxrwx 1 root root 20 Mar 25 2004 /etc/runlevels/boot/hostname -> /etc/init.d/hostname

'''Debian'''
$ ls -l rcS.d/S40hostname.sh
lrwxrwxrwx 1 root root 21 2004-11-07 00:19 rcS.d/S40hostname.sh -> ../init.d/hostname.sh

'''Alpine'''
In Alpine, runlevels work like they do in Gentoo:

* /etc/runlevels/boot
* /etc/runlevels/default
* /etc/runlevels/sysinit
* /etc/runlevels/nonetwork
* /etc/runlevels/shutdown

== Runlevel management ==
To manage which things to start in which runlevels, use the following commands:

'''Alpine'''

To see current status of services in runlevels, do:
rc-status
To add sshd to default runlevel, do:
rc-update add -k sshd default
The -k option will make sure sshd is stopped when shutting down or reboot.
To remove sshd from all runlevels do:
rc-update del sshd

'''Gentoo'''

rc-update
To add the cupsd to the default runlevel, do:
rc-update add cupsd default
To remove alsasound from the boot runlevel, do:
rc-update del alsasound boot
Also see this wiki page about [http://gentoo-wiki.com/Rc-update gentoo runlevel management with rc-update]

'''Debian'''

update-rc.d
Configure cupsd to be started in runlevels 2, 3, 4, 5, and stopped in 0, 1, 6, with sequence code 20:
update-rc.d cupsd start 20 2 3 4 5 . stop 20 0 1 6 .
or simply:
update-rc.d cupsd defaults
Remove cupsd from all runlevels:
update-rc.d -f cupsd remove

= Config Files =

== /etc/portage/make.conf and use flags ==
While in Gentoo there's a large number of configuration files which control the behaviour of the package management system, there are comparatively fewer in Debian, as there is no need to dictate how to compile software which is downloaded and tweak/alter it. In Gentoo, the file /etc/portage/make.conf is used for much configuration; this includes ''USE'' flags, which influence which elements of packages are compiled, and which libraries to build support for - common USE flags (USE or -USE to specifically negate support) include 'gtk gnome' for Gnome users (and a corresponding -qt -kde -arts) and 'qt kde arts' for KDE users. A Gentoo user's complete set of use flags may look something like this:

'''USE="-kde -arts -qt xv truetype bluetooth crypt slang readline gpm berkdb mmx gdbm tcpd pam libwww ssl nls ethereal perl python esd gif imlib sdl oggvorbis mpeg gnome gtk X motif opengl avi png tiff nptl pcmcia nptl ldap eds"'''

== Architectures and repositories ==
'''Gentoo'''

Also in /etc/portage/make.conf is the '''ACCEPT_KEYWORDS''' setting, with (for an X86-based processor) two settings, '''x86''' for stabler packages, and '''~x86''' for bleeding edge packages. It is however not recommended to make this change in /etc/portage/make.conf. Rather configure this per-package in /etc/portage/package.accept_keywords. It's enough to put a line into that file naming the package (for example 'app-foo/bar'). That file might look like this:

app-crypt/gpg-agent
app-text/docbook-xsl-stylesheets
=app-text/docbook-xml-dtd-4.3-r1

The last line says, that ''only'' version 4.3-r1 should be unmasked. Older and newer versions will still be ignored.

'''Note for non-x86 users:'''
The keywords '''x86''' and '''~x86''' can of course be replaced by '''sparc''' and '''~sparc''' for example.

'''Debian'''

Setting this in Debian is slightly more complicated, and is accomplished by setting different 'repositories' in ''/etc/apt/sources.list'' - along with which 'tree' to use for packages; in Debian, these are '''stable''', '''testing''', and '''unstable'''. An ''/etc/apt/sources.list'' file for a debian testing user may look something like this:

deb http://mirrors.kernel.org/debian testing main non-free contrib
deb ftp://ftp.nerim.net/debian-marillat testing main
deb http://security.debian.org testing/updates main contrib non-free

Alternatively, ''/etc/apt/sources.list'' can contain any number of repositories for any trees, and a default tree (this can be overridden using the -t switch on the command line) in ''/etc/apt/apt.conf'':

APT::Default-Release "testing";

Per-package settings go in ''/etc/apt/preferences'', somewhat like Gentoo's ''/etc/portage/package.keywords''.

== Network ==

'''Alpine'''

Alpine uses /etc/network/interfaces, just like Debian. The main reason is because this is the way busybox does it.

''/etc/network/interfaces'':
auto eth0
iface eth0 inet static
address 192.168.0.1
netmask 255.255.255.0
broadcast 192.168.0.255

auto eth0:0
iface eth0:0 inet static
address 192.168.1.1
netmask 255.255.255.0
broadcast 192.168.1.255
# etc.

'''Gentoo'''

''/etc/conf.d/net'':
config_eth0="192.168.1.100 netmask 255.255.255.0
192.168.2.100 netmask 255.255.255.0"
routes_eth0="default via 192.168.1.1"

Note that this has changed recently. For more information please refer to http://www.gentoo.org/doc/en/handbook/handbook-x86.xml?part=4

'''Debian'''

''/etc/network/interfaces'':
auto eth0
iface eth0 inet static
address 192.168.0.1
netmask 255.255.255.0
broadcast 192.168.0.255

auto eth0:0
iface eth0:0 inet static
address 192.168.1.1
netmask 255.255.255.0
broadcast 192.168.1.255
# etc.

= Comparison chart/Rosetta Stone =

This chart shows how some standard things are done in Alpine compared to other distributions.

{| cellpadding="5" border="1" class="wikitable"
|-
! Action
! Alpine ([http://wiki.alpinelinux.org/wiki/Alpine_Linux_package_management apk])
! Arch Linux ([https://wiki.archlinux.org/index.php/Pacman pacman])
! Gentoo ([http://www.gentoo.org/doc/en/handbook/handbook-x86.xml?part=2&chap=1 emerge])
! Debian/Ubuntu ([http://wiki.debian.org/Aptitude aptitute])
! Fedora/RHEL/SL/CentOS ([http://yum.baseurl.org/wiki/YumCommands yum])
|-
| Update package database
| {{Cmd| apk update}}
| {{Cmd| pacman -Sy}}
| {{Cmd| emerge --sync}}
| {{Cmd| aptitude update}}
| {{Cmd| yum update}}
|-
| Showing available updates
| {{Cmd| apk version -l '<'}}
| {{Cmd| pacman -Qu}}
| {{Cmd| emerge --deep --update --pretend @world}}
| {{Cmd| aptitude upgrade --simulate}}
| {{Cmd| yum list updates}}
|-
| Installing packages
| {{Cmd| apk add [package name]}}
| {{Cmd| pacman -S [package name]}}
| {{Cmd| emerge [package name]}}
| {{Cmd| aptitude install [package name]}}
| {{Cmd| yum install [package name]}}
|-
| Update all installed packages
| {{Cmd| apk upgrade -U -a}}
| {{Cmd| pacman -Su}}
| {{Cmd| emerge --update --deep @world}}
| {{Cmd| aptitude upgrade}}
| {{Cmd| yum update}}
|-
| Searching package database
| {{Cmd| apk search -v '[string]*'}}
| {{Cmd| pacman -Ss [string]}}
| {{Cmd| emerge --search [string]}}
| {{Cmd| aptitude search [string]}}
| {{Cmd| yum search [string]}}
|-
| Removing packages
| {{Cmd| apk del [package name]}}
| {{Cmd| pacman -R [package name]}}
| {{Cmd| emerge --depclean [package name]}}
| {{Cmd| aptitude remove [package name]}}
| {{Cmd| yum remove [package name]}}
|}

[[Category:Package Manager]]

Comparison with other distros

2021-08-03T17:25:54Z

Begs: /* Updating a particular package */

Even if Alpine is designed to run from RAM, it has some similarities in package management with both Gentoo and Debian. This page outlines those similarities and differences, to help Debian and Gentoo users use Alpine.

The page was originally copied from: http://gentoo-wiki.com/TIP_Converting_from_or_to_Debian

= Package management =
Where Gentoo has portage and emerge; Debian has, among others, apt; Alpine uses apk-tools. This section compares how apk-tools is used, in comparison to apt-get/aptitude and emerge.

Note that Gentoo is source-based, just like ports in FreeBSD are, while Debian uses pre-compiled binaries. Alpine is compiled using Gentoo's portage, but Alpine itself uses its own apk-tools binary package which is more similar to FreeBSD's binary packages.

== Updating package database ==
Gentoo will update the build-from-source scripts and the updating of the database takes much more time than updating the database for Debian or Alpine.

'''Alpine'''
apk update

'''Gentoo'''
emaint sync -a

'''Debian'''
aptitude update

== Showing available updates ==
Show which packages have an update available:

'''Alpine'''
apk version -v
or:
apk version -v -l '<'

'''Gentoo'''
emerge --deep --update --pretend @world

'''Debian'''
aptitude upgrade --simulate

== Updating a particular package ==
'''Alpine'''
apk add -u package1 package2
or
apk upgrade package1 package2
'''Debian'''
aptitude install package1 package2
'''Gentoo'''
emerge --update package1 package2

== Installing packages ==
'''Alpine'''
apk add package1 package2

For source compile, see the [[Aports tree]] and the [[abuild]] tool.

'''Gentoo'''
emerge package1 package2
'''Debian'''
apt-get install package1 package2
Debian source compile:
apt-get build-dep package1
apt-get source package1
(optional: customize the build by modifying the debian/rules makefile)
(or set environmental variables like DEB_BUILD_OPTIONS)
(note that this will make your bug reports invalid to the maintainer)
dpkg-buildpackage -rfakeroot -uc -b
dpkg -i generatedpackagename
Simplified source compile:
apt-get build-dep package1
apt-get -b source package1
(the packages are automatically generated using the -b switch above)

'''Note:''' This process can be used to backport packages from testing and unstable by simply adding their respective source repositories to sources.list, which is similar to adding ~x86 to package.keywords in Gentoo. This is explored further in the "Architectures and repositories" section below.

== Reinstalling a particular package ==
'''Alpine'''
apk del package1 && apk add package1
or:
apk fix package1 package1
'''Gentoo'''
emerge --oneshot package1
'''Debian'''
apt-get install --reinstall package1 package1

Note: You ''rarely'' need to reinstall a package on Debian

== Searching the package database ==
'''Alpine'''

Alpine will only search package names.
apk search searchword

'''Gentoo'''

To search the package names and descriptions:
emerge --searchdesc searchword
'''Note:''' On Gentoo, it's actually much better to install and use either the esearch package or the eix package to do a search. You use them like this:
eix searchword

or

esearch searchword

'''Debian'''

apt-cache search searchword
Both emerge and apt-cache search support regular expressions.

To get the long package information on Debian (searching only in package names):
apt-cache search --full --names-only searchword

== Removing packages ==
'''Alpine'''

apk del package1 package2
apk del will remove configuration files when the --purge flag is used. Make sure you have backups of your configuration files. (Using rcs might be an idea)

You will mostly like to take a quick look at the dependencies before you remove packages recursively.

To see dependencies for a package, use:
apk info -R package1 package2

To see if package is required by other packages (is a dependency for another packages), use:
apk info -r package1 package2

'''Gentoo'''
emerge --unmerge package1 package2 (Note: this is unsafe as it does not check dependencies)
emerge --depclean package1 package2 (This will check dependencies)

'''Debian'''
apt-get remove package1 package2
or to remove along with all configuration files
apt-get remove --purge package1 package2

== Only downloading packages ==
This can be useful e.g. if you're on a dial-up connection and want to download everything first and install later.

'''Alpine'''
apk fetch package1 package2
'''Gentoo'''
emerge --fetchonly package1 package2
'''Debian'''
apt-get install --download-only package1 package2

== Cleaning up downloaded packages ==
Compressed packages that were downloaded for installation can easily consume gigabytes of storage space.

'''Alpine'''

Alpine will clean up packages automatically.

'''Gentoo'''
rm -rf /var/cache/distfiles/*
To only remove outdated packages you will need to install the gentoolkit package and use eclean:
eclean distfiles
Cleaning temporary files from emerging packages:
rm -rf /var/tmp/portage/*

'''Debian'''
apt-get clean
Only remove outdated packages:
apt-get autoclean

==Reverse dependencies==

'''Alpine'''

apk-tools will take care of reverse dependencies.

'''Gentoo'''

Reverse dependencies are a major drawback of Gentoo's current portage implementation: It does not take care of them at all at the moment.
If you use the unsafe --unmerge argument, this means that you can uninstall packages needed by others without being warned about it. E.g. you can remove the X server package without portage warning you that KDE (which you have installed as well) depends on it. This way you can actually break your entire system (e.g. by removing glibc).

revdep-rebuild
can fix broken dependencies broken by
emerge --depclean

Recent versions of portage include library tracking and preservation with the preserved-libs feature. Portage will notify you to run {{Cmd| emerge @preserved-rebuild}} to help rebuild binaries that might otherwise become broken.

'''Debian'''

Reverse dependencies are taken care of by dpkg.

= Runlevel & Initscripts =
Runlevels work pretty conventionally on Debian (see details: [http://archive.fo/ZdZIz systemd]). On Alpine and Gentoo, they are a bit different.

== Directories and files ==
In '''Debian''', runlevels are named conventionally (0-6 and S). They are represented by directories in /etc/ called rc*.d (when the default sysv-rc boot loader package is installed; file-rc can be installed instead, and then the relevant file is runlevel.conf).

* /etc/rc0.d
* /etc/rc1.d
* /etc/rcS.d
* /etc/rc2.d
* /etc/rc3.d
* /etc/rc4.d
* /etc/rc5.d
* /etc/rc6.d

In '''Gentoo''', runlevels have the same names, but these are mapped to more self explanatory ones (in /etc/inittab): "boot", "default", "nonetwork", with the option to add more. The directories that represent them are in
/etc/runlevels/:
* /etc/runlevels/boot
* /etc/runlevels/default
* /etc/runlevels/nonetwork

In '''Gentoo''', if a service is not explicitly started in a runlevel, it is stopped when switching to that runlevel! There is no explicit stopping of runlevels as in Debian (/etc/rc?.d/K??service).

In '''both Debian and Gentoo''', which things are started (and stopped) in which runlevels is controlled by links in the runlevel directories to scripts in /etc/init.d/, e.g.:
'''Gentoo'''
$ ls -l /etc/runlevels/boot/hostname
lrwxrwxrwx 1 root root 20 Mar 25 2004 /etc/runlevels/boot/hostname -> /etc/init.d/hostname

'''Debian'''
$ ls -l rcS.d/S40hostname.sh
lrwxrwxrwx 1 root root 21 2004-11-07 00:19 rcS.d/S40hostname.sh -> ../init.d/hostname.sh

'''Alpine'''
In Alpine, runlevels work like they do in Gentoo:

* /etc/runlevels/boot
* /etc/runlevels/default
* /etc/runlevels/sysinit
* /etc/runlevels/nonetwork
* /etc/runlevels/shutdown

== Runlevel management ==
To manage which things to start in which runlevels, use the following commands:

'''Alpine'''

To see current status of services in runlevels, do:
rc-status
To add sshd to default runlevel, do:
rc-update add -k sshd default
The -k option will make sure sshd is stopped when shutting down or reboot.
To remove sshd from all runlevels do:
rc-update del sshd

'''Gentoo'''

rc-update
To add the cupsd to the default runlevel, do:
rc-update add cupsd default
To remove alsasound from the boot runlevel, do:
rc-update del alsasound boot
Also see this wiki page about [http://gentoo-wiki.com/Rc-update gentoo runlevel management with rc-update]

'''Debian'''

update-rc.d
Configure cupsd to be started in runlevels 2, 3, 4, 5, and stopped in 0, 1, 6, with sequence code 20:
update-rc.d cupsd start 20 2 3 4 5 . stop 20 0 1 6 .
or simply:
update-rc.d cupsd defaults
Remove cupsd from all runlevels:
update-rc.d -f cupsd remove

= Config Files =

== /etc/portage/make.conf and use flags ==
While in Gentoo there's a large number of configuration files which control the behaviour of the package management system, there are comparatively fewer in Debian, as there is no need to dictate how to compile software which is downloaded and tweak/alter it. In Gentoo, the file /etc/portage/make.conf is used for much configuration; this includes ''USE'' flags, which influence which elements of packages are compiled, and which libraries to build support for - common USE flags (USE or -USE to specifically negate support) include 'gtk gnome' for Gnome users (and a corresponding -qt -kde -arts) and 'qt kde arts' for KDE users. A Gentoo user's complete set of use flags may look something like this:

'''USE="-kde -arts -qt xv truetype bluetooth crypt slang readline gpm berkdb mmx gdbm tcpd pam libwww ssl nls ethereal perl python esd gif imlib sdl oggvorbis mpeg gnome gtk X motif opengl avi png tiff nptl pcmcia nptl ldap eds"'''

== Architectures and repositories ==
'''Gentoo'''

Also in /etc/portage/make.conf is the '''ACCEPT_KEYWORDS''' setting, with (for an X86-based processor) two settings, '''x86''' for stabler packages, and '''~x86''' for bleeding edge packages. It is however not recommended to make this change in /etc/portage/make.conf. Rather configure this per-package in /etc/portage/package.accept_keywords. It's enough to put a line into that file naming the package (for example 'app-foo/bar'). That file might look like this:

app-crypt/gpg-agent
app-text/docbook-xsl-stylesheets
=app-text/docbook-xml-dtd-4.3-r1

The last line says, that ''only'' version 4.3-r1 should be unmasked. Older and newer versions will still be ignored.

'''Note for non-x86 users:'''
The keywords '''x86''' and '''~x86''' can of course be replaced by '''sparc''' and '''~sparc''' for example.

'''Debian'''

Setting this in Debian is slightly more complicated, and is accomplished by setting different 'repositories' in ''/etc/apt/sources.list'' - along with which 'tree' to use for packages; in Debian, these are '''stable''', '''testing''', and '''unstable'''. An ''/etc/apt/sources.list'' file for a debian testing user may look something like this:

deb http://mirrors.kernel.org/debian testing main non-free contrib
deb ftp://ftp.nerim.net/debian-marillat testing main
deb http://security.debian.org testing/updates main contrib non-free

Alternatively, ''/etc/apt/sources.list'' can contain any number of repositories for any trees, and a default tree (this can be overridden using the -t switch on the command line) in ''/etc/apt/apt.conf'':

APT::Default-Release "testing";

Per-package settings go in ''/etc/apt/preferences'', somewhat like Gentoo's ''/etc/portage/package.keywords''.

== Network ==

'''Alpine'''

Alpine uses /etc/network/interfaces, just like Debian. The main reason is because this is the way busybox does it.

''/etc/network/interfaces'':
auto eth0
iface eth0 inet static
address 192.168.0.1
netmask 255.255.255.0
broadcast 192.168.0.255

auto eth0:0
iface eth0:0 inet static
address 192.168.1.1
netmask 255.255.255.0
broadcast 192.168.1.255
# etc.

'''Gentoo'''

''/etc/conf.d/net'':
config_eth0="192.168.1.100 netmask 255.255.255.0
192.168.2.100 netmask 255.255.255.0"
routes_eth0="default via 192.168.1.1"

Note that this has changed recently. For more information please refer to http://www.gentoo.org/doc/en/handbook/handbook-x86.xml?part=4

'''Debian'''

''/etc/network/interfaces'':
auto eth0
iface eth0 inet static
address 192.168.0.1
netmask 255.255.255.0
broadcast 192.168.0.255

auto eth0:0
iface eth0:0 inet static
address 192.168.1.1
netmask 255.255.255.0
broadcast 192.168.1.255
# etc.

= Comparison chart/Rosetta Stone =

This chart shows how some standard things are done in Alpine compared to other distributions.

{| cellpadding="5" border="1" class="wikitable"
|-
! Action
! Alpine ([http://wiki.alpinelinux.org/wiki/Alpine_Linux_package_management apk])
! Arch Linux ([https://wiki.archlinux.org/index.php/Pacman pacman])
! Gentoo ([http://www.gentoo.org/doc/en/handbook/handbook-x86.xml?part=2&chap=1 emerge])
! Debian/Ubuntu ([http://wiki.debian.org/Aptitude aptitute])
! Fedora/RHEL/SL/CentOS ([http://yum.baseurl.org/wiki/YumCommands yum])
|-
| Update package database
| {{Cmd| apk update}}
| {{Cmd| pacman -Sy}}
| {{Cmd| emerge --sync}}
| {{Cmd| aptitude update}}
| {{Cmd| yum update}}
|-
| Showing available updates
| {{Cmd| apk version -l '<'}}
| {{Cmd| pacman -Qu}}
| {{Cmd| emerge --deep --update --pretend @world}}
| {{Cmd| aptitude upgrade --simulate}}
| {{Cmd| yum list updates}}
|-
| Installing packages
| {{Cmd| apk add [package name]}}
| {{Cmd| pacman -S [package name]}}
| {{Cmd| emerge [package name]}}
| {{Cmd| aptitude install [package name]}}
| {{Cmd| yum install [package name]}}
|-
| Update all installed packages
| {{Cmd| apk upgrade -U -a}}
| {{Cmd| pacman -Su}}
| {{Cmd| emerge --update --deep @world}}
| {{Cmd| aptitude upgrade}}
| {{Cmd| yum update}}
|-
| Searching package database
| {{Cmd| apk search -v '[string]*'}}
| {{Cmd| pacman -Ss [string]}}
| {{Cmd| emerge --search [string]}}
| {{Cmd| aptitude search [string]}}
| {{Cmd| yum search [string]}}
|-
| Removing packages
| {{Cmd| apk del [package name]}}
| {{Cmd| pacman -R [package name]}}
| {{Cmd| emerge --depclean [package name]}}
| {{Cmd| aptitude remove [package name]}}
| {{Cmd| yum remove [package name]}}
|}

[[Category:Package Manager]]

LVM on LUKS

2021-05-21T16:14:04Z

Begs: Remove outdated note

= Introduction =

This documentation describes how to set up Alpine Linux on a fully encrypted disk (apart from the bootloader's partition). We will have an LVM container installed inside an encrypted partition. To encrypt the partition containing the LVM volume group, dm-crypt (which is managed by the <code>cryptsetup</code> command) and its LUKS subsystem is used.

Note that your <code>/boot/</code> partition must be non-encrypted to work with Syslinux. When using GRUB2 it is possible to boot from an encrypted partition to provide a layer of protection from [https://en.wikipedia.org/wiki/Evil_maid_attack Evil Maid attacks], but Syslinux doesn't support this.

== Storage Device Name ==

To find your storage device's name, you could either install <code>util-linux</code> (<code>apk add util-linux</code>) and find your device using the <code>lspci</code> command, or you could make an educated guess by using BusyBox's <code>blkid</code> and <code>df</code> commands, and running <code>ls /dev/sd*</code> if you are installing to a USB, SATA or SCSI device, <code>ls /dev/fd*</code> for floppy disks and <code>ls /dev/hd*</code> for IDE (PATA) devices.

The following documentation uses the <code>/dev/sda</code> device as installation destination. If your environment uses a different device name for your storage device, use the corresponding device names in the examples.

= Setting up Alpine Linux Using LVM on Top of a LUKS Partition =

To install Alpine Linux in logical volumes running on top of a LUKS encrypted partition, you cannot use the [[Installation|official installation]] procedure. The installation requires several manual steps you must run in the Alpine Linux Live CD environment.

== Preparing the Temporary Installation Environment ==

Before you begin to install Alpine Linux, prepare the temporary environment:

Boot the latest Alpine Linux Installation CD. At the login prompt, use the <code>root</code> user without a password to log in. Now we will follow the [[Setup-alpine]] script and make our changes along the way.

Run the scripts in this order:

<pre># setup-keymap
# setup-hostname
# setup-interfaces
# rc-service networking start</pre>

If you are configuring static networking (you didn't configure any interfaces to use DHCP), run <code>setup-dns</code>.

If you are using Wi-Fi you may need to do run <code>rc-update add wpa_supplicant boot</code>.

<pre># passwd
# setup-timezone
# rc-update add networking boot
# rc-update add urandom boot
# rc-update add acpid default
# rc-service acpid start</pre>

Edit your {{Path|/etc/hosts}} to look like this, replacing <hostname> with your hostname and <domain> with your TLD (if you don't have a TLD, use 'localdomain':
{{Tip|The default text editor in BusyBox is <code>vi</code> (pronounced ''vee-eye'').}}
{{Cat|/etc/hosts|127.0.0.1 <hostname> <hostname>.<domain> localhost localhost.localdomain
::1 <hostname> <hostname>.<domain> localhost localhost.localdomain}}

<pre># setup-apkrepos
# apk update
# setup-sshd
# setup-ntp</pre>

Now we will deviate from the install script.

Install the following packages required to set up LVM and LUKS:

{{Note|The <code>parted</code> partition editor is needed for advanced partitioning and GPT disklabels. BusyBox <code>fdisk</code> is a very stripped-down version with minimal functionality}}

<pre># apk add lvm2 cryptsetup e2fsprogs parted</pre>

Optionally, if you want to overwrite your storage with random data first, install <code>haveged</code>, which is a random number generator based on hardware events and has a higher throughput than <code>/dev/urandom</code>:

<pre># apk add haveged
# rc-service haveged start</pre>

== Creating the Partition Layout ==

Depending on your motherboard and bios features and configuration
we can either use partition table in MBR (legacy BIOS)
or GUID Partition Table (GPT).
Here we will describe those two with example layouts.

=== BIOS/MBR with DOS disklabel ===

We will be partitioning the storage device with a non-encrypted <code>/boot</code> partition for use with the Syslinux bootloader. Syslinux is meant for use with legacy BIOS and the MSDOS MBR partition table. Syslinux does support GPT partition tables but GRUB2 is the better option for UEFI (UEFI is only possible with GPT).

<pre>+---------------------------+------------------------+-----------------------+
| Partition name | Partition purpose | Filesystem type |
+---------------------------+------------------------+-----------------------+
| /dev/sda1 | Boot partition | ext4 |
| /dev/sda2 | LUKS container | LUKS |
| |-> /dev/mapper/lvmcrypt | LVM container | LVM |
| |-> /dev/vg01/root | Root partition | ext4 |
| |-> /dev/vg01/swap | Swap partition | swap |
+---------------------------+------------------------+-----------------------+</pre>

{{Warning|This will delete your previous partitioning table and make your data very hard to recover. If you want to dual boot, stop here and ask an expert.}}

Create an approx. 100MB partition to boot off, then assign the rest of the space to your LUKS partition.

<pre># parted -a optimal
(parted) mklabel msdos
(parted) mkpart primary ext4 0% 100M
(parted) name 1 boot
(parted) set 1 boot on
(parted) mkpart primary ext4 100M 100%
(parted) name 2 crypto-luks</pre>

To view your partition table, type <code>print</code> while still in <code>parted</code>. Your results should look something like this:
<pre>(parted) print
Model: ATA TOSHIBA ******** (scsi)
Disk /dev/sda: 1000GB
Sector size (logical/physical): 512B/4096B
Partition Table: msdos
Disk Flags:

Number Start End Size Type File system Flags
1 1049kB 99.6MB 98.6MB primary ext4 boot
2 99.6MB 1000GB 1000GB primary ext4</pre>

=== UEFI with GPT disklabel ===

We will be encrypting the whole disk but the EFI system partition mounted at <code>/boot/efi</code>. This means that GRUB2 will decrypt the LUKS volume and load the kernel from there, preventing someone with physical access to your computer from maliciously installing a rootkit (or bootkit) in your boot partition while your computer is not already unlocked. The partitioning scheme will look like this:

<pre>+---------------------------+------------------------+-----------------------+
| Partition name | Partition purpose | Filesystem type |
+---------------------------+------------------------+-----------------------+
| /dev/sda1 | EFI system partition | fat32 |
| /dev/sda2 | LUKS container | LUKS |
| |-> /dev/mapper/lvmcrypt | LVM container | LVM |
| |-> /dev/vg01/root | Root partition | ext4 |
| |-> /dev/vg01/boot | Boot partition | ext4 |
| |-> /dev/vg01/swap | Swap partition | swap |
+---------------------------+------------------------+-----------------------+</pre>

{{Warning|This will delete your previous partitioning table and make your data very hard to recover. If you want to dual boot, stop here and ask an expert.}}

Create an approx. 200MB EFI system partition, then assign the rest of the space to your LUKS partition.

<pre># parted -a optimal
(parted) mklabel gpt
(parted) mkpart primary fat32 0% 200M
(parted) name 1 esp
(parted) set 1 esp on
(parted) mkpart primary ext4 200M 100%
(parted) name 2 crypto-luks</pre>

== Optional: Overwrite LUKS Partition with Random Data ==

This should be done if your hard drive wasn't encrypted previously. It helps purge old, non-encrypted data and makes it harder for an attacker to work out how much data you have on your drive if they have access to the encrypted contents.

We will be using <code>haveged</code> as it is considerably faster than <code>/dev/urandom</code> when generating pseudo-random numbers (it's almost as high as <code>/dev/zero</code> in throughput), and is (supposedly) very close to truly random.

<pre># haveged -n 0 | dd of=/dev/sda2</pre>

== Encrypting the LVM Physical Volume Partition ==

To encrypt the partition which will later contain the LVM PV, you could either use the default settings (aes-xts-plain64 cipher with 256-bit key and Argon2 hashing with iter-time 2000ms), or you could use these settings which have added security with the trade-off being a non-noticeable decrease in performance in modern computers:

Default settings:

<pre># cryptsetup luksFormat /dev/sda2</pre>

Optimized for security:

<pre># cryptsetup -v -c serpent-xts-plain64 -s 512 --hash whirlpool --iter-time 5000 --use-random luksFormat /dev/sda2</pre>

If using at least Alpine v3.11 and GRUB2 with encrypted /boot, the following should be used instead (because GRUB2 does not yet support LUKS2 containers):

<pre># cryptsetup luksFormat --type luks1 /dev/sda2</pre>

== Creating the Logical Volumes and File Systems ==

Open the LUKS partition:

<pre># cryptsetup luksOpen /dev/sda2 lvmcrypt</pre>

Create the PV on <code>lvmcrypt</code>:

<pre># pvcreate /dev/mapper/lvmcrypt</pre>

Create the <code>vg0</code> LVM VG in the <code>/dev/mapper/lvmcrypt</code> PV:

<pre># vgcreate vg0 /dev/mapper/lvmcrypt</pre>

=== LV Creation for BIOS/MBR ===

This will create a 2GB swap partition and a root partition which takes up the rest of the space. This setup is for those who do not need to use the hibernate/suspend to disk state. If you do need to suspend to disk, create a swap partition slightly larger than the size of your RAM (change the size after <code># lvcreate -L</code>).

<pre># lvcreate -L 2G vg0 -n swap
# lvcreate -l 100%FREE vg0 -n root</pre>

The LVs created in the previous steps are automatically marked active. To verify, enter:

<pre># lvscan</pre>

=== LV Creation for UEFI/GPT ===

This will create a 2GB swap partition, a 2GB boot partition and a root partition which takes up the rest of the space. This setup is for those who do not need to use the hibernate/suspend to disk state. If you do need to suspend to disk, create a swap partition slightly larger than the size of your RAM (change the size after <code># lvcreate -L</code>).

<pre># lvcreate -L 2G vg0 -n swap
# lvcreate -L 2G vg0 -n boot
# lvcreate -l 100%FREE vg0 -n root</pre>

The LVs created in the previous steps are automatically marked active. To verify, enter:

<pre># lvscan</pre>

== Creating and Mounting the File Systems ==

Format the <code>root</code> and <code>boot</code> LVs using the ext4 file system:

<pre># mkfs.ext4 /dev/vg0/root</pre>

Format the swap LV:

<pre># mkswap /dev/vg0/swap</pre>

Before you can install Alpine Linux, you must mount the partitions and LVs. Mount the root LV to the <code>/mnt/</code> directory:

<pre># mount -t ext4 /dev/vg0/root /mnt/</pre>

Next format your boot partition, create a mount point and mount it:

* If you're using BIOS and MBR:

<pre># mkfs.ext4 /dev/sda1
# mkdir -v /mnt/boot
# mount -t ext4 /dev/sda1 /mnt/boot</pre>

* If you're using UEFI and GPT:

<pre># apk add dosfstools
# mkfs.fat -F32 /dev/sda1
# mkfs.ext4 /dev/vg0/boot
# mkdir -v /mnt/boot
# mount -t ext4 /dev/vg0/boot /mnt/boot
# mkdir -v /mnt/boot/efi
# mount -t vfat /dev/sda1 /mnt/boot/efi</pre>

Lastly, activate your swap partition:

<pre># swapon /dev/vg0/swap</pre>

== Installing Alpine Linux ==

In this step you will install Alpine Linux in the <code>/mnt/</code> directory, which contains the mounted file system structure:

<pre># setup-disk -m sys /mnt/</pre>

The installer downloads the latest packages to install the base installation. Additionally, the installer automatically creates the entries for the mount points in {{Path|/etc/fstab}} file, which is currently mounted in the <code>/mnt/</code> directory.

{{Note|The automatic writing of the master boot record (MBR) fails in this step. You will write the MBR later manually to the disk.}}

The swap LV is not automatically added to the <code>fstab</code> file. To add it manually, add the following line to the {{Path|/mnt/etc/fstab}} file:

<pre>/dev/vg0/swap swap swap defaults 0 0</pre>

Edit the {{Path|/mnt/etc/mkinitfs/mkinitfs.conf}} file and append the <code>cryptsetup</code> module to the <code>features</code> parameter:

<pre>features="... cryptsetup"</pre>

If you are using GRUB with an encrypted <code>/boot</code> you must add the <code>cryptkey</code> feature so that Alpine can use a keyfile for decryption on boot.

{{Note|Alpine Linux uses the <code>en-us</code> keyboard mapping by default when prompting for the password to decrypt the partition at boot time. If you changed the keyboard mapping in the temporary environment and want to use it at the boot password prompt, be sure to also add the <code>keymap</code> feature to the list above.}}

{{Note|Check the output of <code>mkinitfs -L</code> and add the features necessary for your system to boot. You may need to add <code>kms</code> in order to see a password prompt at boot. You may also need: <code>usb</code>, <code>lvm</code>, <code>ext4</code>, <code>nvme</code>...}}

Rebuild the initial RAM disk:

<pre># mkinitfs -c /mnt/etc/mkinitfs/mkinitfs.conf -b /mnt/ $(ls /mnt/lib/modules/)</pre>

The command uses the settings from the <code>mkinitfs.conf</code> file set in the <code>-c</code> parameter to generate the RAM disk. The command is executed in the <code>/mnt/</code> directory and the RAM disk is generated using the modules for the installed kernel. Without setting the kernel version using the <code>$(ls /mnt/lib/modules/</code>) option, <code>mkinitfs</code> tries to generate the RAM disk using the kernel version installed in the temporary environment, which can differ from the latest one installed by the <code>setup-disk</code> utility.

== Installing a bootloader ==

To get the UUID of your storage device into a file for later use, use this command:

<pre># blkid -s UUID -o value /dev/sda2 > ~/uuid</pre>

{{Tip|To easily read the UUID into a file so you don't have to type it manually, open the file in <code>vi</code>, then type <code>:r /root/uuid</code> to load the UUID onto a new line.}}

=== Syslinux with BIOS ===

Install the Syslinux package:

<pre># apk add syslinux</pre>

Edit {{Path|/mnt/etc/update-extlinux.conf}} and append the following kernel options to the <code>default_kernel_opts</code> parameter, replacing <UUID> with the UUID of <code>/dev/sda2</code>:

<pre>default_kernel_opts="... cryptroot=UUID=<UUID of sda2> cryptdm=lvmcrypt"</pre>

The <code>cryptroot</code> parameter sets the ID of the device/partition that contains encrypted volumes, and the <code>cryptdm</code> parameter uses the name of the mapping we have already configured a few lines above.

We can also double check if <code>modules</code> and <code>root</code> are set correctly, eg:
<pre>
modules=sd-mod,usb-storage,ext4,cryptsetup,keymap,cryptkey,kms,lvm
root=UUID=<UUID of /dev/mapper/vg0-root>
</pre>

Because the <code>update-extlinux</code> utility operates only on the <code>/boot/</code> directory, temporarily change the root to the <code>/mnt/</code> directory and update the boot loader configuration:

<pre># chroot /mnt/
# update-extlinux
# exit</pre>

: Because we didn't mount <code>/dev</code> nor <code>/proc</code> inside our <code>/mnt/</code> chroot, some errors may occur when we run <code>update-extlinux</code> command. But you can most likely ignore these.

Write the MBR (without partition table) to the <code>/dev/sda</code> device:

<pre># dd bs=440 count=1 conv=notrunc if=/mnt/usr/share/syslinux/mbr.bin of=/dev/sda</pre>

=== Grub with UEFI ===

To avoid having to type your decryption password twice every boot (once for GRUB and once for Alpine), add a keyfile to your LUKS partition. The filename is important.

<pre># dd bs=512 count=4 if=/dev/urandom of=/mnt/crypto_keyfile.bin
# cryptsetup luksAddKey /dev/sda2 /mnt/crypto_keyfile.bin
</pre>

This keyfile is stored encrypted at rest (it is in your LUKS partition), so it's existence does not reduce the security of the system.

Mount the required filesystems for the Grub EFI installer to the installation:

<pre># mount -t proc /proc /mnt/proc
# mount --rbind /dev /mnt/dev
# mount --make-rslave /mnt/dev
# mount --rbind /sys /mnt/sys</pre>

Then chroot in and use <code>grub-install</code> to install Grub.

<pre># chroot /mnt
# source /etc/profile
# export PS1="(chroot) $PS1"</pre>

Install <code>GRUB2</code> for EFI and (optionally) remove syslinux:

<pre># apk add grub grub-efi efibootmgr
# apk del syslinux</pre>

Edit {{Path|/etc/default/grub}} and add the following kernel options to the <code>GRUB_CMDLINE_LINUX_DEFAULT</code> parameter, replacing <UUID> with the UUID of the encrypted partition (in this case, <code>/dev/sda2</code>):

<pre>cryptroot=UUID=<UUID> cryptdm=lvmcrypt cryptkey</pre>

The <code>cryptroot</code> parameter sets the ID of the device/partition that contains encrypted volumes, and the <code>cryptdm</code> parameter uses the name of the mapping we have already configured a few lines above.
The <code>cryptkey</code> parameter indicates the existence of the file <code>/crypto_keyfile.bin</code> you created previously.

To enable GRUB to decrypt LUKS partitions and read LVM volumes add:

<pre>GRUB_PRELOAD_MODULES="luks cryptodisk part_gpt lvm"</pre>

If using at least Alpine v3.11, <code>GRUB_ENABLE_CRYPTODISK=y</code> should also be added to {{Path|/etc/default/grub}}.

<pre># (chroot) grub-install --target=x86_64-efi --efi-directory=/boot/efi
# (chroot) grub-mkconfig -o /boot/grub/grub.cfg
# (chroot) exit</pre>

== Unmounting the Volumes and Partitions ==

Unmount the <code>/mnt/</code> partitions, deactivate the LVM volumes, close the LUKS partition and reboot:

<pre># cd
# umount -l /mnt/dev
# umount -l /mnt/proc
# umount -l /mnt/sys
# umount /mnt/boot/efi
# umount /mnt/boot
# swapoff /dev/vg0/swap
# umount /mnt
# vgchange -a n
# cryptsetup luksClose lvmcrypt
# reboot</pre>

= Troubleshooting =

== General Procedure ==

In case your system fails to boot, you can verify the settings and fix incorrect configurations.

Reboot and do the steps in [[#Preparing_the_Temporary_Installation_Environment|Prepare the temporary installation environment]] again.

Setup the LUKS partition and activate the LVs:

<pre># cryptsetup luksOpen /dev/sda2
# vgchange -ay</pre>

[[#Creating_and_Mounting_the_File Systems|Mount the file systems]]

Verify that you run the steps described in the [[#Installing_Alpine_Linux|Installing Alpine Linux]] section correctly. Update the configuration if necessary, unmount the partitions, then reboot.

== System can't find boot device ==

* GPT partition table on a motherboard that runs BIOS instead of UEFI
* running an MSDOS/MBR/Syslinux install without enabling legacy boot mode in the UEFI settings

== I see "can not mount /sysroot" during boot ==

* incorrect device UUID
* missing module in <code>/mnt/etc/update-extlinux.conf</code> or <code>/mnt/etc/mkinitfs/mkinitfs.conf</code>

== Secure boot ==

If secure boot complains of an unsigned bootloader, you can either disable it or adapt [https://wiki.archlinux.org/index.php/Secure_Boot this] guide to sign GRUB. If you're using Syslinux, then secure boot should be automatically disabled when you enable legacy boot mode.

= Hardening =

* To harden, you should disable DMA[https://old.iseclab.org/papers/acsac2012dma.pdf] and install a hardened version of AES (TRESOR[https://www1.informatik.uni-erlangen.de/tresor] or Loop-Amnesia[http://moongate.ydns.eu/amnesia.html]) since by default cryptsetup with luks uses AES by default.
* Disable DMA in the BIOS and set the password for the BIOS according to Wikipedia.[https://en.wikipedia.org/wiki/DMA_attack]
* Blacklist kernel modules that use DMA and any unused expansion modules (FireWire, CardBus, ExpressCard, Thunderbolt, USB 3.0, PCI Express and hotplug modules) that use DMA.

= Mounting additional encrypted filesystems at boot =

If you would like other encrypted LUKS partitions to be decrypted and mounted automatically during boot, for example if you have <code>/home</code> on a separate physical drive, some extra steps are required.
{{Note|This does not apply for volumes
within your main encrypted partition <code>/dev/sda2</code>}}
For the purposes of these instructions we will say <code>/dev/sdb1</code> contains an LVM volume that should be mounted at <code>/home</code>.

Create a keyfile and add it to the LUKS partition:

<pre># dd bs=512 count=4 if=/dev/urandom of=/root/crypt-home-keyfile.bin
# cryptsetup luksAddKey /dev/sdb1 /root/crypt-home-keyfile.bin
</pre>

Alpine, like Gentoo, uses the <code>dmcrypt</code> service rather than <code>/etc/crypttab</code>. Add the following lines to <code>/etc/conf.d/dmcrypt</code>:

<pre>target=crypt-home
source='/dev/sdb1'
key='/root/crypt-home-keyfile.bin'
</pre>

Add an entry to <code>/etc/fstab</code>, changing <code>vg1</code> to the name of your LVM volume group:

<pre>/dev/vg1/home /home ext4 rw,relatime 0 2</pre>

Enable the dmcrypt and lvm services to start on boot:

<pre># rc-update add dmcrypt boot
# rc-update add lvm boot
</pre>

After a reboot the partition should be decrypted and mounted automatically.

= See also =
*[[Bootloaders]]
*[[Alpine setup scripts]]
*[[Installing on GPT LVM]]
*[[Setting up LVM on GPT-labeled disks]]
*[[Setting up disks manually]]
*https://wiki.gentoo.org/wiki/Syslinux
*https://wiki.gentoo.org/wiki/GRUB2
*https://wiki.archlinux.org/index.php/Syslinux
*https://wiki.archlinux.org/index.php/GRUB
*https://wiki.gentoo.org/wiki/Sakaki's_EFI_Install_Guide
*https://battlepenguin.com/tech/alpine-linux-with-full-disk-encryption/
*https://wiki.gentoo.org/wiki/Dm-crypt

[[Category:Storage]]
[[Category:Security]]