Raspberry Pi LVM on LUKS

This article complements the existing installation instructions for Raspberry Pi, providing the needed changes that enable booting with an encrypted disk.

Prepare the Installation Media

Write the downloaded image or tarball to a disk. In this example, this bootable disk (referred to as /dev/sda) will be used as a read-only installation media. The target root disk is referred to as /dev/sdb.

Boot the Installer

Insert the installation disk into the pi and turn it on. To make sure it will boot the right device, unplug any other storage media.

Once Alpine is initialized, log in and perform a "diskless installation" with setup-alpine. Next, we will setup the disk manually.

Disk Setup

Plug in the disk where Alpine will be installed. fdisk -l and blkid should give you an overview of all available disks. In this example, the new disk becomes /dev/sdb.

1. Initialize the disk with a new empty DOS partition table.
2. Create a bootable FAT32 partition (as described here) that will later be mounted as the (unencrypted) /boot filesystem (e.g. /dev/sdb1).
3. Create a larger Linux partition (e.g. /dev/sdb2) that will be LUKS-encrypted.

Install the necessary packages:

apk add cryptsetup lvm2 mkinitfs

Encrypt the Linux partition with one of the following:

cryptsetup luksFormat /dev/sdb2 # Raspberry Pi 5

cryptsetup luksFormat -c xchacha12,aes-adiantum-plain64 /dev/sdb2 # Raspberry Pi 4 and older

Then unlock the disk with cryptsetup open /dev/sdb2 alpine, where "alpine" is a name of choice.

At this point you may follow the LVM on LUKS page to create and format the LVM volumes.

Mount the root volume at /mnt, and the boot partition at /mnt/boot; then run setup-disk like this:

setup-disk -m sys /mnt

Boot Configuration

setup-disk should have installed the system to the target disk. Now we just need to verify a few things so it's ready to boot.

1. Edit /mnt/etc/mkinitfs/mkinitfs.conf and add the features lvm and cryptsetup, if missing.

2. Edit /mnt/boot/cmdline.txt, and ensure that root= points to the respective LVM volume (e.g. /dev/alpine/root).

In the same file, add cryptroot=UUID= pointing to the LUKS device (e.g. /dev/sdb2, but as UUID), and also cryptdm= set to a name of choice (e.g. alpine).

These options are documented here and here.

3. Edit /mnt/etc/fstab and verify that all LVM volumes and the /boot partition are listed there.

Add a line for the swap volume too. There's an example here.

If your disk is an ordinary flash stick or SD card, you might want to replace all instances of relatime with noatime.

4. Regenerate the initramfs. Remember to point it to the /mnt path.

Finally, a friendly reminder: save a backup of that LUKS header. See cryptsetup-luksHeaderBackup(8).

See also

• Raspberry Pi
• LUKS-encrypted volume setup
• LVM on LUKS (encryption and LVM, but beware that the Pi uses a different bootloader)
• Initramfs