Skip to main content

Encrypted local volumes

Lium can store the pod's local volume at /root as ciphertext on the provider's disk. Inside the running pod, it looks like a normal filesystem.

What it protects​

Encryption covers data at rest. A leftover volume, a disk image, or a drive that leaves the datacentre is unreadable by itself.

It does not protect a running pod. A provider with host access can read /root while your pod is up, inspect its memory, or capture the key. If the provider must never see your workload, rent a CVM-enabled machine instead. Full model: Pod security.

Using it​

On the Create Pod page, Encrypt local volume appears for official templates that support it. Encryption is on by default.

The API, SDK, and CLI request encryption by default too. To turn it off:

  • API: "enable_volume_encryption": false in the rent request.
  • SDK: Lium.up(..., enable_volume_encryption=False).
  • CLI: lium up --no-volume-encryption.

The template decides whether the UI shows the option. At deploy time, Lium checks the template's Docker image. If the image does not support encryption, the pod starts with a plain volume instead of failing the rental.

Tradeoffs​

  • Disk is slower. On an A6000 node with an EPYC 7763, a mixed 70/30 random read/write test went from 1008 to 625 MiB/s read and 435 to 271 MiB/s write. That is roughly 38% less throughput. Your numbers depend on the host and workload.
  • Backups need a running pod. Backups and restores of an encrypted volume only work while the pod is up.

Status on the pod page​

After deploy, Volume encryption shows what actually happened:

  • Enabled: /root is encrypted.
  • Unavailable: the image did not support encryption, so the pod got a plain volume.
  • Disabled: encryption was turned off in the request.
  • Setup failed: the image supported encryption, but the encrypted mount did not come up.
For agents and automation

The volume uses gocryptfs. The Docker volume holds ciphertext, and the decrypted view is mounted at /root. An image qualifies by shipping gocryptfs and carrying the lium.volume_encryption.enable=1 Docker label. The validator derives a passphrase per pod and hands it to the container at mount time. The passphrase is never written to the volume.