Encrypted local volumes

Lium can store your pod's /root volume encrypted on the provider's disk. Inside the pod it looks like a normal folder. It is on by default.

What it protects

Encryption at rest covers stored data only: while the pod runs, the volume is decrypted and a standard-node host can read it and the pod's memory. The provider ban rule applies, and for secrets use a Confidential Computing node.

Turn it off

In the UI: clear Encrypt local volume on the Create Pod page. It shows only for templates that support it.

API, SDK or CLI:

• API: "enable_volume_encryption": false in the rent request.
• SDK: Lium.up(..., enable_volume_encryption=False).
• CLI: lium up --no-volume-encryption.

If the template's image does not support encryption, the pod starts with a plain volume.

Tradeoffs

• Disk is slower, most for many small files. In our test on an encrypted /root (30 Oct 2026):
  • large sequential writes were about 4x slower (210 vs 800 MB/s);
  • small 4 KiB writes with fsync were about 3x slower;
  • creating small files was about 13x slower, and stat was about 30x slower.
• For fast scratch space, write temporary files to /tmp. It is on the same disk, not encrypted, not backed up, and gone when the pod is removed. /tmp is smaller than /root: on a small share it may hold only a few tens of GB.
• Rent with encryption off for large downloads (big models or datasets) or mostly small-file I/O.
• Backups and restores of an encrypted volume work only while the pod is running.

Check the status

The pod page shows Volume encryption: Enabled, Unavailable (image does not support it), Disabled (turned off) or Setup failed.

If SSH suddenly asks for a password

The host rebooted and the encrypted volume was not mounted again. The pod still shows RUNNING and keeps billing. Your data is intact.

Fix: Reboot the pod from the pod page, or run lium reboot <pod>.