--- sidebar_position: 5.5 tags: [security] --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.lium.io/llms.txt > Use this file to discover all available pages before exploring further. # Encrypted local volumes Lium can store the pod's local volume at `/root` as ciphertext on the provider's disk. Inside the running pod, it looks like a normal filesystem. ## What it protects Encryption covers data at rest. A leftover volume, a disk image, or a drive that leaves the datacentre is unreadable by itself. It does not protect a running pod. A provider with host access can read `/root` while your pod is up, inspect its memory, or capture the key. If the provider must never see your workload, rent a [CVM-enabled machine](../providers/nodes/cvm.md) instead. Full model: [Pod security](./security). ## Using it On the Create Pod page, **Encrypt local volume** appears for official templates that support it. Encryption is on by default. The API, SDK, and CLI request encryption by default too. To turn it off: - API: `"enable_volume_encryption": false` in the rent request. - SDK: `Lium.up(..., enable_volume_encryption=False)`. - CLI: `lium up --no-volume-encryption`. The template decides whether the UI shows the option. At deploy time, Lium checks the template's Docker image. If the image does not support encryption, the pod starts with a plain volume instead of failing the rental. ## Tradeoffs - Disk is slower. On an A6000 node with an EPYC 7763, a mixed 70/30 random read/write test went from 1008 to 625 MiB/s read and 435 to 271 MiB/s write. That is roughly 38% less throughput. Your numbers depend on the host and workload. - Backups need a running pod. [Backups](./backups) and [restores](./restores) of an encrypted volume only work while the pod is up. ## Status on the pod page After deploy, **Volume encryption** shows what actually happened: - **Enabled**: `/root` is encrypted. - **Unavailable**: the image did not support encryption, so the pod got a plain volume. - **Disabled**: encryption was turned off in the request. - **Setup failed**: the image supported encryption, but the encrypted mount did not come up.
For agents and automation The volume uses [gocryptfs](https://nuetzlich.net/gocryptfs/). The Docker volume holds ciphertext, and the decrypted view is mounted at `/root`. An image qualifies by shipping gocryptfs and carrying the `lium.volume_encryption.enable=1` Docker label. The validator derives a passphrase per pod and hands it to the container at mount time. The passphrase is never written to the volume.