how to start microvm with LUKS encrypted file system(rootfs.ext4) using firecracker

[jahnavilatha589]

I have created an encrypted filesystem(rootfs.ext4) using LUKS. Trying to start microvm by using LUKS encrypted file system with firecracker.

Is it possible to start microvm with encrypted file system..? Can anyone suggest on this.

[bchalios]

Hi @jahnavilatha589,

Thanks for the interest in Firecracker :)

We haven't tried booting a microVM with an encrypted rootfs, so I am not sure if it would work.

Firecracker microVMs do not use a boot-loader to boot. I am not sure whether dm-crypt prompts you for a password to unlock the partition at boot-time. Maybe if you used an initrd: https://github.com/firecracker-microvm/firecracker/blob/main/docs/initrd.md to boot from, which you have setup for LUKS and then pivot to your encrypted file-system, with switch_root it could work.

You should definitely be able to use an un-encrypted root filesystem with additional encrypted drives which you unecrypt at boottime.

[qasmi]

Hello,
I am trying to run a microVM with a LUKS encrypted file system (using dm-crypt) and am encountering the same issue as you @jahnavilatha589. Did you manage to find a solution?

@bchalios do you have any recommendations on how to start microvms with encrypted file system ?

Thanks

[MrKoberman]

I am in the same boat. Any resolution on this?

[Manciukic]

Hey,

I think the solution proposed by bchalios is the way to go but I'm not aware of anybody actually implementing it:

1. build a small initrd with an init process that
   a. mounts the LUKS filesystem usig cryptsetup luksOpen
   b. pivots the root to the new file system (example in firecracker-containerd)
   c. delegates the boot to the init executable in the decrypted image
2. package the initrd as a cpio archive
3. start firecracker with the initrd (docs)

Note that the initrd is copied to the VM memory, consuming it. You can technically do the same with a separate (unencrypted) boot disk that prepares the system and then delegates to the other init process.

If you manage to get the setup working, don't forget to provide the details here for the community!

Update: the kernel documentation has a nice guide on what is the initrd and how to make one: https://docs.kernel.org/admin-guide/initrd.html . It's only missing the LUKS mounting part, but there's a complete example on how to pivot_root to a new filesystem.