For sensitive data storage in the cloud, I will usually provision a separate volume, encrypt it, and then use this as the volume mapper for containerised services.
Creating and attaching a volume
I use Linode to host the vast majority of my services. In Linode, new volumes can be easily created and attached to an instance.
After a short while the instance will then recognise the new device and make it available via the OS.
Encrypting the volume
This note assumes your attached volume is mapped as
/dev/sdc by your system. You can check this using
This note also assumes you have
cryptsetup installed. On Alpine Linux, you can install it with
apk add cryptsetup.
Step 1: Create a LUKS partition:
cryptsetup luksFormat /dev/sdc
Enter the passphrase, etc.
Step 2: Open the partition, entering your passphrase, and provide a “mapper”:
cryptsetup luksOpen /dev/sdc mydata
Step 3: Now, create a new filesystem. E.g. for
Step 4: Mount the new filesystem:
mkdir /data mount /dev/mapper/mydata /data
Step 5: Create a new encryption key and mark it as readonly:
echo "complex string" > /root/data-key chmod 0400 /root/data-key
Step 6: Add the key to the LUKS setup:
cryptsetup luksAddKey /dev/sdc /root/data-key
Step 7: Get the UUIDs for the devices by running
lsblk -f. You’ll need these for the next steps.
Step 8: Set-up the crypttab by editing
/etc/crypttab and adding:
mydata UUID=<LUKS UUID> /root/data-key luks
<LUKS UUID> is the UUID for the LUKS device from above).
This ensures the volume is correctly decrypted at boot.
Note: on Alpine Linux there is no crypttab. Instead refer to the section below.
Step 9: Finally, add an entry for the decrypted volume in
UUID=<ext4 UUID> /data ext4 defaults 0 0
This auto-mounts the decrypted filesystem to
/data on boot. For
<ext4 UUID> use the UUID for the filesystem itself that you obtained earlier.
Auto-decrypting on Alpine Linux
Alpine doesn’t use a crypttab to manage the decryption at boot-time. Instead add the following to
target=mydata source='/dev/sdc' key='/root/data-key'
And then enable the service at boot:
rc-update add dmcrypt boot
cryptsetup luksDump /dev/sdc to view the encryption properties. E.g.:
Key: 512 bits Priority: normal Cipher: aes-xts-plain64 Cipher key: 512 bits PBKDF: argon2id