What is LUKS, and why does it go under LVM in the stack?
LUKS (Linux Unified Key Setup) is the standard for full-block-device encryption; placing it below LVM means the LVM metadata and all volumes above it are encrypted too.
LUKS encrypts an entire block device or partition, not individual files. Until you unlock it with the passphrase/key, the device looks like random noise — there's no visible filesystem, no file names, nothing. Decryption happens at the block layer, beneath the filesystem, so once unlocked everything above works normally and transparently.
Why it sits under LVM in the stack:
Block device → LUKS → LVM → Filesystem
If you encrypt at the bottom, then everything layered on top is inside the encrypted envelope — including LVM's own metadata about volume groups and logical volumes. An attacker who steals the disk sees only ciphertext; they can't even tell how it's partitioned or what volumes exist. Put encryption higher up and that structural metadata would leak in the clear.
Advantages over per-file encryption:
- The filesystem layout itself is hidden when locked.
- A physically removed disk reveals nothing.
- No per-file crypto bookkeeping — it's one envelope around the whole device.
A maximal stack combines it all: Block device → LUKS → LVM VDO → XFS — encrypted, flexible, space-optimized, modern filesystem.
Go deeper:
Linux Unified Key Setup — Wikipedia — the LUKS block-device encryption specification.- cryptsetup(8) man page — the tool that manages LUKS full-disk encryption.