Disk encryption

Disk encryption protects the data at rest on a device, so that a lost or stolen device does not expose your configuration or workload data. This page explains what is encrypted, how a device unlocks itself, and how to recover access.

What is encrypted

When encryption is enabled, the two areas that hold your information are encrypted:

  • the configuration area (device settings, identity, administrator password, hooks)
  • the data area (container images, workload data, logs)

The boot and system-image areas are not encrypted; they contain only the operating system, which is public and identical across devices.

Enabling encryption

Encryption is chosen when you create an install image. You can also set an initial recovery passphrase at that time. Because enabling encryption affects how the disk is laid out, it is selected at image creation rather than toggled on a running device.

How a device unlocks itself

Encrypted devices unlock automatically at boot using the device’s hardware security module (TPM). The encryption keys are bound to the device’s hardware and to the integrity of its boot state, so the disk unlocks only on the same device, booted normally. There is no passphrase to type at the console during a normal boot, which is what allows encrypted devices to run unattended.

Because the keys are tied to the hardware, moving an encrypted disk to different hardware will not unlock it. This is the intended protection.

Recovery passphrase

In addition to automatic hardware unlock, a device can hold a backup recovery passphrase. This is a human-known passphrase you can use to unlock a device if automatic unlock is unavailable — for example after certain hardware changes.

Recommendations:

  • Set a recovery passphrase (at least 12 characters) when you enable encryption.
  • Store it securely, separately from the device.
  • Treat it as a break-glass credential — it can unlock the encrypted areas.

Recovery scenarios

Situation What happens What to do
Normal reboot Disk unlocks automatically via the TPM. Nothing.
Boot state changed (e.g. after an OS upgrade) The device re-establishes its automatic unlock as part of the managed upgrade. Nothing for managed upgrades.
Motherboard / TPM replaced Hardware-bound keys no longer match. Use the recovery passphrase, or re-image the device.
Recovery passphrase lost and automatic unlock unavailable The encrypted areas cannot be opened. Re-image the device (data is not recoverable).