Guide · checked 2026-11-10

Can I encrypt a VPS disk with LUKS?

LUKS protects data at rest. It does not hide a running VPS from the machine it runs on, and this page says where the line is.

Last updated: November 10, 2026 · 6 min read

Quick answer

Can I encrypt a VPS disk with LUKS?

Yes, you can encrypt a VPS disk with LUKS, because Gloamport gives you full KVM virtualization with your own kernel. Create a volume with cryptsetup luksFormat, open it, format and mount it. A Gloam plan, 2 vCPU, 4 GB RAM, 80 GB NVMe, 4 TB traffic, costs $8.25 a month on 12 months.

What does LUKS protect on a VPS, and what does it not?

Situation	Protected by LUKS?	Why
A copy of the disk image or a snapshot	Yes	The data on disk is ciphertext without the passphrase
A VPS that is powered off	Yes	The key is not in memory
A VPS running with the volume open	No	The key and the plaintext sit in RAM, which the host machine can read
Someone with root inside your VPS	No	They see the mounted volume
A lost passphrase or a damaged header	No	Data is lost unless you made a header backup

The RAM limit is a property of virtualization, not of Gloamport: any host can read the memory of the guests it runs.

What does encrypting a VPS disk with LUKS really give you?

LUKS gives you encryption at rest: anyone who copies the disk without the passphrase gets noise. It does not give you protection from the host while the VPS runs, because the unlocked key lives in memory that the hypervisor can read.

This is why the honest framing matters. Gloamport states that Full KVM virtualization: your own kernel, your own firewall rules and your own disk encryption if you set it up, which makes LUKS possible, and that No plan includes backups: keep your own copy of anything you cannot lose. Pair encryption with your own backups. For the wider question of what a private VPS is and is not, see What makes a VPS privacy-focused?.

Which Gloamport plan suits an encrypted volume?

Gloam is a comfortable size: it has 2 vCPU, 4 GB of RAM and 80 GB NVMe of storage, and Gloamport lists it for "A Matrix server, Vaultwarden and SearXNG together". Encryption costs some CPU, so a second core helps.

According to Gloamport's survey of 10 November 2026, the median price of a comparable 2 vCPU, 4 GB VPS across 29 hosts was $31.29 a month. Gloam is $8.25 a month on 12 months and $16.50 on 1 month.

How do I encrypt a volume on a VPS with LUKS, step by step?

Seven steps for a data volume held in a file. The same commands work on a block device.

Install cryptsetup
Run apt install cryptsetup as root.
Create the container file
Allocate a file of the size you need. cryptsetup maps a regular file to a loop device by itself.
Format it as LUKS2
Run cryptsetup --type luks2 luksFormat on the file and choose a long passphrase. This wipes anything in the file.
Back up the header
Run luksHeaderBackup and store the file away from the VPS. A damaged header loses everything otherwise.
Open the volume
Run cryptsetup open with a mapping name. A device appears under /dev/mapper/.
Make a filesystem and mount it
Run mkfs.ext4 on the mapped device, create a folder and mount it.
Close it when you are done
Unmount, then cryptsetup close, which removes the mapping and wipes the key from kernel memory.

What are the exact LUKS commands?

The commands below follow the cryptsetup manual. luksFormat initialises the volume and sets the first passphrase, open creates the mapping, luksDump prints the header, and luksHeaderBackup stores a binary backup of the header and key slot area. The manual says that if the header of a LUKS volume is damaged, all data is permanently lost unless you have a header backup.

Create and format the container

apt install cryptsetup
fallocate -l 10G /root/vault.img
cryptsetup --type luks2 luksFormat /root/vault.img
cryptsetup luksHeaderBackup /root/vault.img --header-backup-file /root/vault.header

Open, format and mount

cryptsetup open /root/vault.img vault
mkfs.ext4 /dev/mapper/vault
mkdir -p /mnt/vault
mount /dev/mapper/vault /mnt/vault

Close it

umount /mnt/vault
cryptsetup close vault

Can I unlock an encrypted root disk remotely with dropbear-initramfs?

Yes, if the system boots from an encrypted root, a small SSH server in the initramfs can take the passphrase before the root filesystem is mounted. This needs an install you set up with an encrypted root, which is a bigger job than the data volume above, so treat it as an advanced step and check that your image and boot process allow it.

The Debian package dropbear-initramfs provides SSH access inside the initial RAM filesystem, for instance to unlock encrypted disks. Its documentation places your public keys in /etc/dropbear/initramfs/authorized_keys and options in /etc/dropbear/initramfs/dropbear.conf, and says to run update-initramfs -u -k all after changing them. It also advises not to reuse the main SSH host keys, because /boot is usually unencrypted.

Install and apply the initramfs SSH server

apt install dropbear-initramfs
nano /etc/dropbear/initramfs/authorized_keys
update-initramfs -u -k all

Optional: listen on another port (dropbear.conf)

DROPBEAR_OPTIONS="-p 2222"

How do I keep an encrypted VPS usable over time?

Back up the header, write the passphrase down offline, and keep your own copy of the data, since the plan has no backups. The cryptsetup manual says that backup is mandatory for encrypted data as well, if the data has any worth.

Lock the front door too. How do I harden SSH on a new VPS? covers it, and How do I generate an SSH key for my VPS? covers the key. Plans and terms are on the pricing page.

In summary

LUKS2 encrypts data at rest on a VPS with full KVM virtualization.
It does not hide a running VPS from the host, which can read RAM.
cryptsetup --type luks2 luksFormat creates the volume; open and close manage it.
Back up the header with luksHeaderBackup: a damaged header loses all data.
dropbear-initramfs allows remote unlocking of an encrypted root.
Gloam (2 vCPU, 4 GB RAM, 80 GB NVMe, 4 TB traffic) costs $8.25 a month on 12 months.

LUKS on a VPS: common questions

Can the VPS host read my LUKS-encrypted data?

Not from the disk, but yes while the volume is open, because the key and the data sit in memory the host can read. LUKS protects data at rest.

Can I use a file instead of a partition?

Yes. The cryptsetup manual says that if the device argument is a file, cryptsetup tries to allocate a loopback device and map it to that file.

What happens if I forget the passphrase?

The data cannot be read. Keep the passphrase safe and make a header backup, because a damaged header also loses everything.

What does dropbear-initramfs do?

It starts a small SSH server inside the initial RAM filesystem so you can unlock an encrypted root disk at boot from another machine.

Does Gloamport include backups?

No plan includes backups, so keep your own copy of anything you cannot lose.

Sources (4)

cryptsetup(8) manual page — Debian (checked 2026-11-10)
cryptsetup-luksFormat(8) manual page — Debian (checked 2026-11-10)
dropbear-initramfs README — Debian (checked 2026-11-10)
dropbear-initramfs package (trixie) — Debian (checked 2026-11-10)