Learning Artix Linux - Storage: LVM, Btrfs & Encryption

#Introduction

Data is the most valuable asset on a system. Episode 10 covers three storage layers you can combine on Artix: LVM for volume flexibility, Btrfs for subvolumes and snapshots, and encryption with LUKS/dm-crypt so your data stays safe if the machine is stolen. We'll also see how all of this integrates with the mkinitcpio hooks at boot.

The choices aren't exclusive — LVM, Btrfs, and LUKS can be layered. The key is understanding what each one provides, then stacking them to fit your needs.

#LVM: Logical Volume Manager

#Concepts: PV, VG, LV

LVM adds a virtualization layer above physical partitions. The workflow: a Physical Volume (PV) is created on a partition, collected into a Volume Group (VG), then divided into Logical Volumes (LV) used as filesystems. LV sizes can be changed without repartitioning.

Create LVM from a partition:

pvcreate /dev/sda2
vgcreate vg0 /dev/sda2
lvcreate -L 40G -n root vg0
mkfs.ext4 /dev/vg0/root

lvcreate -L 40G -n root vg0 creates an LV named root of 40 GB in volume group vg0. Mount the LV like a normal filesystem: /dev/vg0/root to /.

#Managing Size

LVM's advantage shows when capacity runs out. Grow the LV and filesystem without unmounting, for ext4:

lvextend -L +10G /dev/vg0/root
resize2fs /dev/vg0/root

For XFS use xfs_growfs. Check status with vgs and lvs.

#Btrfs: Subvolumes and Snapshots

#Subvolumes as Separate Units

Btrfs supports subvolumes: directories that can be mounted, snapshotted, and rolled back independently. This is a modern way to manage a system — root, home, and data can each have their own subvolume.

Create subvolumes after formatting:

mkfs.btrfs -f /dev/vg0/root
mount /dev/vg0/root /mnt
btrfs subvolume create /mnt/@root
btrfs subvolume create /mnt/@home
umount /mnt

The @root and @home subvolumes will be mounted separately at / and /home. List subvolumes with btrfs subvolume list /.

#Snapshots for Rollback

A snapshot is an instant copy of a subvolume — the main backup tool in episode 16:

btrfs subvolume snapshot -r /mnt/@root /mnt/@snap-root-2026-08-10

The -r snapshot is read-only, safe as a recovery point. Check the result with btrfs subvolume list /mnt.

#Filesystem Choices: ext4 and XFS

#ext4: Versatile and Stable

ext4 is the safest default: stable, supported everywhere, and easy to repair. It suits almost any workload, especially when combined with LVM.

#XFS: For Heavy Write Loads

XFS excels with large files and write-heavy workloads. On Artix, install it with sudo pacman -S xfsprogs then format with mkfs.xfs. Note that XFS cannot be shrunk and Btrfs snapshots don't apply to it — consider this when choosing.

#Encryption with LUKS/dm-crypt

#Setting Up an Encrypted Partition

LUKS with the kernel's dm-crypt provides full-disk encryption. Prepare an encrypted partition before creating a filesystem:

cryptsetup luksFormat /dev/sda2
cryptsetup open /dev/sda2 cryptroot
mkfs.ext4 /dev/mapper/cryptroot

cryptsetup luksFormat /dev/sda2 asks for a passphrase the first time. After being opened, the partition appears as /dev/mapper/cryptroot, which can be formatted and mounted.

#Boot Configuration with the encrypt Hook

To boot from an encrypted partition, add the encrypt hook in /etc/mkinitcpio.conf. On systems with the udev hook, place encrypt after it:

HOOKS=(base udev autodetect modconf kms keyboard keymap consolefont block encrypt filesystems fsck)

After changing the hooks, regenerate the initramfs:

mkinitcpio -P

The mkinitcpio -P command rebuilds the initramfs for all kernels. GRUB also needs a cryptdevice parameter so the kernel knows where the encrypted partition is. Without the encrypt hook, the system can't find root at boot.

#Verifying Encryption

Make sure encryption is truly active by checking the mapping status:

cryptsetup status cryptroot
lsblk -f

The output of cryptsetup status cryptroot shows the cipher, mode, and mapped device. lsblk -f shows the encrypted partition hidden under the cryptroot layer.

#Stacking All the Layers

#Complete LUKS + LVM Scheme

A common combined scheme: encryption on the physical partition, LVM on top, then a filesystem. The setup order:

cryptsetup luksFormat /dev/sda2
cryptsetup open /dev/sda2 cryptlvm
pvcreate /dev/mapper/cryptlvm
vgcreate vg0 /dev/mapper/cryptlvm
lvcreate -L 40G -n root vg0
mkfs.ext4 /dev/vg0/root

The key point: LVM must only be created on top of /dev/mapper/cryptlvm, not on the raw partition. All data inside the LVs is automatically encrypted.

#Passphrase Policy

Use a long, unique passphrase, and store a LUKS header backup in a safe place. A lost LUKS header means the data can't be opened even with the correct passphrase:

cryptsetup luksHeaderBackup /dev/sda2 --header-backup-file /root/luks-header.bin

The command cryptsetup luksHeaderBackup stores the header in an external file. Keep this file on separate, private media.

#Conclusion

Episode 10 equipped you with flexible and secure storage: LVM for easily resizable volumes, Btrfs for subvolumes and snapshots, the ext4/XFS choice, and LUKS/dm-crypt encryption with the encrypt hook in mkinitcpio.

Key takeaways:

• LVM separates PV, VG, and LV so resizing is easy.
• Btrfs subvolumes allow separate mounts and snapshots.
• ext4 is versatile; XFS is for heavy write loads.
• LUKS encrypts disks; dm-crypt provides the mapping layer.
• The encrypt hook is required in mkinitcpio for an encrypted root.
• Back up the LUKS header; losing it means losing data.

In the next episode, episode 11, we'll cover kernel and firmware — the linux, linux-lts, and linux-zen kernels, custom kernels, mkinitcpio hooks, linux-firmware, and the intel-ucode and amd-ucode microcode packages.