[dm-crypt] Why OVA size increases after encryption?

[dm-crypt] Why OVA size increases after encryption?

[Manish Upasani]

[-- Attachment #1: Type: text/plain, Size: 426 bytes --]

I am comparing the size of OVF after exporting the VM using OVFtool, or
others (doesn't make any difference). When I have no encryption, the VM
exports with *2.91G size*.

If I try to export the same VM after encrypting the disk using dm-crypt,
LUKS its sized at *4.34G*.

Can you please help me understand why and how to avoid it? I want to make
sure that the OVA size remains same / similar even after encryption.
Thank you

[-- Attachment #2: Type: text/html, Size: 2152 bytes --]

Re: [dm-crypt] Why OVA size increases after encryption?

[Ondrej Kozina]

On 3/9/20 8:16 PM, Manish Upasani wrote:
> 
> I am comparing the size of OVF after exporting the VM using OVFtool, or 
> others (doesn't make any difference). When I have no encryption, the VM 
> exports with *2.91G size*.
> 
> If I try to export the same VM after encrypting the disk using dm-crypt, 
> LUKS its sized at *4.34G*.

IIUC those formats are compressed for faster transfer. Encrypted data 
are in practice impossible to compress or to deduplicate. That's why you 
can see the size increase after you introduce encryption in VM.

Regards O.

Re: [dm-crypt] Why OVA size increases after encryption?

[Max Zettlmeißl]

On Tue, 10 Mar 2020 at 08:36, Ondrej Kozina <okozina@redhat.com> wrote:
>
> On 3/9/20 8:16 PM, Manish Upasani wrote:
> >
> > I am comparing the size of OVF after exporting the VM using OVFtool, or
> > others (doesn't make any difference). When I have no encryption, the VM
> > exports with *2.91G size*.
> >
> > If I try to export the same VM after encrypting the disk using dm-crypt,
> > LUKS its sized at *4.34G*.
>
> IIUC those formats are compressed for faster transfer.

I'm not familiar with the intricacies of the OVF, but the contained
disk images might also be sparse by default (which is very common for
VM images) and when encrypting their whole filesystem as it is done
with dm-crypt they can't remain sparse from an outside point of view.

Re: [dm-crypt] Why OVA size increases after encryption?

[Milan Broz]

On 10/03/2020 08:36, Ondrej Kozina wrote:
> On 3/9/20 8:16 PM, Manish Upasani wrote:
>>
>> I am comparing the size of OVF after exporting the VM using OVFtool, or 
>> others (doesn't make any difference). When I have no encryption, the VM 
>> exports with *2.91G size*.
>>
>> If I try to export the same VM after encrypting the disk using dm-crypt, 
>> LUKS its sized at *4.34G*.
> 
> IIUC those formats are compressed for faster transfer. Encrypted data 
> are in practice impossible to compress or to deduplicate. That's why you 
> can see the size increase after you introduce encryption in VM.

I think the problem is that you have disabled TRIM for the crypt device,
so the unused block are still allocated.

Usual trick is to enable TRIM for encrypted device and then call
fstrim for the filesystem - OVA image should shrink.

You need to enable it on several places though (VM config and crypttab at least).

Milan

Re: [dm-crypt] Why OVA size increases after encryption?

[Manish Upasani]

[-- Attachment #1: Type: text/plain, Size: 1122 bytes --]

Thank you, Milan. I will give it a try and see if that works.
Best
Manish Upasani



On Tue, Mar 10, 2020 at 1:50 AM Milan Broz <gmazyland@gmail.com> wrote:

> On 10/03/2020 08:36, Ondrej Kozina wrote:
> > On 3/9/20 8:16 PM, Manish Upasani wrote:
> >>
> >> I am comparing the size of OVF after exporting the VM using OVFtool, or
> >> others (doesn't make any difference). When I have no encryption, the VM
> >> exports with *2.91G size*.
> >>
> >> If I try to export the same VM after encrypting the disk using
> dm-crypt,
> >> LUKS its sized at *4.34G*.
> >
> > IIUC those formats are compressed for faster transfer. Encrypted data
> > are in practice impossible to compress or to deduplicate. That's why you
> > can see the size increase after you introduce encryption in VM.
>
> I think the problem is that you have disabled TRIM for the crypt device,
> so the unused block are still allocated.
>
> Usual trick is to enable TRIM for encrypted device and then call
> fstrim for the filesystem - OVA image should shrink.
>
> You need to enable it on several places though (VM config and crypttab at
> least).
>
> Milan
>

[-- Attachment #2: Type: text/html, Size: 1909 bytes --]