luksbox size

How much disk space a vault uses; its maximum size; giving back free space at the end of the vault file.

luksbox size <PATH> [--max <SIZE>] [--shrink] [--unlock-args]

Shows where the size of the vault file goes, and optionally sets its maximum size or gives back the free space at its end (LUKSbox 0.6.1+). Unlocks the vault (the maximum size is stored in the encrypted metadata).

$ luksbox size vault.lbx
vault.lbx
  File size:      9.2 GB
  Metadata:       64.0 MB (header and encrypted file tree, fixed)
  Used by files:  7.1 GB
  Free inside:    2.0 GB (1.8 GB at the end can be given back: luksbox size vault.lbx --shrink)
  Maximum size:   unlimited
  Disk free:      412.3 GB

Why a vault does not shrink on its own

A vault grows as you add files. When you delete a file, its space stays inside the vault as free space, and the next files you add reuse it, so nothing is lost, but vault.lbx keeps its largest size. Shrinking automatically after every delete would mean moving data around, which costs time and wears out flash drives. Instead, --shrink gives back the free space at the end of the file when you ask for it. Free space in the middle stays inside the vault. Adding and changing files is just as fast either way.

Sizes

Every size option (--max, create --max-size, and the same fields in the wizard and the GUI) reads sizes the same way:

A limit smaller than the vault itself is refused: a new vault already takes about 64 MB (the header plus the default 64 MiB metadata region).

$ luksbox create v.lbx --max-size 62M
error: --max-size: 62.0 MB is smaller than the vault itself (64.0 MB). Use at least 65M, or create the vault with a smaller --metadata-size.

--max <SIZE>: maximum size

luksbox size vault.lbx --max 6G          # limit the vault file to 6 GB
luksbox size vault.lbx --max unlimited   # remove the limit (or --max 0)

Writes that would grow the vault past the limit fail with "no space left", as on a full disk (a mounted vault reports it to applications the same way). Free space inside the vault is still reused, and existing files can still be changed. Set it when creating a vault with create --max-size.

A limit below the current file size is fine: the vault stops growing, and --shrink (or deleting files) brings it under the limit.

A vault with a limit needs LUKSbox 0.6.1 or later to open; a vault without one (or whose limit was set back to unlimited) still opens in older versions.

--shrink: give back free space

luksbox size vault.lbx --shrink

Cuts the free space at the end of the vault file. It first saves the metadata without that space, then truncates the file, so an interruption at any point leaves a vault that opens normally.

To do it automatically when a mount ends, use luksbox mount --shrink-on-close. After luksbox rm frees at least 64 MB at the end, rm prints a hint; it never asks a question, so scripts cannot hang.

Deniable vaults

Deniable vaults are never shrunk on their own: anyone who sees the file at two points in time (backups, sync history, disk images) would learn from a smaller file that data was deleted, about how much, and when. The CLI never shrinks them (luksbox size --shrink and mount --shrink-on-close only work on standard vaults), and neither does the wizard.

If you accept that risk, the GUI can still give a deniable vault's free space back: open the Vault size dialog, tick "I understand that a smaller file reveals deletions", then click Give back ... anyway (the button shows how much).