> Deploying Gentoo Linux: LUKS Encryption, LVM, and UKI Boot Setup

$ uname -r
6.x.x-gentoo // System Initialized

When building a Gentoo system from scratch, standard partitioning just won't cut it for a hardened, production-ready environment. This guide walks through setting up a modern, encrypted Gentoo installation utilizing LUKS full-disk encryption, Logical Volume Manager (LVM), and a streamlined Unified Kernel Image (UKI) workflow.

1. Partitioning and LUKS Encryption

First, prepare your target disk (/dev/vda) by creating a fresh GPT partition table and partitioning layout (e.g., a boot partition and an encrypted root/lvm partition).

Create GPT Partition Table

fdisk /dev/vda

Create Encrypted LUKS Volume

Initialize the encryption layer on your secondary partition:

cryptsetup luksFormat /dev/vda2

Open the encrypted container so we can map volumes to it:

cryptsetup luksOpen /dev/vda2 crypt

2. Logical Volume Manager (LVM) Configuration

With the encrypted block device open, set up your volume group and logical partitions for root, swap, and home.

vgcreate volg /dev/mapper/crypt

lvcreate --name root -L 100G volg

lvcreate --name swap -L 18G volg

lvcreate --name home -l 100%free volg

3. Formatting and Mounting Filesystems

Format your partitions with appropriate filesystems (vfat for EFI boot, xfs for performance on root and home), activate swap, and mount everything into the target environment.

mkfs.vfat /dev/vda1
mkfs.xfs /dev/volg/root
mkfs.xfs /dev/volg/home
mkswap /dev/volg/swap
swapon /dev/volg/swap



mount /dev/volg/root /mnt/gentoo
mkdir -p /mnt/gentoo/{home,boot}
mount /dev/vda1 /mnt/gentoo/boot
mount /dev/volg/home /mnt/gentoo/home

4. Stage 3 Extraction and Chroot

Navigate into your mount point, pull down the systemd-based stage 3 tarball, and extract it safely preserving attributes and ownership.

cd /mnt/gentoo
wget https://distfiles.gentoo.org/releases/amd64/autobuilds/20250115T221822Z/stage3-amd64-systemd-20250115T221822Z.tar.xz
tar xpvf stage3-*.tar.xz --xattrs-include='*.*' --numeric-owner -C /mnt/gentoo

(Proceed with binding virtual filesystems and entering your chroot environment per standard Gentoo procedures).

5. Repository Sync, LVM & Cryptsetup Support

Once inside your chroot, sync your repository data and cryptographic keys:

emerge-webrsync && getuto

Configure Portage use flags for LVM and cryptsetup support, then emerge the packages:

nano /etc/portage/package.use/system

sys-fs/lvm2 lvm



emerge --ask sys-fs/lvm2 sys-fs/cryptsetup
rc-update add lvm boot

6. Kernel Installation & UKI Setup

Configure Portage use flags to utilize installkernel with ugrd, systemd-boot, and Unified Kernel Images (uki):

nano /etc/portage/package.use/system

sys-kernel/installkernel ugrd systemd-boot systemd uki ukify
sys-apps/systemd-utils kernel-install boot ukify



emerge --ask --oneshot installkernel

Configure ugrd

Set up your initial RAM disk generator configuration:

nano /etc/ugrd/config.toml

modules = [                          
  "ugrd.fs.fakeudev",                                                                                                                                                                                                                                                                                             
]

Install Bootloader:

bootctl install

7. Filesystem Table (fstab)

Populate your /etc/fstab with exact UUID mappings and persistent volume paths.

nano /etc/fstab

UUID=<YOUR_BOOT_UUID_HERE> /boot vfat umask=0077 0 2

/dev/volg/root /     xfs defaults,noatime 0 1
/dev/volg/home /home xfs defaults,noatime 0 2

/dev/volg/swap none swap sw 0 0

8. Kernel Build and Finalizing Firmware

Initialize your kernel command line tracking file and emerge a precompiled kernel target:

touch /etc/kernel/cmdline

emerge --ask gentoo-kernel-bin

Continue with installing your necessary system firmware packages, verify boot configuration files, and you are ready to reboot into your encrypted Gentoo environment.