Encryption key weirdness between host and backup pools. host is different from backup, but host unlocks part of backup data

No you didn’t.

I’m telling you, the ZFS design, which we’re stuck with forever, is stupid and counter-intuitive.


If you look at this post, try this thought experiment:

You see the rectangle named “tank (root dataset)”? No data ever lives directly inside. It serves no purpose other than to exist as the immutable root dataset and provide “defaults” for any pseudo-roots (or children) to inherit from.

That’s it. Nothing more. You don’t want to (nor need to) send it anywhere, because any target pool you try to send it to will have its own immutable root dataset that cannot be overwritten. You can only send a dataset to be nested underneath the destination pool’s root dataset.

If this dataset (that you nest underneath) is the source pool’s root dataset? It’s redundant and pointless, and will always create an extra “ladder” in your hierarchy for no useful benefit. In fact, if you promote your backup pool to the new main pool? Then it means you don’t have the same layout as the former main pool.

By accepting the purpose of a root dataset as a “glorified peg-hook”, you can focus on your own meaningful pseudo-roots, in which it makes sense to nest underneath a destination pool’s root dataset. (You retain the same layout, ladder, and hierarchy. The only difference being the name of the root dataset.)

This way you don’t need to tell the replicated dataset to “inherit” anything from its parent on the destination pool. You can just do a raw stream or provide your own passphrase / keystring, which is unrelated to the destination pool’s root dataset. (Encrypted or not, doesn’t matter. But if the destination pool’s root dataset is encrypted? It means you have to unlock one extra encryptionroot to be able to access the encryptionroot underneath; which you had sent over.)

In the flowchart, only the colored boxes are to have their own encryption passphrase/keystring (as encryptionroots), regardless of what the root dataset is. These are the only datasets being “sent” anywhere. The root dataset (“tank”) never gets sent anywhere.


My personal opinion, ZFS would have been way more intuitive if there was no immutable root dataset.

Can you imagine how much more sense it would make that upon creating a pool, it’s just a… pool. No datasets. Just a pool. Then in order to get started with datasets, you can start creating your own root datasets, which are independent of each other?

Sadly, that’ll never be the case, and hence why I use the pseudo-root method.

1 Like