I just install Debian 8.1. I allocated almost all disk 300 GiB to encrypted partition and a little bit for boot. I want to make smaller 50GiB encrypted physical volume and install different xen OS to the free space.

Is it possible to do it without data loss? How?

System info:

/dev/dm-1 ext4 /
/dev/sda1 ext2 /boot

Files in /dev/mapper:

  • control
  • hostname--vg-root
  • hostname--vg-swap_1
  • sda5_crypt

Added the answer to the first comment:

root@X550C:/home/user# lsblk
sda               8:0    0 298.1G  0 disk  
├─sda1            8:1    0   243M  0 part  /boot
├─sda2            8:2    0     1K  0 part  
└─sda5            8:5    0 297.9G  0 part  
  └─sda5_crypt  254:0    0 297.9G  0 crypt 
            254:1    0 290.1G  0 lvm   /
            254:2    0   7.8G  0 lvm   [SWAP]
sdb               8:16   0 931.5G  0 disk  
└─sdb1            8:17   0 931.5G  0 part  /media/user/Seagate Backup     Plus Drive
sr0              11:0    1  1024M  0 rom   
  • The output of lsblk and dmsetup table would help. You mean the PV for the "hostname" VG is on a LUKS-encrypted sda5? Do you mean xen domain instead of xen OS? Jul 21, 2015 at 7:49

1 Answer 1


Reduce each of the pieces, from the inside out. You'll need to do that with / unmounted, so you'll need to do it from a live CD/USB. SystemRescueCD is good at this kind of things. Note that you need fairly recent version of the LVM and cryptsetup tools.

  1. Shrink the / filesystem with resize2fs.

    resize2fs /dev/mapper/hostname--vg-root 240G
  2. Shrink the logical volume containing / with lvresize. Make absolutely sure you don't shrink it below the size of the filesystem. Run tune2fs -l /dev/mapper/hostname--vg-root to double-check the filesystem size.

    lvresize -L 240g hostname/vg-root

    Note: if supported, tell lvresize to call fsadm to resize the filesystem. This eliminates the risk of accidentally shrinking the volume below the size of the filesystem. If this works, the previous step can be skipped.

    lvresize -r -L 240g hostname/vg-root
  3. Shrink the physical volume sda5_crypt with pvresize. This may or may not work, due to a limitation of pvresize: if the logical volume happens to occupy some room near the end of the physical volume, pvresize won't move any data towards unoccupied space closer to the beginning of the volume. If you get bitten by that, the only solution I know of is to reduce the / filesystem and the logical volume as much as possible, and remove the swap volume, until you're able to shrink the physical volume to your content.

    pvresize --setphysicalvolume 248g /dev/mapper/sda5_crypt

    Then deactivate the volume group.

    vgchange -an hostname
  4. Shrink the encrypted volume with cryptsetup. Here again, make very sure not to shrink it below the size of the LVM physical volume. Note that the unit for the --size argument is 512-byte sectors. Very importantly, note that this is the size of the containing device, not the size of the encrypted data, so allow space for the metadata.

    cryptsetup resize --size $((248*2*1024*1024+4096)) sda5_crypt

    Then deactivate the encrypted volume.

    cryptsetup luksClose sda5_crypt
  5. Shrink the partition with fdisk. Make sure not to shrink it below the size of the encrypted volume. You can create a new partition here.

Tip: if unsure about sizes, leave a margin at each step: shrink the inside more than the outside. Then, once everything is smaller than your goal, enlarge the encrypted volume to fill the partition, then enlarge the physical volume to fill the encrypted volume, then enlarge the logical volume to fill the physical volume, then enlarge the filesystem to fill the logical volume. Calling cryptsetup resize, pvresize and resize2fs without a size argument makes them fill the containing volume.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .