CLEVIS-LUKS-BIND(1)

📦
version 24 · 13 versions
, in fedora 44

✨ clevis-luks-bind(1) ✨

okay bestie, sit down, hydrate, and let me tell you about clevis-luks-bind — it's the section 1 manual page for binding a LUKS device using a policy you pick. glazing this one fr fr 🫶

🌸 NAME 🌸

clevis-luks-bind — bind a LUKS device using the specified policy 💅

🎀 SYNOPSIS 🎀

clevis luks bind [-f] [-y] -d DEV [-t TKN_ID] [-s SLT] [-k KEY] [-e
EXISTING_TOKEN_ID] PIN CFG

like, that's the whole thing. PIN and CFG are right there at the end, no cap.

👑 OVERVIEW 👑

So the clevis luks bind command binds a LUKS device using whatever policy you specified, and honestly? It's giving one simple command energy:

$ clevis luks bind -d /dev/sda tang '{"url":...}'

That one little line does four whole steps, and yes, I'm counting them:

  1. Creates a new key with the same entropy as the LUKS master key — maximum entropy bits is 256.
  2. Encrypts the new key with Clevis.
  3. Stores the Clevis JWE in the LUKS header.
  4. Enables the new key for use with LUKS.

After that, your disk can be unlocked with your existing password as well as with the Clevis policy. Obsessed 😭✨

But!! You'll additionally need to enable one or more of the Clevis LUKS unlockers. Go peek at clevis-luks-unlockers(7) for that. iykyk.

💖 OPTIONS 💖

Every single one, no skips, we don't do that here:

  • -f — Do not prompt for LUKSMeta initialization.
  • -y — Automatically answer yes for all questions. When using tang, it causes the advertisement trust check to be skipped, which can be useful in automated deployments.
  • -d DEV — The LUKS device on which to perform binding.
  • -s SLT — The LUKSMeta slot to use for metadata storage.
  • -t TKN_ID — The LUKS token ID to use; only available for LUKS2.
  • -k KEY — Non-interactively read LUKS password from KEY file.
  • -k - — Non-interactively read LUKS password from standard input.
  • -e E_TKN_ID — LUKS token ID for existing passphrase; only available for LUKS2. This parameter allows providing a configured token ID in LUKS2 containing the existing passphrase for this device, so that existing passphrase is not prompted by clevis.

💀 CAVEATS 💀

bestie. sit. this part is not the cute part.

This command does not change the LUKS master key. Which implies that if you create a LUKS-encrypted image for use in a Virtual Machine or Cloud environment, all the instances that run this image will share a master key. That is extremely dangerous and should be avoided at all cost. I'm serious. all caps serious. 🚨

and no, this is not a limitation of Clevis — it's a design principle of LUKS. periodt.

So if you want encrypted root volumes in the cloud, you're gonna need to make sure you perform the OS install method for each instance in the cloud as well. The images cannot be shared without also sharing a master key. that's the deal, that's the vibe, that's just how it is 🌈

🦋 SEE ALSO 🦋

go read those next, they're lowkey iconic too ⭐

and that's the whole page, bestie!! this one's from the source/version + date line down at the bottom: 10/16/2026, and yes it's still CLEVIS-LUKS-BIND(1) on the corner like main character energy 💜

mwah 💋 now go bind something responsibly ✨

📦 where this page comes from