STRATIS(8)

📦

version 3.9.1 · 5 versions

3.9.1 · fedora 43, fedora 44 (latest)
3.7.0 · centos-stream 9
3.9.0 · centos-stream 10
3.8.2 · fedora 43
3.8.3 · fedora 44

, in fedora 43, fedora 44

STRATIS(8) 💖

okay so bestie, welcome to the stratis manual page — part 1 of 3, we're going on a journey 💅

🌸 NAME 🌸

stratis — Configure Stratis local storage pools ✨

🦋 SYNOPSIS 🦋

stratis [GLOBAL OPTIONS] pool <command> [args] [COMMAND OPTIONS]
stratis [GLOBAL OPTIONS] filesystem|fs <command> [args] [COMMAND OPTIONS]
stratis [GLOBAL OPTIONS] blockdev <command> [args] [COMMAND OPTIONS]
stratis [GLOBAL OPTIONS] key <command> [args] [COMMAND OPTIONS]
stratis [GLOBAL OPTIONS] report <report_name>
stratis [GLOBAL OPTIONS] daemon <version>

💖 DESCRIPTION 💖

okay so stratis is a command-line tool to create, modify, and destroy Stratis pools, and the filesystems allocated from the pool. it's giving storage management main character energy 🔥

Stratis creates a pool from one or more block devices (blockdevs), and then enables multiple filesystems to be created from the pool. The user can set keys for use with pool encryption. no cap, it's that simple.

✨ GLOBAL OPTIONS ✨

--version — Show stratis-cli version. 👑
--help, -h — Show help on command. 🫶
--propagate — (For debugging.) Allow exceptions raised during execution to propagate. 🐛
--unhyphenated-uuids — (For listing.) Print pool and filesystem UUIDs without hyphens for list commands. 💅

🌈 COMMANDS 🌈

`pool create`

pool create [--key-desc <key_desc>] [--clevis <(nbde|tang|tpm2)>
[--tang-url <tang_url>] [<(--thumbprint <thp> | --trust-url)>]
[--no-overprovision] [--integrity <(no,pre-allocate)>] [--journal-size
<journal_size>] [--tag-spec <tag_spec>] <pool_name> <blockdev>
[<blockdev>..]

Create a pool from one or more block devices, with the given pool name. The --tag-spec and --journal-size options are used to configure the amount of space to reserve for integrity metadata. 💾

`pool stop`

pool stop <(--uuid <uuid> |--name <name>)>

Stop a pool, specifying the pool by its UUID or by its name. Tear down the storage stack but leave all metadata intact. 💀 (not in a bad way, just the stack goes bye)

`pool start`

pool start [--remove-cache] [--keyfile-path KEYFILE_PATH |
--capture-key] --unlock-method <(any | clevis | keyring)> <(--uuid
<uuid> |--name <name>)>

Start a pool, specifying the pool by its UUID or by its name. Use the --unlock-method option to specify a method of unlocking the pool if it is encrypted. If an unlock method of any is specified the pool will be unlocked with any facility available that allows the pool to be unlocked. If --keyfile-path or --capture-key is specified, then the pool will use only the passphrase specified by either of these options; the pool will not be unlocked if the passphrase is incorrect. The --unlock-method option is required if --keyfile-path or --capture-key is used. If the value is any, the specified passphrase will be tried for all keyslots; otherwise the specified passphrase will be tried only for the keyslot corresponding to the specified method. If --remove-cache is specified, the pool’s cache, if there is one, will not be set up and the Stratis metadata on each of the pool’s cache devices, if any, will be removed. 🔐

`pool list`

pool list [--stopped] [(--uuid <uuid> |--name <name>)]

List pools. If the --stopped option is used, list only stopped pools. Otherwise, list only started pools. If a UUID or name is specified, print more detailed information about the pool corresponding to that UUID or name. 📋

`pool rename`

pool rename <old_pool_name> <new_pool_name>

Rename a pool. ✨

`pool destroy`

pool destroy <pool_name>

Destroy a pool and all the filesystems created from it. 💥 (gone, reduced to atoms)

`pool add-data`

pool add-data <pool_name> <blockdev> [<blockdev>..]

Add one or more blockdevs to an existing pool, to enlarge its storage capacity. 📈

`pool init-cache`

pool init-cache <pool_name> <blockdev> [<blockdev>..]

Initialize a cache for an existing pool. Add one or more blockdevs to a pool, to be used as cache instead of additional storage. Typically, smaller and faster drives, such as SSDs, are used for this purpose. ⚡

`pool add-cache`

pool add-cache <pool_name> <blockdev> [<blockdev>..]

Add one or more blockdevs to an existing pool with an initialized cache. 🧊

`pool extend-data`

pool extend-data <pool_name> [--device-uuid <uuid>]

Increase the pool’s data capacity with additional storage space offered by its component data devices through, e.g., expansion of a component RAID device. Devices may be specified by their Stratis UUID. If no devices are specified, then stratisd will attempt to make use of all data devices belonging to the pool that appear to have been expanded. 🚀

`pool bind`

pool bind <(nbde|tang)> <pool name> <url> <(--thumbprint <thp> |
--trust-url)>

Bind the devices in the specified pool to a supplementary encryption mechanism that uses NBDE (Network-Bound Disc Encryption). tang is an alias for nbde. MOVE NOTICE: The "bind" subcommand can also be found under the "pool encryption" subcommand. The "pool bind" subcommand that you are using now is deprecated and will be removed in stratis 3.10.0. ⚠️

`pool bind tpm2`

pool bind tpm2 <pool name>

Bind the devices in the specified pool to a supplementary encryption mechanism that uses TPM 2.0 (Trusted Platform Module). MOVE NOTICE: The "tpm2" subcommand can also be found under the "pool encryption bind" subcommand. The "pool bind tpm2" subcommand that you are using now is deprecated and will be removed in stratis 3.10.0. ⚠️

`pool bind keyring`

pool bind keyring <pool name> <keydesc>

Bind the devices in the specified pool to a supplementary encryption mechanism using a key in the kernel keyring. MOVE NOTICE: The "keyring" subcommand can also be found under the "pool encryption bind" subcommand. The "pool bind keyring" subcommand that you are using now is deprecated and will be removed in stratis 3.10.0. ⚠️

`pool rebind clevis`

pool rebind clevis <pool name> [--token-slot <token slot>]

Rebind the devices in the specified pool using the Clevis configuration with which the devices in the pool were previously bound. MOVE NOTICE: The "clevis" subcommand can also be found under the "pool encryption rebind" subcommand. The "pool rebind clevis" subcommand that you are using now is deprecated and will be removed in stratis 3.10.0. ⚠️

`pool rebind keyring`

pool rebind keyring <pool name> <keydesc> [--token-slot <token slot>]

Rebind the devices in the specified pool using the specified key description. MOVE NOTICE: The "keyring" subcommand can also be found under the "pool encryption rebind" subcommand. The "pool rebind keyring" subcommand that you are using now is deprecated and will be removed in stratis 3.10.0. ⚠️

`pool unbind`

pool unbind <(clevis|keyring)> <pool name> [--token-slot <token slot>]

Unbind the devices in the specified pool from the specified encryption mechanism. MOVE NOTICE: The "unbind" subcommand can also be found under the "pool encryption" subcommand. The "pool unbind" subcommand that you are using now is deprecated and will be removed in stratis 3.10.0. ⚠️

`pool encryption on`

pool encryption on --in-place <(--uuid <uuid> |--name <name>)>
[--key-desc <key_desc>] [--clevis <(nbde|tang|tpm2)> [--tang-url
<tang_url>] [<(--thumbprint <thp> | --trust-url)>]

Turn encryption on for the specified pool. This operation takes time proportional to the size of the pool. ⏳

`pool encryption off`

pool encryption off --in-place <(--uuid <uuid> |--name <name>)>

Turn encryption off for the specified pool. This operation takes time proportional to the size of the pool. ⏳

`pool encryption reencrypt`

pool encryption reencrypt --in-place <(--uuid <uuid> |--name <name>)>

Reencrypt the pool with a new master key. This operation takes time proportional to the size of the pool. ⏳

`pool encryption bind`

pool encryption bind <(nbde|tang)> <(--uuid <uuid> |--name <name>)>
<(--thumbprint <thp> | --trust-url)> <url>

Bind the devices in the specified pool to a supplementary encryption mechanism that uses NBDE (Network-Bound Disc Encryption). tang is an alias for nbde. 🔐

`pool encryption bind tpm2`

pool encryption bind tpm2 <(--uuid <uuid> |--name <name>)>

Bind the devices in the specified pool to a supplementary encryption mechanism that uses TPM 2.0 (Trusted Platform Module). 🔐

`pool encryption bind keyring`

pool encryption bind keyring <(--uuid <uuid> |--name <name>)> <keydesc>

Bind the devices in the specified pool to a supplementary encryption mechanism using a key in the kernel keyring. 🔐

`pool encryption rebind clevis`

pool encryption rebind clevis <(--uuid <uuid> |--name <name>)>
[--token-slot <token slot>]

Rebind the devices in the specified pool using the Clevis configuration with which the devices in the pool were previously bound. 🔁

`pool encryption rebind keyring`

pool encryption rebind keyring <(--uuid <uuid> |--name <name>)>
<keydesc> [--token-slot <token slot>]

Rebind the devices in the specified pool using the specified key description. 🔁

`pool encryption unbind`

pool encryption unbind <(clevis|keyring)> <(--uuid <uuid> |--name
<name>)> [--token-slot <token slot>]

Unbind the devices in the specified pool from the specified encryption mechanism. 🔓

`pool set-fs-limit`

pool set-fs-limit <pool name> <amount>

Set the limit on the number of file systems allowed per-pool. This number may only be increased from its current value. 📊

`pool overprovision`

pool overprovision <pool name> <(yes|no)>

Set overprovisioning mode. If set to "yes", the pool may allow overprovisioning, i.e, the sum of the logical sizes of the Stratis filesystems supported by the pool may exceed the amount of data space available. 🍰

`pool explain`

pool explain <code>

Explain any code that might show up in the Alerts column when listing a pool. Codes may be prefixed with an "I" for "info", a "W" for "warning", or an "E" for "error". 🧐

`pool debug get-object-path`

pool debug get-object-path <(--uuid <uuid> |--name <name>)>

Look up the D-Bus object path for a pool given the UUID or name. 🔍

`pool debug get-metadata`

pool debug get-metadata [--pretty] [--written] <(--uuid <uuid> |--name
<name>)>

Get the pool-level metadata for the specified pool. If --written is not set, get metadata that would be written if metadata were written now, otherwise get the most recently written metadata. If --pretty is set, format prettily, otherwise print all on one line. 📄

`filesystem create`

filesystem create <pool_name> <fs_name> [<fs_name>..] [--size <size>]
[--size-limit <size_limit>]

Create one or more filesystems from the specified pool. If the --size option is specified, make each filesystem the specified size. Otherwise, accept the stratisd default. if the --size-limit option is specified, set the filesystem’s size limit on creation. If the size limit is not set, the filesystem will be grown, as needed, up to the maximum possible size. The filesystem size limit must be at least as large as the filesystem size. NOTE: There is a temporary restriction on the number of filesystems that can be specified with this command. Specifying more than one filesystem will result in an error. 🚨

`filesystem snapshot`

filesystem snapshot <pool_name> <fs_name> <snapshot_name>

Snapshot the filesystem in the specified pool. 📸

💖 `filesystem list [pool_name]`

Bestie, this one just lists. Every filesystem in the pool you name — or every filesystem across all pools, if you don't give a pool_name at all. No pool name means the whole collection, no cap.

🗑️ `filesystem destroy <pool_name> <fs_name> [<fs_name>..]`

Destroys one or more filesystems that exist in the pool you named. And yes, you can pass multiple <fs_name>s — they all get taken out together. RIP to them.

✏️ `filesystem rename <pool_name> <fs_name> <new_name>`

Renames a filesystem. That's it, that's the whole thing, and honestly? Love that for us.

📏 `filesystem set-size-limit <pool_name> <fs_name> <size_limit>`

Sets the filesystem's size limit. Crucial detail: the limit must be at least as large as the filesystem's current size — no shrinking below what's already there. And if you want the size limit to be exactly the same value as the filesystem's current size, you don't do math, you just pass the keyword current. Iconic shortcut behaviour, truly.

🚫 `filesystem unset-size-limit <pool_name> <fs_name>`

Removes a filesystem size limit that you previously set. Undoing the thing.

⏪ `filesystem schedule-revert <pool_name> <snapshot_name>`

Sets a flag so that the next time the pool starts, the snapshot you named overwrites its origin filesystem. So like... a scheduled rewind, queued up for next boot.

⚠️ Heads up, this matters: a snapshot that is scheduled to overwrite its origin filesystem can not be destroyed. You have to cancel the scheduled revert first before the snapshot or its origin can be destroyed. There is no sneaking around this.

🙅 `filesystem cancel-revert <pool_name> <snapshot_name>`

Cancels a scheduled revert. The un-scheduling of the rewind.

🔍 `filesystem debug get-object-path <(--uuid <uuid> |--name <name>)>`

Looks up the D-Bus object path for a filesystem, given its UUID or its name. Pick whichever one you have, bestie.

🕵️ `filesystem debug get-metadata <pool_name> [--pretty] [--written] [--fs-name <fs-name>]`

Gets the filesystem metadata for the pool you specify, and optionally for a specifically named filesystem if you pass --fs-name <fs-name>. Now the flag tea:

If --written is not set, you get the metadata that would be written if metadata were written right now.
If --written is set, you get the most recently written metadata instead.
If --pretty is set, it's formatted prettily. Otherwise it all prints on one line.

🧱 `blockdev list [pool_name]`

Lists all the blockdevs that make up the pool you named — or all pools, if you didn't name one. Same energy as the filesystem list, different noun.

🔎 `blockdev debug get-object-path <(--uuid <uuid>)>`

Looks up the D-Bus object path for a blockdev, given the UUID. UUID only on this one, no name option, don't come for me.

🔑 `key list`

Lists all the key-descriptions in the kernel keyring that can be used for encryption. A whole little roster of keys.

🔐 `key set <(--keyfile-path <path> | --capture-key)> <key_desc>`

Sets a key in the kernel keyring so it can be used with encryption. You supply the key one of two ways (see the --keyfile-path / --capture-key options below), plus the key description.

♻️ `key reset <(--keyfile-path <path> | --capture-key)> <key_desc>`

Resets the key data of a key that already exists in the kernel keyring. Not a new key — the same slot, fresh data.

🚮 `key unset <key_desc>`

Unsets a key in the kernel keyring, so it is no longer available for encryption operations. Bye, key.

📊 `report <report_name> [--no-sort-keys]`

Gets a report from the daemon about its internal state. The engine_state_report name will be supported in future releases. Any other report name should be considered unstable and may be removed in a future release. And the JSON schema of any report must always be considered unstable — like, permanently, no promises ever. The keys in the JSON schema are sorted in the output, unless the --no-sort-keys option is set.

🏷️ `daemon version`

Shows the Stratis service's version. Quick little identity check for your daemon.

🛠️ `debug refresh`

For all pools that are not stopped, this rebuilds their storage stacks from the pool-level metadata stored on each pool's devices.

🚨 Real talk: this is not a standard administrative command. It is intended for trouble-shooting and repair only. Do not just casually run this one, bestie, it's the emergency drawer of commands.

✨ OPTIONS ✨

--key-desc — The key description of the key that should be used to encrypt the created pool. That key description has to correspond to a key that you set in the kernel keyring with the key command. No matching key, no encryption.
--keyfile-path <path> | --capture-key — These two are mutually exclusive, meaning you pick one and only one, and they let you hand over an encryption key in one of two ways. The --keyfile-path option requires an argument: the path to a file containing the key. If you choose --capture-key instead, you have to type the key in at the prompt that follows. Now the detail that gets people: with --capture-key, the key value is terminated at the first newline character you enter, and the newline character is not included in the key value. Meanwhile, if the file you passed as the argument to --keyfile-path contains a newline character anywhere, that newline character will be included in the key value. Yes, they behave differently. That's the rule, not a vibe.
--thumbprint <thp> | --trust-url — Also mutually exclusive. These let you either declare that a tang server's URL should be trusted and the server's credentials accepted without verification, or supply a previously provided thumbprint so the verification actually happens. Trusting blindly vs. checking the receipt. Your call, but know which one you're doing.
--tang-url <url> — If you're creating a pool encrypted via NBDE using a tang server, this specifies the URL of the server.
--clevis <(nbde | tang | tpm2)> — The clevis method that should be used to encrypt the created pool. Your choices are nbde, tang, or tpm2.
--no-overprovision — Do not allow the pool to allocate more logical space for its filesystems than it has physical space available. Basically: don't promise storage you can't back up.
--size <size spec> — Used to specify the size of, like, a filesystem. The specification format must follow the standard size specification format for input, which is spelled out right below. 👇
--token-slot <token slot> — For V2 pools only. Use the token slot number to select among different bindings that use the same encryption method.
--in-place — This is a mandatory option that must be set when you're requesting a long-running in-place encryption operation. So let's talk about what you're signing up for:
- These operations are the kind that change the pool's data as well as its metadata.
- Because of that, they take a time that is linear in the size of the pool. Big pool, long wait.
- They also run in place, meaning the pool's data blocks are directly modified while it is in use.
- While the operation is happening, automatic administrative actions — for example, extending filesystems — can not be taken on the pool.
- Furthermore, user-initiated actions, like adding a new device to a pool, are also disabled.
- So the pool administrator should therefore ensure that no administrative operations will become urgently necessary while the encryption operation is running.

💀 And consider backing up your data before initiating this operation. For real. That's in the manual, not just me being dramatic.

📐 SIZE SPECIFICATION FORMAT FOR INPUT

The format of a size specification is '<magnitude><unit specifier>' where the magnitude must be a decimal integer and the unit specifier may be any of 'B', 'KiB', 'MiB', 'GiB', 'TiB'. or 'PiB'.

🌈 ENVIRONMENT VARIABLES 🌈

STRATIS_DBUS_TIMEOUT — Sets a timeout for any Stratis D-Bus call. If this environment variable is not set, a default value of 120 seconds is used for the timeout. The accepted STRATIS_DBUS_TIMEOUT environment variable values are:
1. an integer between 0 (inclusive) and 1073741823 (inclusive), which represents the timeout length in milliseconds
2. -1, which represents the libdbus default timeout

🔍 LIST OUTPUT FIELDS 🔍

okay bestie so when you run a list command, the columns you get back depend entirely on which flavour of list you asked for. different vibes, different fields. let's go through them one by one 💅

FIELDS for `stratis pool list` 💖

Name — the name of the pool, obviously. it's giving "what did I call this thing again" ✨
Total / Used / Free — the physical usage statistics for the pool. the receipts, basically 💀
Properties — boolean valued properties that the pool may have. each property has a two-letter camel-case code. and here's the tea:
- if the pool does not have the property, a ~ (for negation) gets prepended to the property code.
- if the engine hit an error getting the property, a "?" (representing "unknown") gets prepended to the property code.
- the property codes are:
  - Le — indicates that the pool is a legacy pool
  - Ca — indicates the pool has a cache
  - Cr — indicates the pool is encrypted
  - Op — indicates the pool allows overprovisioning
UUID — the UUID of the pool. her government name 🫶
Alerts — any unusual or urgent info about the pool that the user should be made aware of. the notifications, if you will 🚨

FIELDS for `stratis pool list --stopped` 🛑

Name — the name of the pool.
UUID — the UUID of the pool.
# Devices — the number of devices used by the pool. literally the headcount 🔢
Key Description — the kernel key description used by the pool.
Clevis — the status of Clevis encryption ("present" or "N/A").

FIELDS for `stratis pool list [(--uuid <uuid> |--name <name>)]` 👑

UUID — the UUID of the pool.
Name — the name of the pool.
Alerts — a list of all alerts on the pool, as a text summary.
Metadata Version — the metadata version that the pool is using.
Actions Allowed — what actions may be taken on the pool. generally the pool will be listed as fully operational. so like, she's fine 💅
Cache — whether or not the pool has a cache.
Filesystem Limit — the maximum number of filesystems the pool allows.
Allows Overprovisioning — whether or not the pool allows overprovisioning.
Encryption Enabled — whether or not encryption is enabled for this pool.
Encryption Enabled: Key Description — the key description, if the pool is encrypted using a key in the kernel keyring. only displayed if metadata version is 1 and encryption is enabled.
Encryption Enabled: Clevis Configuration — the Clevis configuration, if the pool is encrypted via Clevis. only displayed if metadata version is 1 and encryption is enabled.
Encryption Enabled: Last Time Reencrypted — the last time the pool was re-encrypted. if the pool has never been re-encrypted, the value is "Never". only displayed if metadata version is 2 and encryption is enabled.
Encryption Enabled: Free Token Slots Remaining — the number of token slots remaining that can accommodate new bindings, followed by a list of binding descriptions, ordered by token slot. only displayed if metadata version is 2 and encryption is enabled.
Space Usage: Fully Allocated — whether or not all the space on a pool's devices has been allocated for some purpose.
Space Usage: Size — the total size of all the devices in the pool.
Space Usage: Allocated — the space on the devices allocated for some purpose, e.g., to store Stratis filesystem metadata or user data. once space has been allocated for one purpose, it can not, in general, be reclaimed and used for another purpose. no take-backs 😭
Space Usage: Used — the space on the devices that is in use. used space can be reclaimed. for example, destroying a Stratis filesystem will reduce this value. so it's not forever, slay ✨

FIELDS for `stratis pool list [(--uuid <uuid> |--name <name>)] --stopped` 🦋

UUID — the UUID of the pool.
Name — the name of the pool.
Metadata Version — the metadata version that the pool is using.
Encryption Enabled — whether or not encryption is enabled.
Encryption Enabled: Key Description — the key description, if the pool is encrypted using a key in the kernel keyring. only displayed if metadata version is 1 and encryption is enabled.
Encryption Enabled: Clevis Configuration — the Clevis configuration, if the pool is encrypted via Clevis. only displayed if metadata version is 1 and encryption is enabled.
Encryption Enabled: Allows Unlock via a Key in Kernel Keyring or a User-Entered Passphrase — whether or not the pool can be unlocked via a key in the kernel keyring or a user-entered passphrase. only displayed if metadata version is 2 and encryption is enabled.
Encryption Enabled: Allows Unattended Unlock via Clevis — whether or not the pool can be unlocked via Clevis. only displayed if metadata version is 2 and encryption is enabled.

FIELDS for `stratis filesystem list` 🌸

Pool — the name of the pool containing the filesystem.
Filesystem — the name of the filesystem.
Total / Used / Free — the size of the filesystem.
Created — the time the filesystem was created. her birthday 🎂
Device — the device path to use for mounting the filesystem.
UUID — the UUID of the filesystem.

FIELDS for `stratis filesystem list [(--uuid <uuid> |--name <name>)]` 🎀

UUID — the UUID of the filesystem.
Name — the name of the filesystem.
Pool — the name of the filesystem's pool.
Device — the device path to use for mounting the filesystem.
Created — the time the filesystem was created.
Snapshot origin — if this filesystem is a snapshot, its origin. if the filesystem is a snapshot, whether or not it is scheduled to replace its origin next time the pool is started.
Sizes — the logical size of the Stratis filesystem, the total space actually used, and the logical amount free on the Stratis filesystem. since every Stratis filesystem holds an XFS filesystem, a new Stratis filesystem will have a non-zero amount used for the XFS filesystem metadata. so like, don't panic if it's not exactly zero, bestie 💜

FIELDS for `stratis blockdev list` 🔥

Pool Name — the name of the pool using the block device.
Device Node — the device node of the block device. a second device node will be displayed in parentheses if the block device is encrypted. this device node is the device node of the associated dm-crypt device.
Physical Size — the total size of the device on which stratisd places Stratis metadata. if the device is encrypted, this size will be slightly smaller than the total size of the device specified by the user; it will be the size of the associated dm-crypt device. a second size will be displayed in parentheses if stratisd has observed that the device has a size that is different from the size that stratisd is making use of. this can happen if, e.g., a RAID device was previously added to a pool and has since been expanded.
Tier — the data tier type ("Data" or "Cache").
UUID — the UUID of the block device.

FIELDS for `stratis key list` 🔑

Key Description — the key description corresponding to a key in the kernel keyring that that can be used for encryption.

🚧 RESTRICTIONS 🚧

okay so there are some hard rules here, and they're not vibes-based, they're real:

Encryption and a cache are mutually exclusive choices. if a pool is encrypted, an attempt to initialize a cache will result in an error. pick a lane, bestie 💅
there's a restriction on the total size of the cache device of 32 TiB. adding devices to the cache so that the cumulative size of all the devices in the cache exceeds 32 TiB will result in an error. like, that's the ceiling, fr fr 😤

📝 NOTES 📝

if a block device appears to be already in use, stratisd will refuse to claim it. to allow use with stratisd, any signature on the device must first be erased.

⚠️ please carefully verify the identity and availability of the device before taking such a step. like genuinely, double-check, because erasing a signature is not a "whoopsie" moment 😭

✨ EXAMPLES ✨

Example 1. Creating a Stratis pool

stratis pool create mypool /dev/sdb /dev/sdc

Example 2. Creating an encrypted pool

stratis key set --capture-key someKeyDescription

stratis pool create --key-desc someKeyDescription mypool /dev/sdb
/dev/sdc

Example 3. Creating a filesystem from a pool

stratis filesystem create mypool data1

Example 4. Binding a pool's devices to use an NBDE policy for decryption

stratis pool bind nbde --trust-url mypool someTangServerUrl

👀 SEE ALSO 👀

mount(8), umount(8), fstab(5)

🐛 REPORTING BUGS & DEVELOPMENT 🐛

GitHub for issues and development — https://github.com/stratis-storage/project/issues
Mailing list — stratis-devel@lists.fedorahosted.org for general development discussion
Unknown values — if the stratisd D-Bus API returns values that stratis-cli cannot interpret, stratis-cli will substitute "???". if encountered, upgrading to the latest version of stratis-cli, or filing an issue, is recommended.
Unobtainable values — if the stratisd D-Bus API indicates that a value is unobtainable, stratis-cli will substitute "FAILURE". this may indicate something wrong with the pool, blockdev, or filesystem. in some cases, restarting stratisd may resolve the issue.

📜 LICENSE 📜

stratis-cli is licensed under the Apache License, Version 2.0. software distributed under this license is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either expressed or implied.

and that's the whole page, bestie!! 🫶 this was stratis-cli version 3.x territory, dated 07/17/2026, and it lives in the STRATIS(8) section of your manual. go forth and pool responsibly ✨💖

📦 where this page comes from

fedora 43: stratis-cli 3.9.1-1.fc43 · Apache-2.0
fedora 44: stratis-cli 3.9.1-1.fc44 · Apache-2.0
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on 2026-10-18: a language model's rewrite of the original, under its terms

STRATIS(8)

STRATIS(8) 💖

🌸 NAME 🌸

🦋 SYNOPSIS 🦋

💖 DESCRIPTION 💖

✨ GLOBAL OPTIONS ✨

🌈 COMMANDS 🌈

pool create

pool stop

pool start

pool list

pool rename

pool destroy

pool add-data

pool init-cache

pool add-cache

pool extend-data

pool bind

pool bind tpm2

pool bind keyring

pool rebind clevis

pool rebind keyring

pool unbind

pool encryption on

pool encryption off

pool encryption reencrypt

pool encryption bind

pool encryption bind tpm2

pool encryption bind keyring

pool encryption rebind clevis

pool encryption rebind keyring

pool encryption unbind

pool set-fs-limit

pool overprovision

pool explain

pool debug get-object-path

pool debug get-metadata

filesystem create

filesystem snapshot

💖 filesystem list [pool_name]

🗑️ filesystem destroy <pool_name> <fs_name> [<fs_name>..]

✏️ filesystem rename <pool_name> <fs_name> <new_name>

📏 filesystem set-size-limit <pool_name> <fs_name> <size_limit>

🚫 filesystem unset-size-limit <pool_name> <fs_name>

⏪ filesystem schedule-revert <pool_name> <snapshot_name>

🙅 filesystem cancel-revert <pool_name> <snapshot_name>

🔍 filesystem debug get-object-path <(--uuid <uuid> |--name <name>)>

🕵️ filesystem debug get-metadata <pool_name> [--pretty] [--written] [--fs-name <fs-name>]

🧱 blockdev list [pool_name]

🔎 blockdev debug get-object-path <(--uuid <uuid>)>

🔑 key list

🔐 key set <(--keyfile-path <path> | --capture-key)> <key_desc>

♻️ key reset <(--keyfile-path <path> | --capture-key)> <key_desc>

🚮 key unset <key_desc>

📊 report <report_name> [--no-sort-keys]

🏷️ daemon version

🛠️ debug refresh