See also my closely-related answer here, where I expand a LUKS-encrypted partition (which is easier) instead of shrinking it: How to clone your hard drive (SSD or HDD) and expand your LUKS-encrypted partition to fill the new full disk space.
How to shrink an encrypted LUKS partition
...by installing blivet-gui on an Ubuntu live USB and then using blivet-gui, Gnome Disks, and GParted (all 3 are required together).
Tested on:
- An Ubuntu 22.04 live USB which was used to run these 3 GUIs to unlock a LUKS-encrypted outer partition, shrink and edit an Ubuntu 20.04 LVM volume within it, and then shrink the outer LUKS partition.
- An Ubuntu 22.04 system where I shrunk a LUKS-encrypted partition on an external SSD drive.
1. Install blivet-gui
I was just now able to follow @rugk's instructions, except while running the Blivet GUI from an Ubuntu 22.04 live USB (created with Balena Etcher) instead of using a Fedora live USB.
To install blivet-gui into my Ubuntu 22.04 live USB, I tried to follow blivet-gui's own installation instructions here, which are these. Note: the instructions here worked on an actual Ubuntu system, but failed on my Ubuntu live USB installation disk. For the live USB, my customized instructions I posted farther below worked.
# Ubuntu 22.04
echo 'deb http://download.opensuse.org/repositories/home:/vtrefny/xUbuntu_22.04/ /' | sudo tee /etc/apt/sources.list.d/home:vtrefny.list
curl -fsSL https://download.opensuse.org/repositories/home:vtrefny/xUbuntu_22.04/Release.key | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/home_vtrefny.gpg > /dev/null
sudo apt update
sudo apt install blivet-gui
Ubuntu 20.04
echo 'deb http://download.opensuse.org/repositories/home:/vtrefny/xUbuntu_20.04/ /' | sudo tee /etc/apt/sources.list.d/home:vtrefny.list
curl -fsSL https://download.opensuse.org/repositories/home:vtrefny/xUbuntu_20.04/Release.key | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/home_vtrefny.gpg > /dev/null
sudo apt update
sudo apt install blivet-gui
etc.
Although the 2nd set of instructions above work perfectly on my main Ubuntu 20.04 machine (I tested this too), they do not work equally well on the more-limited live USB environment.
So, what worked for me on the Ubuntu 22.04 live USB ended up looking more like this:
sudo apt update
sudo add-apt-repository universe
sudo apt --fix-broken install
sudo apt update
optional, if you want to try the other answer here recommending this tool too
sudo apt install partitionmanager
sudo apt install curl
Ubuntu 22.04
echo 'deb http://download.opensuse.org/repositories/home:/vtrefny/xUbuntu_22.04/ /' | sudo tee /etc/apt/sources.list.d/home:vtrefny.list
curl -fsSL https://download.opensuse.org/repositories/home:vtrefny/xUbuntu_22.04/Release.key | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/home_vtrefny.gpg > /dev/null
sudo apt update
sudo apt install blivet-gui
I just tried it again, and that worked. If that isn't sufficient for your case, however, throw in a couple more scattered sudo apt --fix-broken install and sudo apt update commands, then try sudo apt install blivet-gui again too. You can also try following the comment by @mixalbl4 below this answer.
2. Unlock and shrink the LUKS partition
Unlock a LUKS-encrypted outer partition, shrink and edit the LVM volume(s) within it, and then shrink the outer LUKS partition using a combination of 3 GUIs: Gnome "Disks", "blivet-gui", and "GParted".
Usages:
- You must use Gnome "Disks" to unlock the outer LUKS-encrypted partition. Although both
blivet-gui and GParted also have features to unlock LUKS-encrypted partitions, they won't work properly to allow blivet-gui to then edit and shrink the inner LVM volumes. Only unlocking via Gnome "Disks" will work for that. So, follow my instructions below.
- You must use
blivet-gui to shrink the inner LVM volume(s) and edit or delete any other inner volumes inside the outer LUKS-encrypted partition. blivet-gui is the only one of these 3 GUIs that can edit the inner volumes once the outer LUKS-encrypted partition is unlocked via "Disks".
- To shrink the outer LUKS-encrypted partition afterwards, you must use GParted. It's the only one of the 3 that can do that.
- Also, only GParted can fully close and re-lock the outer LUKS-encrypted partition. For me to write this tutorial and test my instructions repeatedly, I had to use only GParted to close and re-lock the outer LUKS-encrypted partition (via right-click menus on it). Although I unlocked it with Disks, only GParted could properly re-lock and re-close the outer LUKS-encrypted partition. Weird, but that's what I saw, repeatedly.
Instructions:
Use Disks to unlock the outer LUKS-encrypted partition: press the Windows key and type in "disks" to open up the gnome-disks GUI tool. Click on your drive of interest containing the LUKS-encrypted partition, then find the locked LUKS-encrypted partition. This is what I'm calling the "outer partition", since it contains protected inner LVM volumes. Click the unlock icon (it looks like an unlocked padlock) and enter your encryption password to unlock the partition. It will take several seconds to complete unlocking. You'll see the unlocked inner "LVM2 PV" volumes now show up in the Disks GUI underneath that outer "LUKS" partition. Reminder: only the Disks tool can properly unlock the partition to work with the next step. Don't unlock it with blivet-gui nor GParted, or else blivet-gui will throw an error in the next step.
Use blivet-gui to shrink and edit the inner LVM volume(s) within the outer LUKS-encrypted partition: press the Windows key and type in "blivet" to open the blivet-gui tool. Note: the blivet-gui should NOT already be open! You must do the unlock step above in "Disks" before opening blivet-gui. Under the bold "LVM" label, I have a 951.94 GiB partition which is my protected LVM volume (inside the outer LUKS-encrypted partition) which I want to shrink. Under the "Logical View" tab, right-click the volume you want then go to --> Edit --> Resize --> drag the slider to the left to resize to your desired size. Here's what that looks like for an LVM volume of 80 GiB being resized to 57.3 GiB:
Note: in my original case, I shrunk a 951.94 GiB LVM volume down to 80 GiB.
Click "Resize" when done.
Do any other editing of inner LVM volumes via blivet-gui at this time. You may add, delete, resize, etc, LVM volumes as you see fit.
Disks is still open at this time. You can leave blivet-gui open too.
Use GParted to shrink the outer LUKS-encrypted partition: press the Windows key and type in "gparted" to open up the GParted partition editor GUI tool. It looks like this. You can see that my outer 951.94 GiB LUKS-encrypted partition is unlocked (previously by the Disks tool) because its label shows "lvm2 pv", and because it shows the usage (the yellow portion near the left of the graphical view of it shows "space used"--which is actually just the 80 GiB inner LVM volume in this case--even if not all of that space is truly "used", and the white portion to the right is empty space freed from where I just shrunk the inner LVM volume above).
Next, in GParted, right-click it and go to --> Resize/Move --> drag the right side of the bar all the way to the left, as shown here. This shrinks the outer LUKS-encrypted partition down to the size of the inner LVM volume. My inner LVM volume is actually exactly 80 x 1024 = 81920 MiB, but for whatever reason, I could only shrink the LUKS container down to 81940 MiB:
Click "Resize" when done, then click the green check-mark at the top of GParted to apply the change on-disk. A few minutes later, and "boom, done!" Here's the final, most-beautiful result! You can see that the LUKS-encrypted outer partition containing the currently-unlocked LVM2 PV inner volume is now 80.02 GiB, with 871.92 GiB to the right of that totally free!:
To close and re-lock the partition, inside GParted, right-click the encrypted partition and go to --> Deactivate, then right-click it again and go to --> Close Encryption. It now looks like this, showing just the label "[Encrypted]", rather than also indicating that it contains an "lvm2 pv system" volume inside of it:
You can now close GParted, blivet-gui, and Disks. As you can see, all 3 of those GUIs were required to unlock an outer LUKS-encrypted partition, shrink and edit its inner LVM volumes, and then shrink the outer LUKS-encrypted partition, in that order.
That new space can now be used for installing a new LUKS-encrypted Linux operating system, for instance, while keeping the old LUKS-encrypted Linux operating still intact, for a dual-boot system with two Linux operating systems
Update 1:
I don't know how to make the dual-boot system work when both systems are LUKS-encrypted; after my new install, the old Ubuntu 20.04 OS I shrunk down to 80 GiB above is not in the grub menu, and I don't know why, nor how to fix it yet. Here are my follow-up questions on that:
- Unix & Linux: How to get a dual boot (2 Linux OSs) system working when both are LUKS-encrypted
- Ask Ubuntu: How to get old LUKS-encrypted Ubuntu version back into Grub menu after installing new Ubuntu version in new LUKS partition
I think maybe next time I should try shrinking only the LVM volume within the outer LUKS partition, but not shrink the outer LUKS partition itself. Then, instead of creating a new LUKS partition, try installing the new version of Linux Ubuntu next to the old version inside a new LVM volume within the same LUKS partition as the original version of Ubuntu. Maybe that would work???
Update 2:
I got it! I got the Grub boot menu updated to include my old LUKS-encrypted operating system, as well as the new one. See my answers at either of the two links just above, here and here.
Update 3:
Next time I install the new OS, try using the same /boot partition as the old OS, instead of making a new, separate /boot partition. I think using a single, shared /boot partition will avoid having to do the "dirty hack" I explain near the end of my answer here (search that answer for "dirty hack")!
See also
- [my answer] Use blivet-gui, instead of gparted or Gnome Disks, to see what is inside of LUKS-encrypted LVM volumes/partitions
