Do you inherit encryption or create datasets as their own encryption root?

OpenZFS
1

I’ve been mostly using inherited encryption but over the years have run into issue and annoyances when using something like raw-send syncoid because of the nature of having dataset with an encryption root that’s not itself. (E.g. sometimes you can’t send a dataset or you can also not rename/move it outside the encryption root, that kind of stuff).

I was wondering if other people have had similar issues and for example decided that they set the encryption for every dataset individually. Or maybe you actively decided to use inheritance because it solves other issues. I’m just curious and would like to learn how you guys engage with inheritance and encryption.

2

I haven’t had any issues with inheritance personally.

3

Mostly for the reasons you specify, it can be useful to have a separate encryption root for each kind of “group” of datasets that you will treat differently.

If you are only going to replicate a subset, it might be useful for that set to a self contained encryption root, rather than depending on a parent that won’t get replicated.

Obviously, you also want a different encryption root if you want a different passphrase etc.