Encrypted, Nested Datasets with Syncoid

OpenZFS Sanoid
1

Looking to ensure I’ve done this all properly.

I have these datasets using native ZFS encryption:

tank/rootData
tank/rootData/child1
tank/rootData/child2
tank/rootData/child3

For some non-nested dataset, I would use syncoid to replicate to a different pool like this:

syncoid -r --sendoptions="wp" tank/otherStuff backup/otherStuff

The w option doing a raw send to preserve encryption, and the p option to preserve dataset properties on the target.

When I try this same approach with nested datasets, I ran into two issues.

  1. Syncoid would give errors when trying to send to another pool using a command like the above. The sync snapshot would differ across the child datasets, causing issues (I think?).
  2. The encryptionroot would be incorrect on the target dataset backup/rootData/child1, backup/rootData/child2, backup/rootData/child3.

Based on what I learned from this GitHub issue for sanoid/syncoid, I ended up with this sanoid config:

sanoid.conf snippet:

[tank/rootData]
  recursive = zfs
  use_template = myProd

The recursive = zfs bit is to ensure the snapshots taken by sanoid are atomic (I think?) across all the parent and child datasets. And I end up with snapshots looking like this:

# zfs get -r -t snap tank/RootData
tank/rootData@autosnap_2024-10-12_22:00:11_hourly
tank/rootData@autosnap_2024-10-12_23:00:11_hourly
...
tank/rootData/child1@autosnap_2024-10-12_22:00:11_hourly
tank/rootData/child1@autosnap_2024-10-12_23:00:11_hourly
...
tank/rootData/child2@autosnap_2024-10-12_22:00:11_hourly
tank/rootData/child2@autosnap_2024-10-12_23:00:11_hourly
...
tank/rootData/child3@autosnap_2024-10-12_22:00:11_hourly
tank/rootData/child3@autosnap_2024-10-12_23:00:11_hourly
...

Every snapshot across parent and child happens at the same time, not milli-seconds apart.

Then, I can run syncoid like this:

syncoid --sendoptions="Rwp" --no-sync-snap tank/rootData backup/rootData

Removing the syncoid recursion flag -r and instead relying on ZFS with --sendoptions=R to transfer tank/rootData and all its child datasets to the target. I think (?) I need the --no-sync-snap option because the sync snaps taken by sanoid are not atomic and the zfs send/recv seems to toss off errors if I don’t do this.

My goals with this are:

  1. Syncoid should replicate the parent and child datasets to a backup target.
  2. Preserve the encryptionroot and other properties on the target pool/dataset.

Am I making any mistakes? Is there a better approach to sending encrypted, nested datasets between pools?

Thanks!