This page lists the encrypted-disk methods by operating system. A row is Available only when a recorded boot proof exists. Every other row is Not offered. Ordering and reinstall still follow the encrypted server disk guide, which remains Ubuntu 24.04 only.
This page is not a launch of the rows marked Not offered.
Matrix
| System | Method | State | Evidence |
|---|---|---|---|
| Ubuntu 24.04 | LUKS2 and SSH unlock | Available | Boot proof on record (October 2026). |
| Debian 13 | LUKS2 and SSH unlock | Not offered | No boot proof is on record. |
| Debian 12 | LUKS2 and SSH unlock | Not offered | No boot proof is on record. |
| Ubuntu 22.04 | LUKS2 and SSH unlock | Not offered | No boot proof is on record. |
| Ubuntu 26.04 | Dracut | Not offered | No boot proof is on record. |
| Rocky Linux 9 and AlmaLinux 9 | Clevis and Tang | Not offered | No boot proof is on record. |
| A server already enrolled | TPM2 automatic unlock | Not offered | No boot proof is on record. |
| Windows Server | BitLocker | Not offered | No boot proof is on record. |
The Available row is the published Ubuntu 24.04 encrypted-disk image. Its boot proof covers an order of "Ubuntu 24.04 (encrypted disk)" and the first boot of that server. Unlock after that boot is the SSH procedure on the encrypted server disk page. Impreza still never receives the passphrase.
TPM2 enrollment, Clevis and Tang, Dracut, and BitLocker are not ways to order a server. A PCR change or a missing TPM does not unlock a disk that was never offered.
Unlock modes
On a new server, disk encryption is chosen at purchase, on a clean install. Today the only unlock mode you can order is SSH: the default, and the one with the most privacy. TPM and TPM and PIN are described here but stay Not offered until a boot proof is on record; you cannot choose them yet. If they are offered, TPM unlock is optional and stays off unless you choose it. With TPM alone, the provider or the hypervisor can unlock the disk through the virtual TPM. With TPM and PIN, the disk also needs a PIN that you type.
Encrypting an existing disk in place is outside this launch.