Kirsle.net
In 2024, after I accidentally spilled a whole cup of coffee over my old Dell XPS laptop, I was suddenly in the market for a new computer and I picked up a 13" Apple Macbook Air M3. It was my first Apple computer in a very long time (before that I had an old Intel Macbook Air from ca. 2013), and having a macOS computer enabled me to finally debug and fix WebRTC errors in my chat room, but I was also greatly looking forward to Asahi Linux adding support for Apple Silicon M3 computers so that I could eventually install Linux onto this device some day.
At the time, Asahi Linux had support for M1 and M2 Apple Silicon devices so I thought it'd be maybe a year or so until M3 was supported. It took a little while longer than that, but as of this month they have released M3 support and I went ahead and installed it. It was quite easy to set up with their automated installation script.
There seem to be just a couple of issues they are still working out, which they mention in that blog post but briefly they are:
The most pressing matter for me, though, is that the Asahi Linux installer (still) doesn't provide an option for full-disk encryption with LUKS. I consider disk encryption to be an absolute must-have especially for small, portable, easily stolen devices such as a laptop. This poor guy on Hacker News learned this the hard way when his Macbook Pro running Asahi Linux was stolen, and without the disk encryption, the thief got his files and decided to blackmail him for profit.
While they have an open feature request to add LUKS setup to the installer, in the meantime it is possible to encrypt Asahi Linux separately, if a little involved.
Here is what worked for me in Sept. 2026.
I'll link to the tools and guides that worked for me here.
AsahiLocker provides a robust script to add encryption to an existing Asahi Linux installation.
The catch is that you can't encrypt a live, running Linux install, so you need to run this script either from a bootable Live USB (which I had trouble getting to work), or from a secondary Asahi Linux install on the same computer.
AsahiLocker is the script I used and it worked for me. I also saw osxtools/asahi-encrypt which looks to do a similar job, and this blog post about Fedora Asahi Remix with LUKS Encryption was linked to everywhere and provides some insight into how to do this a little more manually.
For creating a bootable USB drive, asahi-fedora-usb might work. I was able to provision a USB stick with things installed on it, but for my Macbook Air M3, I could not actually boot from USB, but you may have better luck.
It is fortunate that you can simply add LUKS encryption to an already-installed instance of Asahi Linux, but you can't do that encryption while inside the live running OS - you need to either boot from an external USB drive or from a 'sibling' install of Asahi Linux elsewhere on the same internal drive.
The USB option sounded the cleanest to me, but unfortunately I couldn't get it to work.
According to Asahi's documentation, Apple Silicon devices generally do not boot from USB, at all.
It seems that Asahi Linux though can provide its own work-around, in their own bootloader, where basically after you have Asahi installed, the U-Boot loader may be able to redirect and boot a USB drive instead of the installed Linux system.
My USB drive was a 16GB Sandisk Cruzer, and it took some finagling with the asahi-fedora-usb script, but I eventually got the drive partitioned and filled with a minimal Fedora chroot.
But I wasn't able to boot from it: at the U-Boot shell, I noticed that the USB drive wasn't given any power (its LED didn't light up), and it only powered on after Fedora began to boot, but not before so I couldn't have U-Boot launch from the USB drive.
The approach that worked for me instead was to set up a second, minimal Asahi Linux installation directly on my Macbook, which I could do by running the same install command from AsahiLinux.org that I used the first time to install my main Fedora (AsahiLinux) desktop.
When I installed my main Asahi Linux originally:
To install the secondary Asahi Linux then:
So my partitions were roughly:
Then I booted into my new AsahiRecovery installation to download and run AsahiLocker.
Note: the minimal install drops you at a text terminal, with some setup prompts initially, to set a root password at least if not also create a user account. I opted to set a root password. And then you'll probably need to connect to WiFi, which you can do with NetworkManager CLI commands like:
nmcli device to see devices and status.nmcli device wifi connect [SSID] password [your_password] to connect to a WiFi network you know.This worked for me, and I was able to dnf install git to git clone AsahiLocker and run it. nmtui may be a way to visually browse and select a WiFi network but I didn't test it.
AsahiLocker seems to prefer/assume that you are running it from a Live USB and not a secondary AsahiRecovery installation like I had set up. It made me type the word 'LIVE' to confirm that I want to proceed despite not running from a Live USB, and when it listed the various disk partitions on my Macbook, it wanted to default to the AsahiRecovery partitions (the ones I was currently booted from!)
You need to be careful not to select those. I wanted to encrypt my Fedora (256 GB) partition, not the AsahiRecovery 20GB one that I was currently booted into. So you would want to carefully pay attention to what the script is printing out and be sure to select the intended Linux root and boot partitions.
Besides that, the script worked well and I booted back into my main Fedora system to verify that it gave me the LUKS password prompt at boot to decrypt the disk and it all worked OK.
Note: on an Apple M3 computer (likely others), to boot an operating system that isn't the current default, you just hold the Power key for several seconds as you turn on the computer. An on-screen text says to keep holding Power to enter startup options and then it will enter startup options. Since my 20GB AsahiRecovery OS was the most recently installed, it was the default boot target, so I had to do this to boot back into Fedora or MacOS.
After everything was verified working, I wanted to clean up my temporary 20GB AsahiRecovery installation and reclaim its disk space for MacOS, and to do this I booted back into MacOS (by holding the Power key on startup to select it from the Startup Options screen).
First, be sure to go into your System Settings -> General -> Startup Disk and change the default to Fedora (or whatever you want - not AsahiRecovery since we're going to delete it soon!)
See the Partitioning Cheat Sheet page from Asahi Linux's documentation.
I used the diskutil command-line on Mac OS, as is recommended -- the graphical Disk Utility program on MacOS is apparently very fragile and should generally never be used, as anything outside of the most basic standard default layout on a Macbook can cause problems, per the documentation linked above.
I used the Asahi Linux installer to just list the existing partitions, as well as diskutil list to cross check and verify what's in every partition before I got started.
Do not blindly use these disk IDs below, they will very likely be different for you. Apparently MacOS can re-number the disks and virtual partitions on a whim every time, so always use diskutil list and closely inspect the disk IDs for your system!
For me, the commands to remove my AsahiRecovery install looked like:
diskutil apfs deleteContainer disk3 to delete an APFS Container that I saw on diskutil list (it was listed like "/dev/disk3 (synthesized)") and had APFS Volumes with labels like AsahiRecovery below it so I knew which disk it was).diskutil eraseVolume free free disk0s4 to delete the EFI, Boot and Root partitions for the AsahiRecovery install. (I re-ran the command 3 times, substituting the final parameter disk0s4 with disk0s5 and disk0s6 for the other two partitions).
These partitions were listed on diskutil list near the top, labeled under /dev/disk0 (internal, physical)
Finally, diskutil apfs resizeContainer disk0s2 0 to resize the MacOS container to fill back in the 20GB of free space.
The name disk0s2 was listed at the top of diskutil list labeled like "Apple_APFS Container disk4" with the ~246 GB capacity I expected. The final parameter 0 has it grow to fill the remaining free space between it and my Fedora container.
The good news also is: removing these partitions automatically removed the AsahiRecovery boot target from the Startup Options list. On my old Intel Mac from 2013, after (re)installing Linux a few times (Fedora's and Debian's), oftentimes the Startup Disks list would become cluttered with old obsolete entries for installations that no longer exist, but it seems with the way Apple Silicon devices boot, those were automatically cleaned up along with removing the APFS container and partititons.
Even if you're not into Linux, the Asahi Linux project also documents what they found from reverse engineering the Apple Silicon architecture, and these devices are really quite neat under the hood!
ARM devices, in general, are very different from traditional Intel-compatible computers that I grew up with. There is nothing like a BIOS or UEFI firmware, with automatic hardware detection or the ability to just boot arbitrary operating systems from USB devices. All ARM devices require specialized methods to install an operating system, where the OS needs to bring its Device Tree with it (all of the drivers and the pre-advance knowledge of where, physically, all of the hardware is connected at -- there is no auto-discovery of onboard peripherals on any ARM device).
I've played with various ARM devices over the years, from Raspberry Pi computers to the Pine64 Pinephone. Most ARM devices more or less work in similar ways, but Apple Silicon devices do a lot of things in a much more custom way.
My favorite documentation from the Asahi project is the Apple Silicon Platform Security which goes into depth on the way that disks, partitions, APFS Volumes, and the Secure Enclave Processor (SEP) all work together.
The basic idea is, Apple left open the possibility to install a non-Apple operating system (probably to get ahead of possible antitrust lawsuits they would face if they didn't leave the possibility open), and then knowing that projects like Asahi would come about, Apple wanted to be sure that even if you do install a secondary OS, they want MacOS to maintain its same security guarantees and to be no less safe than a stock device would be for having you mess with it like this.
For example, on most traditional PCs, when you dual boot Linux with Windows, it's fairly common that you will go and disable Secure Boot in order to get things like nVIDIA proprietary graphics drivers to install under Linux. Some mainstream Linux distributions such as Fedora can run with Secure Boot enabled, thanks to Microsoft signing a 'shim bootloader' with their keys, but if you need any third-party kernel drivers such as nVIDIA proprietary ones, Secure Boot won't allow the kernel to load that unsigned code, so people end up turning off Secure Boot altogether, which weakens the security of Microsoft Windows at the same time.
I found it quite fascinating to read about the underlying architecture of these devices. There is in-depth reverse engineered knowledge about all kinds of Apple Silicon subsystems that have been gathered by the Asahi Linux developers, so check it out if curious!
I consider full-disk encryption to be absolutely necessary on portable devices such as laptops which can be easily stolen, so that the thief doesn't immediately gain access to all of your personal files and credentials (SSH keys, passwords saved in your web browser, logged-in website sessions, etc.)
Asahi Linux doesn't (yet) offer during their installer to set up LUKS disk encryption, but it is possible to install Asahi Linux as normal first and then encrypt its disk in-place without losing your apps and files that were installed in the mean time. (Though, as always, back up anything important before you go messing with this kind of low-level stuff so you don't lose your files in case it all goes wrong!)
Booting from USB may be quite difficult on an Apple Silicon computer, but a secondary Asahi Linux install is easy enough to add (and only slightly less easy to remove afterward).
Once it's all set up, everything works as expected: Fedora prompts for the LUKS encryption password on boot, etc.
There are 0 comments on this page. Add yours.
0.0065s.
