How to securely decommission a LXD deployment

Important

This process will erase all data associated with your LXD deployment. Make copies of any data that you need to preserve before proceeding. Refer to How to back up instances and How to back up custom storage volumes for relevant details.

This guide walks you through the steps to decommission a LXD cluster. You can also follow this guide to decommission a standalone server, though the steps regarding cluster members will not apply in such cases.

If you only need to decommission a single member of a cluster, first remove that member from the cluster. After removing the member, update the certificate on the cluster remaining in production. Then, return to this guide, skip ahead to Remove the LXD snap, and follow the instructions in the sections that follow.

Unless otherwise noted, you can run the commands in this guide on any online cluster member.

Remove offline cluster members

Run this command with the --force flag to remove any offline cluster members (you will remove online cluster members later in the process):

lxc cluster remove --force <offline_member_name>

Revoke remote access

List all identities that have access to LXD, then delete each one:

lxc auth identity list
lxc auth identity delete <authentication_method>/<name_or_identifier>

To decommission a deployment configured for single sign-on with OIDC, remove the corresponding profile from your OIDC identity provider.

List projects

Replicators, instances, profiles, custom volumes, and buckets are scoped by project. By default, LXD commands only affect project-scoped entities on the currently active project; you can specify a different project by using the --project flag.

If your deployment has more than one project, this means that you must repeat project-scoped commands with the --project flag to delete entities across projects. Note that you do not need to use the --project flag to delete entities on the currently active project (for example, default).

Run this command to get a list of all projects:

lxc project list

Note

You can also delete a project (except the default project) and all of its project-level entities with:

lxc project delete <project_name> --force

Delete data

Important

Data deleted by LXD physically remains on disks and can be recovered by users with access to the disks. To prevent unauthorized data recovery, you must destroy and sanitize your data.

Stop and delete instances

For each project, stop all instances:

lxc stop --all --project <project_name>

Next, for each project, list all instances, then delete each one:

lxc list --project <project_name>
lxc delete <instance_name> --project <project_name>

If you are unable to stop or delete an instance, use the --force flag:

lxc stop --force <instance_name> --project <project_name>
lxc delete --force <instance_name> --project <project_name>

Delete profiles

For each project, list all profiles:

lxc profile list --project <project_name>

Each project has a default profile that cannot be deleted. Delete all other profiles:

lxc profile delete <profile_name> --project <project_name>

Remove disk devices from default profiles

You cannot delete a storage pool used by an instance, profile, or custom volume. You must, therefore, remove any disk devices used by default profiles in order to delete any storage pools or custom volumes referenced by those devices.

For example, if you configured a new storage pool during the interactive initialization process with lxd init, then the default profile of the default project will have a disk device named root that references a storage pool.

Remove this device with:

lxc profile device remove default root --project default

To check for additional disk devices, view information about the default profile of each project:

lxc profile show default --project <project_name>

Remove any remaining disk devices that reference storage pools:

lxc profile device remove default <device_name> --project <project_name>

Delete custom volumes and buckets

You must specify storage pools to delete custom volumes or buckets. First, list all storage pools across projects:

lxc storage list

Next, list the custom volumes on each storage pool. Use the --all-projects flag to view all custom volumes across projects:

lxc storage volume list <pool_name> type=custom --all-projects

Then, for Ceph Object pools only, list all buckets:

lxc storage bucket list <pool_name> --all-projects

Use the PROJECT column in the output to identify the project associated with each custom volume or bucket.

Finally, delete all custom volumes and buckets, specifying both the storage pool and the project:

lxc storage volume delete <pool_name> <volume_name> --project <project_name>
lxc storage bucket delete <pool_name> <bucket_name> --project <project_name>

Delete storage pools

List all storage pools, then delete each one (storage pools are not scoped by project, so you do not need to use the --project flag):

lxc storage list
lxc storage delete <pool_name>

Delete monitoring data

Delete data from any external systems that you used to monitor events or monitor metrics, such as Loki, Prometheus, or Grafana. Refer to the documentation for those systems for details.

Remove remaining cluster members

After deleting data, you can remove the online cluster members from the cluster. List all cluster members, then remove each one:

lxc cluster list
lxc cluster remove <member_name>

Remove the LXD snap

Important

Run these commands on every machine that you decommission.

Removing LXD does not erase dedicated disks/partitions, ZFS pools (zpools), LVM volume groups, or remote storage. To securely decommission LXD, you must destroy and sanitize your data.

Remove the LXD snap. Use the --purge flag, or a snapshot of your data will be preserved:

sudo snap remove lxd --purge

Verify that the snap and associated data were removed. The following commands should report that LXD is not installed and that the /var/snap/lxd/ directory does not exist:

snap list lxd
ls /var/snap/lxd/

Note

If you followed a different method to install LXD, use your package manager to remove LXD. Then, delete the data in /var/lib/lxd/.

Destroy and sanitize data

Data deleted by LXD remains readable and can be recovered by users with access to disks used in your deployment. To prevent unauthorized recovery, you must physically overwrite the data.

Follow your data destruction policy to securely erase and destroy disks used by LXD, as well as disks on machines used to monitor LXD events or metrics. Consult storage providers for details about how to securely sanitize data on remote storage. For deployments configured for single sign-on with OIDC, consult your OIDC identity provider for the steps to remove any associated data. Likewise, if you used ACME services to issue server certificates, refer to the service provider for the steps to remove any associated data.

Important

Sanitized data is irreversibly destroyed and cannot be recovered.