How to shrink encrypted root filesystem under LVM with USB Stick on Linux Mint 19 (Ubuntu 18.04)

Prerequisites

Download Linux Mint Image from here: https://linuxmint.com/download.php

Plug-In your USB Stick to your maschine. Click with right mouse on the Image and choice Make bootable USB stick.

After rebooted your maschine and booted with Linux Mint 19.3, please open a terminal.

Identify encrypted device

Identify encrypted device - /dev/nvme0n1 partition in this example.

$ lsblk -f /dev/nvme0n1
NAME                  FSTYPE      LABEL UUID                                   MOUNTPOINT
nvme0n1                                                                        
├─nvme0n1p1           vfat              D1EC-CB38                              /boot/efi
├─nvme0n1p2           ext4              6706d5ab-ded4-4a99-a17a-39db1aa75761   /boot
└─nvme0n1p3           crypto_LUKS       12a034f9-1a0a-4e4e-97e2-2731620534b9   
  └─nvme0n1p3_crypt   LVM2_member       jxFZEZ-nZ0o-tSG1-wkfQ-ZBmw-gpcu-xWbGie 
    ├─mint--vg-root   ext4              7e3fc579-a6e4-49c2-bc69-d5f66cca45c4   /
    └─mint--vg-swap_1 swap              4115a08a-bf78-4415-9209-36deadd7ed3b   [SWAP]

Open LUKS device

Open encrypted /dev/nvme0n1p3 device and set up encrypted_device mapping.

$ cryptsetup luksOpen /dev/nvme0n1p3 encrypted_device
Enter passphrase for /dev/nvme0n1p3: ****************

Identify volume group

Identify volume group - mint-vg in this example.

$ vgs
  VG      #PV #LV #SN Attr   VSize    VFree 
  mint-vg   1   2   0 wz--n- <475,72g <1,72g

List logical volumes

List logical volumes on identified mint-vg volume group.

$ lvs
  LV     VG      Attr       LSize   Pool Origin Data%  Meta%  Move Log Cpy%Sync Convert
  root   mint-vg -wi-ao---- 410,00g                                                    
  swap_1 mint-vg -wi-ao----  64,00g

Activate logical volumes

Activate volume group.

$ lvchange -ay mint-vg

Shrink encrypted file system

Attach the encrypted file system for testing

$ mkdir /media/mint--vg-root & mount /dev/mapper/mint--vg-root /media/mint--vg-root

$ ls -la /media/mint--vg-root
  total 108
drwxr-xr-x  24 root root  4096 Feb 14 19:58 .
drwxr-xr-x  24 root root  4096 Feb 14 19:58 ..
drwxr-xr-x   2 root root  4096 Feb 14 19:58 bin
drwxr-xr-x   5 root root  4096 Feb 13 10:52 boot
drwxr-xr-x   2 root root  4096 Feb  6 10:34 cdrom
drwx------   3 root root  4096 Feb 12 11:47 .config
drwxr-xr-x  21 root root  4700 Feb 14 20:39 dev
drwxr-xr-x 172 root root 12288 Feb 14 20:35 etc
drwxr-xr-x   3 root root  4096 Feb  6 10:34 home
lrwxrwxrwx   1 root root    33 Feb 13 10:51 initrd.img -> boot/initrd.img-4.15.0-43-generic
lrwxrwxrwx   1 root root    32 Feb 13 10:51 initrd.img.old -> boot/initrd.img-5.3.0-26-generic
drwxr-xr-x  25 root root  4096 Feb 12 13:20 lib
drwxr-xr-x   2 root root  4096 Feb 12 13:20 lib64
drwx------   2 root root 16384 Feb  6 10:32 lost+found
drwxr-xr-x   3 root root  4096 Feb 14 19:58 media
drwxr-xr-x   2 root root  4096 Dec 13 17:12 mnt
drwxr-xr-x   5 root root  4096 Feb 12 15:27 opt
dr-xr-xr-x 341 root root     0 Feb 14 20:39 proc
drwx------  11 root root  4096 Feb 14 20:35 root
drwxr-xr-x  37 root root  1180 Feb 14 20:39 run
drwxr-xr-x   2 root root 12288 Feb 12 14:21 sbin
drwxr-xr-x   2 root root  4096 Dec 13 17:12 srv
dr-xr-xr-x  13 root root     0 Feb 14 20:39 sys
drwxrwxrwt  15 root root  4096 Feb 14 20:50 tmp
drwxr-xr-x  11 root root  4096 Dec 13 17:11 usr
drwxr-xr-x  12 root root  4096 Feb 12 11:41 var
lrwxrwxrwx   1 root root    30 Feb 13 10:51 vmlinuz -> boot/vmlinuz-4.15.0-43-generic
lrwxrwxrwx   1 root root    29 Feb 13 10:51 vmlinuz.old -> boot/vmlinuz-5.3.0-26-generic

Umount the encrypted file system.

$ umount /media/mint--vg-root 

Shrinking both logical volumes and filesystem

$ lvreduce --resizefs --size -410G /dev/mapper/mint--vg-root 

Deactivate active volume group.

$ lvchange -an mint-vg

Close LUKS device

Remove the encrypted_device mapping

$ cryptsetup luksClose encrypted_device

Now you can reboot your maschine as normal.