Security-misc Advanced Documentation Debian Packages Previous page: Security-misc Index page: Advanced Documentation Next page: Debian Packages swap-file-creator

Creates a swap file on LUKS-encrypted systems. Useful for systems with low RAM, such as virtual machines.

Introduction

swap-file-creator adds a swap file on a LUKS-encrypted disk to the system. On every boot, it creates a new swapfile if the disk is LUKS-encrypted.

No swapfile will be created by default on unencrypted disks.

Optional: Create a swap file on an unencrypted disk.

This is useful for systems with low RAM such as those inside virtual machines. It prevents common cases of freezing of VMs with low RAM during upgrades. ^[1]

It has an ENOUGH_RAM setting which defaults to 1950 MB. If there is more than enough RAM, it will not advise to increase RAM. (This setting only controls whether a low-RAM warning is shown; it does not disable swap creation.)

An optional option exists to shred the swapfile on shutdown but this is slow. ^[2]

Earlier versions created an encrypted swap file with an ephemeral key using dm-crypt. Due to a Linux kernel bug, this is no longer supported in Debian trixie and later; current versions instead create a regular swap file on top of LUKS full-disk encryption.

https://lore.kernel.org/lkml/20251111231835.1232ad8f@kf-m2g5/T/#u

For further information, see: Kicksecure GitHub swap-file-creator repository

Installation

Platform dependent.

Kicksecure: Available. Installed by default. Otherwise, see footnote. ^[3]
Kicksecure-Qubes: Unsupported. Setting up swap and/or encryption of any kind is completely up to Qubes. Unspecific to Kicksecure. Opt-in available.

Configuration

The config file is located at /etc/default/swap-file-creator. Here you can change various parameters for the swapfile creation such as the path for where to create the swapfile at startup.

This might be useful in case you have a copy-on-write system like ZFS or BtrFS.

Open file /etc/default/swap-file-creator in an editor with root rights.

Select your platform.

See Open File with Root Rights for detailed instructions on why using sudoedit improves security and how to use it.

Note: Mousepad (or the chosen text editor) must be closed before running the sudoedit command.

sudoedit /etc/default/swap-file-creator

Notes:

When using Kicksecure-Qubes, this must be done inside the Template.

sudoedit /etc/default/swap-file-creator

After applying this change, shut down the Template.
All App Qubes based on the Template need to be restarted if they were already running.
This is a general procedure required for Qubes and is unspecific to Kicksecure-Qubes.

Notes:

This is just an example. Other tools could achieve the same goal.
If this example does not work for you, or if you are not using Kicksecure, please refer to Open File with Root Rights.

sudoedit /etc/default/swap-file-creator

For example, to set a custom swap file size of 1024 MB, add.

SWAP_FILE_SIZE_CUSTOM_MB=1024

Save.

Done. Settings will be applied after reboot (or when swap-file-creator is restarted).

Other configuration options include (see /etc/default/swap-file-creator for the full list):

SWAPFILE=/var/swapfile

Path where the swap file is created.

ENOUGH_RAM=1950

RAM threshold in MB after which no low-RAM advice is shown. Does not disable swap-file-creator.

DO_PRE_CHECK=yes

When yes (default), swap-file-creator only creates a swap file if the target path is on a LUKS-encrypted device. Set to no to allow creating a swap file on unencrypted disks (not recommended for privacy).

SHRED_ON_STOP=no

When set to yes, the swap file is shredded before deletion when stopping the service.

SWAPON_EXTRA=

Extra options passed to swapon.

MKSWAP_EXTRA=

Extra options passed to mkswap.

Check Swap File Size

sudo du -sh /var/swapfile

Functionality Test

To check it is working correctly, check the amount of free and used memory in the system.

free -m

Next, display the swap usage summary.

sudo swapon -s

For troubleshooting purposes, Check Daemon Log and search for unit-name: swap-file-creator.

Live Mode

swap-file-creator does not run if live mode is detected. ^[4]

Debugging

Only required in case of issues. Otherwise the user can skip this wiki chapter.

Error States

In case swap-file-creator is failing at boot time, it does not break the boot process.

For example, host kernel versions other than the one recommended on the recommended VirtualBox version wiki page are likely to break VirtualBox VMs in many ways if these are unsupported by VirtualBox. ^[5] In this case, swap-file-creator might be broken and this being the only visible error, but this still does not break the boot process. However, when using kernel versions unsupported by VirtualBox, many other things will be broken and the system will be unbootable anyhow.

Manual Swap File Creation

TODO: document

Disable

sudo systemctl stop swap-file-creator

sudo systemctl disable swap-file-creator

sudo rm -f /var/swapfile

Development

main source code file: Kicksecure GitHub swap-file-creator repository subpath
systemd unit file: Kicksecure GitHub swap-file-creator repository subpath
Kicksecure GitHub swap-file-creator repository

Footnotes

↑
Such as during Linux kernel module building (VirtualBox guest additions) as well as kernel header package upgrades.
↑ Kicksecure GitHub swap-file-creator repository subpath
↑
Install package(s) swap-file-creator following these instructions
Platform specific notice.
- Kicksecure: No special notice.
- Kicksecure-Qubes: In Template.
Update the package lists and upgrade the system.
sudo apt update && sudo apt full-upgrade
Install the swap-file-creator package(s).
Using apt command line --no-install-recommends option is in most cases optional.
sudo apt install --no-install-recommends swap-file-creator
Platform specific notice.
- Kicksecure: No special notice.
- Kicksecure-Qubes: Shut down Template and restart App Qubes based on it as per Qubes Template Modification.
Done.
The procedure of installing package(s) swap-file-creator is complete.
↑ Live mode is detected via the helper-scripts live mode detection mechanism /usr/libexec/helper-scripts/live-mode.sh, which sets a live_status_detected flag used by swap-file-creator.
↑ https://www.virtualbox.org/ticket/17055#comment:3

Security-misc Advanced Documentation Debian Packages Previous page: Security-misc Index page: Advanced Documentation Next page: Debian Packages

Kicksecure

A secure by default operating system with the latest security research in place.

Dark mode

Supported by Power Up Privacy

Kicksecure is proudly supported until 2026 by Power Up Privacy, a privacy advocacy group that seeks to supercharge privacy projects with resources so they can complete their mission of making our world a better place. (Strictly subject to our sponsorship policy.)

At Kicksecure we value freedom and trust, supporting Open Source and Freedom Software

By using this website, you acknowledge you have read, understood, and agree to be bound by these agreements: Terms of Service, Privacy Policy, Cookie Policy, E-Sign Consent, DMCA, Imprint

2012- 2025 ENCRYPTED SUPPORT LLC

Your support makes
all the difference!

We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 13 year success story and maybe DONATE!

[1] Such as during Linux kernel module building (VirtualBox guest additions) as well as kernel header package upgrades.
https://forums.whonix.org/t/swap-swap-file-whonix-gateway-freezing-during-apt-get-dist-upgrade-encrypted-swap-file-creator/8317

https://forums.whonix.org/t/whonix-xfce-for-virtualbox-users-ram-increase-required/8993

https://forums.whonix.org/t/default-ram-setting/12312

[2] ttps://forums.whonix.org/t/swap-swap-file-whonix-gateway-freezing-during-apt-get-dist-upgrade-encrypted-swap-file-creator/8317

[3] ttps://forums.whonix.org/t/whonix-xfce-for-virtualbox-users-ram-increase-required/8993

[4] ttps://forums.whonix.org/t/default-ram-setting/12312

[2] Kicksecure GitHub swap-file-creator repository subpath

[3] 

Install package(s) swap-file-creator following these instructions
Platform specific notice.

Kicksecure: No special notice.

Kicksecure-Qubes: In Template.

Update the package lists and upgrade the system.
sudo apt update && sudo apt full-upgrade
Install the swap-file-creator package(s).
Using apt command line --no-install-recommends option is in most cases optional.
sudo apt install --no-install-recommends swap-file-creator
Platform specific notice.

Kicksecure: No special notice.

Kicksecure-Qubes: Shut down Template and restart App Qubes based on it as per Qubes Template Modification.

Done.
The procedure of installing package(s) swap-file-creator is complete.

[7] Kicksecure: No special notice.

[8] Kicksecure-Qubes: In Template.

[9] Kicksecure: No special notice.

[10] Kicksecure-Qubes: Shut down Template and restart App Qubes based on it as per Qubes Template Modification.

[4] Live mode is detected via the helper-scripts live mode detection mechanism /usr/libexec/helper-scripts/live-mode.sh, which sets a live_status_detected flag used by swap-file-creator.

[5] ttps://www.virtualbox.org/ticket/17055#comment:3

[1]

[2]

[3]

[4]

[5]

swap-file-creator

Contents

Introduction

Installation

Configuration

Kicksecure

Kicksecure-Qubes

Others and Alternatives

Check Swap File Size

Functionality Test

Live Mode

Debugging

Error States

Manual Swap File Creation

Disable

Development

See Also

Footnotes

Navigation menu

swap-file-creator

Introduction

Installation

Configuration

Kicksecure

Kicksecure-Qubes

Others and Alternatives

Check Swap File Size

Functionality Test

Live Mode

Debugging

Error States

Manual Swap File Creation

Disable

Development

See Also

Footnotes

Navigation menu

Search