zfs list tips — authorized dataset literacy

Snapshot

Tip checklist (authorized only)

1. Confirm you may run zfs list / zfs get on the lab host (syllabus box you own or were given access to; some mutations need root/CAP).
2. Prefer documenting who / why / ticket before any dataset create/destroy — never touch production pools without change control.
3. Record short factual notes; quote short Evidence (dataset name + used/avail + mountpoint — never secrets).
4. Optional: block-tree peer → lsblk-tips.
5. Optional: usage peer → df-tips.
6. Prefer disposable lab VMs and throwaway file-backed vdevs for ZFS drills; quote non-secret labels afterward as Evidence.
7. Prefer zfs list / zfs get compression,mountpoint <ds> read-back before and after changes — refuse unauthorized foreign-pool cookbooks.
8. Stop at literacy — no attack or unauthorized disk-bypass cookbooks.

Allowed framing

• Classroom labs reviewing zfs list -o name,used,avail,mountpoint on authorized disposable hosts.
• Binding short factual notes as Evidence (dataset name + used/avail + mountpoint — no secrets).
• Documenting expected vs observed dataset listings for authorized notes.
• Comparing zfs-list ↔ lsblk / df / blkid-uuid / cryptsetup peer tip pages under one binder.
• Testing syllabus-approved dataset create/destroy only when change control authorizes that drill on lab resources.

Scope we will not cover

• No crack/pirate/keygen via zfs list.
• No intentional unauthorized pool import/destroy against foreign hosts or unlicensed pools.
• No secret-theft or dataset-inventory credential harvesting against hosts you do not own.
• No cookbooks that use ZFS as an attack step against production without authorization.
• No zfs framed as a disk-encryption bypass against systems you do not own.

Beginner path (authorized only)

1. Obtain one syllabus-approved disposable lab host with OpenZFS available.
2. Prefer a throwaway lab VM and a disposable file-backed vdev before any dataset drill.
3. With authorization, run zfs list then zfs get compression,mountpoint <labds>; quote selected name/used/mountpoint labels as Evidence.
4. Optional: peer tip pages above when the syllabus asks.
5. Stop at literacy — no attack or unauthorized disk-bypass cookbooks.

Practical notes for authorized labs

• zfs list reports datasets — keep Evidence labels distinct from df-tips mount usage.
• Pair with lsblk-tips when the syllabus zooms on underlying vdev block devices.
• Prefer documenting dataset names, used/avail, and mountpoints the syllabus authorized without dumping unrelated privileged state.
• Snapshot names are useful inventory — quote them without inventing hostile rollback cookbooks against foreign pools.
• Never commit zfs dumps with secrets or proprietary pool paths to git — even for labs.

FAQ-aligned refusals (quick)

• Foreign-host / unlicensed-pool import/destroy → refuse.
• Unauthorized disk-bypass / hostile-ZFS attack cookbooks → refuse.
• Attack/credential-theft framing → refuse.

For legal, authorized and educational use only.

FAQ

Sources