The RaspberryPi CM4 module has hardware features that provide secure boot and disk encryption. Enable this features in balenaOS.

Alex Gonzalez: This is an active project - changes are being implemented in meta-balena[1] to abstract away the secure boot and disk encryption interfaces, and secure boot and disk encryption support is being worked on in a balena-raspberrypi branch [2]. [1] CM4 secure boot by alexgg · Pull Request…

Alex Gonzalez: An optimistic rough estimation for availability based on the current status is 1 more development cycle (6 weeks) to review/merge the above and one more cycle to finish automation testing.

Hello @Alex Gonzalez, I see that the above mentioned pull requests are closed. Are these features ready to be used in production? If yes which balenaOS version? If not, when is it estimated? Will an update to the relevant balenaOS version automatically include the secure boot and disk encryp…

Alex Gonzalez: Hi Marius, Most of the core work is indeed done. You can find some details about the implementation in balena-raspberrypi/docs/rpi-secure-boot.md at master · balena-os/balena-raspberrypi · GitHub . The feature is not yet production ready though. We are working on automation testing a…

Hi Alex, do you have an update on when this will be production ready? Thanks,

Hello Alex - While it seems to show partial support, is this a production supported release? Thanks

hey @TMH it’s not production ready unfortunately. Work on the feature was paused until some product concerns are ironed out.

hey @TMH , the concerns are mostly: Signed images cannot modify config.txt - this would severely limit the applicability of the images, and can either be solved by providing signing endpoints which is a security problem, or by enabling balenaCloud’s ingestion of customer signed images Increase in r…

Hello Alex, It seems things are still in the works, checking in. Would it be possible to manually sign Balena images for secure boot while it’s not fully supported in Balena cloud?

Enable secure boot and disk encryption for CM4

Feature Requests

TMH February 18, 2025, 12:02pm 9

Hello Alex -
When will those product concerns be ironed out? We’ve been awaiting this for years .

Remote OS update for a fleet of devices with secure boot

Topic		Replies	Views
Remote OS update for a fleet of devices with secure boot Product support security , raspberrypi4 , balenacloud	5	168	March 17, 2025
Surface secure boot and full disk encryption in balenaCloud Feature Requests balenacloud , balenaos , open	17	649	September 23, 2026
CM4 Secure Boot balenaOS	11	4103	August 22, 2022
Raspberry Pi CM - eMMC Disk Encryption / code protection Product support raspberrypi3 , raspberrypi4	2	986	November 17, 2020
Expanding balenaOS Secure Boot and Full Disk Encryption to ARM Devices Discussions	0	49	August 5, 2026

Enable secure boot and disk encryption for CM4

Related topics