i see, there's a race condition where the pod still starts but is then stopped - i have created a new ticket to track that NAS-114378. Thanks for clarifying!

Yes, you are correct and step 2 is not needed. Sorry for the confusion.

i don't follow, when you create the datasets - they should already be unlocked ? So why is step 2 required ?

Let me add more details on top of the steps I previously commented on 03th Jan 2022.

0. Create a new "enc" dataset under the zfs root with default options and encryption with passphase. Create a new "app" dataset under the "enc" with default options and inherited encryption. Create a new "syncthing" dataset under the "app" dataset with default options and inherited encryption.

1. The layout of datasets of interested is now as followed:

2. Unlock the "enc" (and its child datasets) recursively.

3. On the Apps section in the WebUI. Create an app by the "Launch Docker Image" button, and under the "Configure Host Path Volumes" of "Storage", add the path "/mnt/zfs/enc/app/syncthing" into the host path and "/config" to the mount path

4. Reboot

5. On the host system, despite the app having not been started, empty directories with the path of "/mnt/zfs/enc/app/syncthing" are found under the "enc" dataset, despite the "enc" dataset has not been unlocked

6. "enc" refuses to be unlocked, stating the mount point is not empty

7. Removing all the directories under "enc" allows it to be successfully unlocked

i am still not able to reproduce as UI is consuming the API at the end and not doing something directly. It would be nice/better if you could list down explicit steps which i can try and before starting steps please clarify system state like the path which you are mounting, is it a fresh dataset and unlocked etc. Thanks!