Hey,

I think the solution proposed by bchalios is the way to go but I'm not aware of anybody actually implementing it:

1. build a small initrd with an init process that
   a. mounts the LUKS filesystem usigcryptsetup luksOpen
   b. pivots the root to the new file system (example in firecracker-containerd)
   c. delegates the boot to the init executable in the decrypted image
2. package the initrd as acpio archive
3. start firecracker with the initrd (docs)

Note that the initrd is copied to the VM memory, consuming it. You can technically do the same with a separate (unencrypted) boot disk that prepares the system and then delegates to the other init process.

If you manage to get the setup working, don't forget to provide the details here for the community!

Update: the kernel documentation has a nice guide on what is the initrd and how to make one:https://docs.kernel.org/admin-guide/initrd.html . It's only missing the LUKS mounting part, but there's a complete example on how to pivot_root to a new filesystem.