A comprehensive resource for activists, protesters, and community organizers.
This guide is for technically competent users who are new to the Qubes OS paradigm. It provides a comprehensive overview of its philosophy, core concepts, and practical, secure workflows.
Qubes OS is not just another Linux distribution; it’s a fundamentally different approach to computing security. Its core design is built on the principle of Security by Compartmentalization.
Imagine your digital life is a house. In a traditional operating system (like Windows, macOS, or a standard Linux distro), this house is a single, open-plan studio apartment. If a burglar (malware) gets in through an open window (a vulnerable web browser), they have immediate access to everything: your desk (work documents), your filing cabinet (passwords), and your personal photos. A single point of failure compromises the entire system.
Qubes OS rebuilds this house into a series of separate, sealed rooms, each with its own reinforced door. Your work happens in one room, your personal banking in another, and your random web browsing in a third. A fire starting in the ‘browsing’ room is contained there; it cannot spread to the ‘banking’ room or the ‘password vault’ room. Each room is a qube, an isolated virtual machine. This is the essence of Security by Compartmentalization: if one component is compromised, the damage is contained, and the rest of your digital life remains secure.
Qubes OS is designed for those whose digital security is paramount. While anyone can benefit from its architecture, it is particularly vital for:
Hardware choice is critical for Qubes OS. Because it relies on hardware virtualization features, not all computers are compatible.
The single most important resource when choosing a machine for Qubes is the Hardware Compatibility List (HCL). This is a community-maintained database of systems that have been tested with Qubes OS. Before you attempt to install Qubes, you must check the HCL to see if your hardware is listed and what level of compatibility to expect.
Attempting to install on non-listed hardware is a gamble that can lead to a frustrating experience with non-functional devices (Wi-Fi, suspend, etc.) or a complete failure to install.
For Qubes to function correctly, your system’s CPU and motherboard BIOS/UEFI must support the following virtualization technologies:
sys-net). Without it, you lose a significant layer of security.dd or Rufus to write the ISO to a USB drive. The Qubes documentation provides specific, secure instructions for this process.Qubes OS has a unique vocabulary and architecture. Understanding these core concepts is key to using it effectively.
An App Qube (or Domain) is an isolated virtual machine where you run your applications. Each qube is based on a TemplateVM (see below). You might have a work qube for your office applications, a personal qube for your private email, and an untrusted qube for random browsing. The most visible indicator of which qube an application window belongs to is its color-coded border. This is a critical security feature: a red border instantly tells you the window belongs to your untrusted qube, while a green border might belong to your personal qube, preventing you from accidentally entering a password in the wrong context.
TemplateVMs are the ‘master copies’ or ‘golden images’ for your App Qubes. You do not run applications directly in a TemplateVM. Instead, you install software into the TemplateVM. For example, to install the GIMP image editor, you would start the fedora-39 TemplateVM, install GIMP using the standard package manager (sudo dnf install gimp), and then shut it down. All App Qubes based on fedora-39 will now have GIMP available in their application menu after they are rebooted.
This design is incredibly efficient and secure. To update the software for dozens of App Qubes, you only need to update their single, underlying TemplateVM. The update process is centralized and secure.
DisposableVMs are single-use, throwaway qubes. They are perfect for opening a suspicious email attachment or clicking a link from an unknown source. When you open a file in a DisposableVM, a new, clean qube is created on the fly. You can view the document, and when you close the window, the entire virtual machine is instantly and permanently destroyed. Any malware that might have been in the document is destroyed with it, having never had a chance to touch your persistent qubes.
Networking in Qubes is a prime example of compartmentalization.
sys-net: This is a special, unprivileged qube that has direct control of your physical network hardware (Wi-Fi, Ethernet). Its sole job is to manage the hardware and pass network traffic to sys-firewall. Because it’s isolated, a compromise of sys-net (e.g., via a malicious Wi-Fi driver) does not compromise your entire system. It only compromises the network device itself.sys-firewall: This qube acts as the central firewall for your entire system. It does not have any user applications. Its only purpose is to enforce rules about which qubes can connect to the network and to each other. You can, for example, configure it to deny all network access to your vault qube while allowing access for your work qube.sys-whonix and Anonymous NetworkingQubes OS provides strong anonymity by integrating the Whonix project. Whonix is an operating system designed to route all network connections through the Tor network. In Qubes, this is implemented through two key components:
The Whonix Gateway (sys-whonix): This is a dedicated qube that acts as a Tor gateway. Its only purpose is to take incoming traffic from other qubes and force it through the Tor network. It is designed to be secure and prevent IP address leaks.
The Whonix Workstation (Template for anon-whonix): This is a special TemplateVM that is pre-configured for security and anonymity. Applications run from this template (like the included Tor Browser) are hardened against fingerprinting and are configured to work safely with Tor.
How it Works in Practice:
anon-whonix is created for you) based on the Whonix Workstation template.sys-whonix.anon-whonix will have its traffic automatically and transparently routed through Tor. You don’t have to configure anything inside the qube itself; the anonymity is enforced at the system level.Stream Isolation for Enhanced Anonymity:
This is a powerful concept. You can create multiple App Qubes based on the Whonix Workstation template, each for a different anonymous activity. For example:
anon-research: Used for anonymously researching sensitive topics.anon-social: Used for managing an anonymous social media persona.Even though both of these qubes connect to the same sys-whonix gateway, Tor’s design ensures that the traffic from each is sent through a different Tor circuit (a different path through the network). This makes it extremely difficult for an outside observer to correlate your research activities with your social media persona. You are using different, isolated ‘streams’ of traffic for each identity, all while benefiting from the central protection of the Whonix Gateway.
A default Qubes installation provides a good starting point, but its real power comes from creating a workflow that matches your personal threat model. Here is a classic, highly effective setup:
vault Qube:
(none). This makes it an offline vault. It is physically impossible for malware to exfiltrate data from this qube over the network.work Qube:
sys-firewall. You can create firewall rules to restrict it to only your company’s VPN or specific websites.personal Qube:
sys-firewall. Kept separate from work to prevent a compromise in one domain from affecting the other.untrusted Qube:
sys-firewall. This is your ‘digital sandbox’. If you download a file here, you can safely pass it to a DisposableVM for inspection before moving it to a more trusted qube.Because all qubes are isolated, simple actions like copy/paste and file transfer require special, secure mechanisms.
A standard Ctrl+C and Ctrl+V will only work within the same qube. To securely move clipboard data between qubes:
Ctrl+Shift+C. This copies the text to a secure inter-qube clipboard and notifies the Qubes system that data is ready to be pasted.Ctrl+Shift+V. This will paste the data.This two-step process is intentional. It prevents a malicious qube from silently injecting data into your clipboard and tricking you into pasting a malicious command into a terminal in another, more privileged qube.
To move a file from one qube to another:
This triggers a secure, user-approved transfer. The file is not simply ‘moved’ in a shared filesystem; it is securely passed from one isolated environment to another under your explicit control.
Keeping the system updated is critical for security. Qubes provides a unified tool to handle this securely.
fedora-39, debian-12, whonix-gw-17, whonix-ws-17).The Qubes Update tool will now securely and sequentially:
After the process completes, you must reboot any running App Qubes for the updates to take effect. This single process ensures that the foundational software for all your compartments is patched and secure.