Qubes OS lets you run applications in separate virtual machines. A virtual machine, usually shortened to VM, is an isolated operating environment running on your physical computer. In a carefully structured Qubes OS setup, your browser, email client, password manager and LibreOffice can each run in a separate VM.
This separation is the central security feature. The browser process runs inside the browser VM and sees the files stored there. KeePassXC runs inside another VM and sees its password database. LibreOffice runs inside an Office VM and sees the documents stored there. Each application therefore works with the data and network connection assigned to its VM.
KUHBS adds a graphical interface that creates, upgrades, backs up, restores and removes these application VMs from reviewed configuration.
What Qubes OS is
Qubes OS is a free and open-source operating system for desktop computers. Its security model is based on compartmentalization: applications and data are divided between separate VMs instead of sharing one operating-system environment.
Qubes OS uses the Xen hypervisor to run these VMs. A hypervisor is the software layer that divides the computer’s processor, memory and devices between virtual machines. Xen also enforces the boundaries between them.
The VMs still share one desktop. Firefox, Thunderbird, KeePassXC and LibreOffice appear as ordinary application windows. A coloured border and the VM name show which VM owns each window.
Why Qubes OS runs applications in separate virtual machines
An application normally has access to the files, memory and services available inside the operating system where it runs. Placing applications in separate VMs divides that access.
For example, Firefox can run in a VM that stores browser data. Its connection can pass through a firewall VM, which is a separate VM that controls network traffic. KeePassXC can run locally in a network-isolated VM that stores the password database. Thunderbird can run in its own VM with access to its email profile and a defined network route.
The VM boundary separates these application environments. It is designed to contain a security event inside the browser VM while the password-manager and Office VMs continue behind their own boundaries. This is what makes Qubes OS a reasonably secure operating system.
Qubes OS also lets you choose how each VM connects to other parts of the computer. A VM can use a firewall VM, work locally in network isolation or receive a USB device for a specific task. Qubes OS can also create a DisposableVM for one application session and remove it when that application closes.
The four types of Qubes OS VMs
Qubes OS uses several VM types because software installation, daily data and temporary sessions need different rules for which changes remain after shutdown. Understanding these types makes the Qubes OS design much easier to follow.
TemplateVMs provide software for other VMs
A TemplateVM contains the operating system files and installed applications used by other VMs. Software is installed and updated in the TemplateVM. AppVMs based on it can use those system files while their daily activity leaves the TemplateVM unchanged.
For example, a TemplateVM can contain Thunderbird and its supporting packages. The Thunderbird AppVM uses that software while keeping the user’s email and account settings in its own storage.
Several AppVMs can use the same TemplateVM. Updating it provides the updated software to all of them after they restart, while their user files remain separate.
AppVMs keep user files and application settings between sessions
An AppVM is where most daily work happens. It uses the operating system and installed software from a TemplateVM, while its user files and application settings persist between sessions.
A KeePassXC AppVM keeps the password database. A Thunderbird AppVM keeps downloaded email, account details and preferences. An Office AppVM keeps documents and LibreOffice settings.
Qubes OS allows one AppVM to run several applications. A structured KUHBS setup can instead dedicate an AppVM to a single purpose such as email, password management or document work. The VM name and coloured window border make that purpose visible on the desktop.
DisposableVMs start fresh for temporary tasks
A DisposableVM starts from an AppVM configured as its source. The source AppVM determines which software and initial settings the DisposableVM uses. Qubes OS can launch an unnamed DisposableVM for one session and remove it together with its session data when the task finishes.
Web browsing is a practical example. A browser launcher can create a fresh DisposableVM, start Firefox inside it and remove the session when Firefox closes. The next launch creates another fresh browser VM from the same source AppVM.
DisposableVMs are also useful for viewing a document, opening an email attachment or handling a short task in a new VM created for that task.
StandaloneVMs contain their own software and data
A StandaloneVM keeps its complete operating system, installed software, user files and settings. It continues independently of a TemplateVM after creation.
This VM type suits applications that need a complete environment of their own, such as Windows or a specialised development environment.
KUHBS can prepare a temporary setup TemplateVM, install the required software once and create one or more StandaloneVMs from it. The resulting StandaloneVMs then keep the complete operating system, software and later changes.
How Qubes OS VMs appear and work together on one desktop
Qubes OS integrates application windows from different VMs into one desktop. You click a normal application launcher and receive a normal window. The border colour and title identify the VM running it.
The colour can represent the purpose or trust level of the VM. You might use green for a password manager or confidential documents, yellow for browsing and another colour for communication. The visual label remains attached to the application window as you move it around the desktop.
Qubes OS provides explicit clipboard and file-copy actions between VMs. You select the source VM and destination VM when transferring information. This keeps the boundaries visible during daily work.
Networking follows the same model. An application VM can connect through a firewall VM, which is a separate VM that controls network traffic. A network-isolated VM works locally. USB controllers can also be assigned to a dedicated VM, so hardware handling receives its own boundary.
What using Qubes OS looks like in daily life
A daily session can begin with KeePassXC in a persistent, network-isolated AppVM. Its password database remains available between sessions.
Opening a browser launcher creates a fresh DisposableVM. The browser uses that VM’s memory, session files and network route. Login details can be copied from KeePassXC through the Qubes OS clipboard.
Thunderbird runs in another persistent AppVM. Its email profile contains downloaded messages, account settings and preferences. Its network connection can pass through a firewall VM.
Documents open in an Office AppVM with LibreOffice and PDF tools. That VM can work locally while its documents and settings remain available for the next session.
All four applications appear together on the desktop. Their coloured borders show that they run in separate Qubes OS VMs.
What KUHBS adds to Qubes OS
Qubes OS supplies the virtualisation and isolation. KUHBS, the Kuh Build System, automates the work required to turn those features into complete application setups.
A technical user describes one setup in a directory called a KUHB. The KUHB states which VM types and base TemplateVM to use, and which software to install. It also defines the network connections, desktop launchers and user data included in backups.
KUHBS validates this definition and displays it as an application card in the GUI. The end user selects the card and clicks Create. KUHBS then builds the required Qubes OS VMs, applies their settings, runs the installation steps and adds the application launchers to the desktop menu.
This turns specialist Qubes OS knowledge into reusable code. The end user operates the reviewed definition through the graphical interface.
How a reviewed KUHBS definition becomes a complete VM setup
KUHBS definitions are stored in repositories that record the history of every version. A technical reviewer can inspect the exact version, including its software sources, installation scripts, VM settings, network routes, launchers and backup paths.
After the reviewed repository is added and its definition is enabled, KUHBS validates both the configuration and the relationships between the planned VMs. It also checks that the selected base TemplateVM exists.
Create then follows the required order. KUHBS prepares the TemplateVM first, creates the dependent AppVMs or the source used for DisposableVM sessions, applies their VM settings, installs the software and generates the desktop launchers.
For a StandaloneVM setup, KUHBS prepares a temporary TemplateVM and creates the final StandaloneVM from it. The user receives the finished application entry in the desktop menu instead of a list of manual Qubes OS commands.
Four practical setups from the KUHBS application catalog
The KUHBS application catalog shows how different applications use different VM types, network connections and backup choices.
- Browser: Browser software is prepared in a TemplateVM. Each launcher starts the selected browser in a fresh DisposableVM and closes that VM with the browser session.
- KeePassXC: The password manager runs in a persistent, network-isolated AppVM. Its password database remains available between sessions.
- Thunderbird: The email client runs in a persistent AppVM connected through the KUHBS firewall VM. Its Thunderbird profile is selected for backup.
- Office: LibreOffice and document tools run in a persistent, network-isolated AppVM. The user’s document workspace is selected for backup.
How KUHBS handles Create, Upgrade, Backup, Restore and Remove
KUHBS manages the complete lifecycle of an application setup from the same GUI.
Create builds the required Qubes OS VMs, installs the applications, applies the configuration and creates the launchers.
Upgrade updates managed TemplateVMs and StandaloneVMs and runs any update steps supplied by the KUHB. AppVMs receive updated system software from their TemplateVMs after restarting.
Backup saves the application data selected by the KUHB. This selection is specific to the application. A Thunderbird definition can select its email profile, while an Office definition can select the folder containing the user’s documents and settings. KUHBS stores the selected data in a compressed backup file called an archive.
Restore returns a matching archive to the application VM. KUHBS can also restore selected data while recreating an application setup, before the application-specific setup steps run.
Remove shuts down and removes the generated VMs and their KUHBS desktop launchers. The reviewed KUHB remains available as the reproducible description of the setup.
Together, these actions support a clean rebuild: Create reproduces the software environment, and Restore returns the selected user data.
Who benefits from Qubes OS with KUHBS
Qubes OS is useful for people who handle confidential communication, source material, client documents, private identities or valuable online accounts. Journalists, activists, NGOs, lawyers, researchers and businesses can separate these activities into dedicated VMs.
The same structure is useful for private users who want stronger desktop security. Browsing, email, passwords, banking and personal documents each have different data and network requirements. Technical specialists prepare and review the definitions; end users operate the resulting setups from the KUHBS interface.
What you need to get started
Qubes OS requires compatible hardware with virtualisation support, sufficient memory and sufficient storage for several VMs. The official Qubes OS website provides its hardware compatibility list, system requirements and installation guidance.
After installing Qubes OS, learn the VM names, border colours, clipboard actions and file-transfer workflow. These are the parts of Qubes OS that appear throughout daily use.
The next step is to install KUHBS, add a reviewed repository and enable one application definition. A browser setup is a practical first example because every launch visibly creates a fresh DisposableVM.
From there, add the persistent application VMs that match your work: password management, email, documents and communication. Qubes OS supplies the isolation between those VMs. KUHBS supplies the repeatable definitions and lifecycle controls that make the setup manageable for daily use.
Image source: AI Generated
