Attack surface of templates

[fsflover]

@Sven

There are some folks however who do see the advantage in running things
as compartmentalized as possible. For example: should I ever
accidentally attempt to open a PDF in my mail qube, nothing bad can
happen because there is nothing installed that could open it.

I strive to come as close as workable to a 1 qube per app/domain,
because that is obviously safer. What’s not there can’t be exploited or
exfiltrated or even shared/leaked by mistake.

See also:

Compartmentalization, "am I doing it right?"

So I don’t depend so much on the stock fedora and debian vms. I clone them, then install the apps I need on the clones, then make appvms to run those apps. I like this instead installing all apps I need one only two templates. But I’ve seen I’m up to maybe 50 or so templates. Is this overkill or is this what I should be doing for maximal security? The space isn’t rly the problem. And haven’t had many peformance issues either.