The templates come with many common applications not installed. I assume this is done “to reduce attack surface”.
So for example some of your application qubes may need to use libreoffice, but not all of them. One option is to add every application you want to use to the template and have every application qube use that template. Another option is to create a seperate “debian-11-with-libreoffice” qube, and have just the application qubes that need libreoffice to use that, while the others use plain “debian-11” template.
As you add the new programs your qubes need, it can fragment the templates with the worst case being “one template per appvm” (I.E. “debian-11-with-libreoffice-and-sshfs-and–python3-psycopg2–for-qube-work07” template used only by appVM “work07”)
Both extremes seem undesirable. Maybe the best is a balance between exposed attack surfaces and disk consumption/template proliferation?
What are peoples thoughts?