CLI qubes-vm-update tool adnvantages

WhiteShadow · July 25, 2026, 7:16am

According to Qubes 4.3, qubes-vm-update include next flag:

--leave-obsolete Do not remove updater and cache files from target qube

GUI version of Qubes update have no access to toggle that.
In usage case of many templates based on same original OS template with small modification, actual use of “–leave-obsolete” flag save significant amount of network traffic and time.

Anyone can mention downsides for use of “–leave-obsolete” flag? Any security risks?

otter2 · July 25, 2026, 4:24pm

Looking at the code it seems to run apt upgrade with dist_upgrade set to False.

From description:

If the parameter dist_upgrade is True, new dependencies will be
installed as well (and conflicting packages may be removed). The
default value is False.

The equivalent of apt-get dist-upgrade?

--leave-obsolete also prevents removal of obsolete kernels.

In case of dnf if disables obsoletes configuration option.

I think it’s all it does, see yourself if you want to know more:

user@dom0 $ grep -r 'leave_obsolete' /usr/lib/python3.13/site-packages/vmupdate
/usr/lib/python3.13/site-packages/vmupdate/agent/entrypoint.py: remove_obsolete=not args.leave_obsolete
user@dom0 $ grep -r 'remove_obsolete' /usr/lib/python3.13/site-packages/vmupdate
...

WhiteShadow · July 27, 2026, 8:50am

IMHO, You look at process within update proxy, named disposable sys-firewall by default. We should focus on how it serve update process.
–leave-obsolete flag order update proxy to keep cache and downloaded data between different interactions with separated templates.

otter2 · July 27, 2026, 4:58pm

You need something like unman’s caching proxy if you want that:

github.com/unman/notes

apt-cacher-ng.md

master

# Using apt-cacher-ng as a caching proxy in Qubes.

## Why?
The standard tinyproxy is just a proxy. This ,means that as soon as you start to use more than a few templates you are wasting bandwidth (and time) in repeatedly downloading the same packages.  
Using a caching proxy saves on both.

## How?
apt-cacher-ng is a caching proxy with support for Debian based distros out of the box, as well as Arch.
It can be configured to support Fedora, Suse, Gentoo, and \*BSD

###  INSTALL 
Create a new Debian based template -  
`qvm-clone debian-12-minimal template-cacher`

In template-cacher install the software, by running as root:  
```
apt-get install qubes-core-agent-networking apt-cacher-ng 
systemctl mask apt-cacher-ng 
```
Shut down template-cacher.

This file has been truncated. show original

WhiteShadow · July 27, 2026, 6:49pm

github.com/QubesOS/qubes-core-admin-linux

doc/tools/qubes-vm-update.rst

main

===============
qubes-vm-update
===============

NAME
====
qubes-vm-update - update software in virtual machines (qubes)

SYNOPSIS
========
| qubes-vm-update [options]

OPTIONS
=======

Package Manager
---------------
--no-refresh
    Do not refresh available packages before upgrading vm
--force-upgrade, -f

This file has been truncated. show original

Update-proxy process packages for templates.

According to github docs:

`--no-cleanup`	Do not remove updater and cache files from target qube

outdated flag, actual flag is --leave-obsolete.

otter2 · July 28, 2026, 9:06pm

What makes you think it’s outdated? I’m pretty sure --no-cleanup removes what it says it should:

github.com/QubesOS/qubes-core-admin-linux

vmupdate/agent/source/apt/apt_cli.py

main


      
          def clean(self) -> int:
              """
              Use apt to clears out the local repository of retrieved package files.
              """
              cmd = [self.package_manager, "clean"]  # consider autoclean
              result = self.run_cmd(cmd, realtime=False)
              return_code = EXIT.ERR_VM_CLEANUP if result.code != 0 else 0
              return return_code

github.com/QubesOS/qubes-core-admin-linux

vmupdate/agent/source/dnf/dnf_cli.py

main


      
          def clean(self) -> int:
              """
              Performs cleanup of temporary files kept for repositories.
              """
              cmd = [self.package_manager, "clean", "packages"]
              result = self.run_cmd(cmd, realtime=False)
              return_code = EXIT.ERR_VM_CLEANUP if result.code != 0 else 0
              return return_code

github.com/QubesOS/qubes-core-admin-linux

vmupdate/qube_connection.py

main


      
          if self.cleanup:
              self.logger.info("Remove %s", self.dest_dir)
              try:
                  self._run_shell_command_in_qube(
                      self.qube, ["rm", "-r", self.dest_dir]
                  )
              except Exception as err:
                  self.logger.error(
                      "Cannot remove %s, because of error: %s",
                      self.dest_dir,
                      str(err),
                  )

Neither of these flags should save network traffic unless you’re upgrading a debian machine or switch between package versions often.

As manual says, caching and removal happen on target qubes. For example, if you run:

$ qubes-vm-update --leave-obsolete --targets template1 template2

Obsolete packages are going to stay on template1 and temlpate2, not update proxy. If you want proxy to cache packages you need either unman’s apt-cacher or its alternative.