Extra templateVM for email / vault?

[fsflover]

@qun

what is the (security) difference, if I make just stanaloneVMs for nearly everything instead of making templateVMs and appVMs for each “task”? Is the benefit especially in separation from the root partition which is in the templateVM?

Yes, the reset of root partition is the main advantage in security. This brings more security through isolation. Software in the AppVM will not be able to change the root partition. It also bring a lot of convenience with updates, software installations, less disk space, lower number of VMs.

See also:

How do I create a standalone VM?

@bill actually, installing a non-native VM for this purpose is loosing out on a lot of Qubes features. security-wise you’ll be running that qube in the HVM virtualization mode which the docs state has security disadvantages compared to standard qubes VMs (which run in PHV mode) convenience-wise You’ll be missing on automated updates (through Qubes Updates); you’ll be seeing the desktop of that VM instead of a seamless experience where the windows integrate well with everything else, etc. …