How can I configure a disposable template's Net cube separately from its child?

User Support General
1

I’ve created a disposable template that uses a specific network qube. However, every disposable app I generate from this template seems to be connected to a different network. How can I adjust the network settings for the disposables created from this template?

How do I configure the network settings for disposables created from a specific template?
I need to air-gap a template but provide network access to its disposables, and I have a disposable template that’s not using the correct network; how do I fix this?

2

Conventional disposables inherit settings of their template. If you want separate settings, use named disposables.

Unfortunately, doing so goes against spawning multiple numbered unnamed disposables.

You could try writing a script that creates an unnamed disposable, sets its network settings, and then starts it.

Something like:

make_dvm() {
   local template="dom0" # setting template to dom0 uses your default dvm template
   local -a dvm=()

   if [ -n $1 ]
   then
      template="$1"
   fi

   # call for disposable
   readarray -d '' -s 1 dvm < <(qubesd-query --empty --fail dom0 \
      admin.vm.CreateDisposable "$template")
   wait $! || ...  # handle error

   echo "$dvm"
}

dvm=$(make_dvm my-dvm-template)
qvm-prefs $dvm netvm my-netvm
qvm-start $dvm
3

Then why do my disposables use a different net than what I have its parent set to?
I have double triple checked, and the template has the right net qube set. But every one made from it uses a different one.

4

I would quadruple check this,
Or you could provide sufficient information for others to be able to
replicate this - you could start with the Qubes version. the basis for
the disposable template, the netvm for the disposable template, and the
netvm used by (every?) disposable.

I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.

5

Quadruple checked it.
Restarted my computer to make sure everything was updated, checked with “qvm-prefs” in Dom0, checked in the GUI, and launched the template itself. They all use/report the expected Netvm.
I launch a disposable from it, check from within the VM itself, Dom0, and the GUI. All show the unexpected Netvm.
I have no named-disposables or similarly named Qubes on my computer I could possibly be confusing it with.

6

I can’t replicate it.

What do you do to launch a disposable from template?

You could try executing qvm-run -q -a --service --dispvm=<your_template> -- qubes.StartApp+<app> to start a disposable from dom0 and then checking whether networks are truly different.

Another option would be starting from scratch. Try creating new disposable template and running disposable based off of it:

qvm-create --class AppVM --property template_for_dispvms=True --label red testmydvm
qvm-run -q -a --service --dispvm=testmydvm -- qubes.StartApp+qubes-run-terminal
7

I got things working again by starting from the beginning. If there might be a security issue, I can certainly go back and look at what I did initially. I believe I can figure out how to recreate the problem. In fact, I’ve run into it several times while trying to do the same thing.