How can I execute a script after each update?

I would like to execute a script after each time my TemplateVM updates.

I tried /etc/qubes/post-install.d, but I don’t understand how it works.

Here is what I did:

  • Start a blank TemplateVM: (e.g.: fedora-38-xfce or debian-12-xfce)

In the TemplateVM:

  • Execute this:
$ cd /etc/qubes/post-install.d
$ sudo touch
$ sudo chmod +x
  • Write this in

echo 'aaaa' > /tmp/a.txt

In dom0:

  • Start the Qubes Update GUI
  • Select the modified TemplateVM
  • Press Update

What I expect:

  • /tmp/a.txt exists and has aaaa in it.

What I happened:

  • Nothing


  • How can I execute a script after each update?

It works for me.
To note, if you run Qubes Update for this qube and restart the template after update then the file /tmp/a.txt won’t persist because /tmp directory is not persistent. Write to /home/user/a.txt for a test instead.
Also the script in /etc/qubes/post-install.d will only be executed if some package was installed during update. If there were no new updates then nothing will be executed.

In addition to what was said, these scripts will also be executed if you install a program from an AppVM (it’s something I often do, even if it’s not persistent).

You can add this to your script so it exits on non templates, this checks if there is a network interface and exits if so, a template shouldn’t have a network interface.

# abort if not in a template
ip l show eth0 && exit 0
1 Like

It’s not direct related, but you can parse rc.local.d directory on boot. See here:

It’s better to add this instead:

if test -f /run/qubes/this-is-templatevm ; then
   ## Do none of the following in a TemplateVM.
   exit 0

Because in offline qubes there is no eth0 interface as well.


Perfect, I was looking for something more “template-only” :star_struck: :+1:


qubesdb-read /type

Instead for this @solene :slight_smile:

this is even better :+1:

1 Like