How to set the template of sys-net to debian-minimal?

Base the disposable template on the new template.

[user@dom0 ~]$ qvm-create -l red -t <NEW_TEMPLATE> <NEW_DISPOSABLE_TEMPLATE>
[user@dom0 ~]$ qvm-prefs <NEW_DISPOSABLE_TEMPLATE> template_for_dispvms True
[user@dom0 ~]$ qvm-features <NEW_DISPOSABLE_TEMPLATE> appmenus-dispvm 1

Templates | Qubes OS

My use case is to separate WiFi from Ethernet. So logically, I need separate “net” and “firewall” qubes for both kinds of connection. It seems reasonable to name them sys-net-wifi, sys-net-ether, sys-firewall-wifi, and sys-firewall-ether.

But no matter what I try as far as changing names, so that defaults for updates and the like go through sys-firewall-wifi (and sys-net-wifi) something in the system insists that there must be a qube named sys-net and another named sys-firewall. If I run update on some template, a new sys-net will be created on the fly and used.

This was regardless of anything I set on global qubes setting window.

Digging a bit deeper I found a config file that would change things unavailable on the settings window, but I somehow managed to lock myself out of my system (keyboard wouldn’t work on reboot) that way.

I strongly recommend just doing what’s necessary to ensure you have qubes named sys-net and sys-firewall…even if they are based on your templates. (And to make sure those templates are the ones set up to talk to the internet, if you are trying to “split” your system like I did.)

In other words, just make sure sys-net uses your new qube as a template, rather than whatever was installed. (Be ready, of course, to change it back if things don’t work.) Don’t try to rename sys-net (or sys-firewall).

Which disposable template? Are you telling me that I should base debian-11-dvm template (which is the current sys-net template) as the newly created deb-11-min-net ?

I wouldn’t do this, as you may be using that template for disposables
elsewhere, and it may have unforeseen consequences.
Disposables are based on a “disposable template” - that is a standard
template based qube.

You can (though I would not recommend it) change the template for your
debian-11-dvm to your new template. This will affect all disposables.
Or you can create a new qube using the new template, make it a
disposable template, and then use that as the template for your
sys-net. tzwcfq showed you how to do that.
In either case you can, if you want, create a new disposable qube called
“sys-net-minimal” or similar. That’s up to you.

1 Like

I would rather confine the change to sys-net and not affect other disposables.

However, as I said above in this thread, the Qube Manager UI doesn’t allow me to pick the newly created minimal deb-11-min-net for sys-net template. So how do I get that done?

you have a disposable called sys-net.
This is based on a “disposable template” called debian-11-dvm.
That “disposable template” is a qube which uses a template.

You have created a new template. What you haven’t yet done is create a
new “disposable template”

@tzwcfq showed you how to do this.

OK. So it is not enough to create a minimal template for the sys-net, but one also has to create a “Disposable Qube” based on the minimal template, which the sys-net will then use as a Template.

deb-11-min-net → deb-11-min-net-dvm → sys-net

The arrow denotes “Template” relationship with the left hand side is the parent of the right hand side of the arrow.

I will try @tzwcfq 's steps and report back.

I did @tzwcfq 's steps. And then changed the sys-net’s template to deb-11-min-net-dvm.

For clarity here is a table of VM relations:

deb-11-min (minimal debian template)
deb-11-min-net (clone of deb-11-min with qubes-core-agent-networking qubes-core-agent-network-manager packages installed)
deb-11-min-net-dvm (created following tzwcfq’s post above)

So, sys-net has Template as deb-11-min-net-dvm selected on the Qube Manager. I haven’t messed around with sys-firewall, so its Template is still the default debian-11-dvm.

Now after restarting the QubesOS, I no longer have the wifi on system tray visible. So, I am guessing something messed up. How do I get the wifi tray working again?

And now you have discovered the issue with minimal templates - they are
minimal. They are also aimed at “advanced users”: people who are at
home with Linux and Qubes.
The docs make it clear that if a minimal template doesn’t work as the
full one it is almost certainly due to missing packages.

Like many Qubes problems this is not Qubes specific. You could search
any guide to WiFi in Debian, looking for your specific WiFi adapter.
(The only Qubes specific part is that you have to do this in the
template, not in sys-net.)

You haven’t made it clear if you are missing the Network Manager icon, or
whether you are missing WiFi.
I’m assuming the latter.
The first thing to do is to check if you have “wireless tools” installed.
Then if you have the drivers required for your specific WiFi adapter.
If you run journalctl -b and look for warnings/errors relating to
networking/WiFi you should be able to identify the problem.

You will,of course, have to switch to the working sys-net to actually
install any packages in the template. Also, as a minimal template it
does not have passwordless sudo installed - you can open a root terminal
with qvm-run -u root XXX xterm to get root and install packages.

I’ve tried this myself just now and if I create non-disposable sys-net2 based on debian-11-minimal with qubes-core-agent-networking qubes-core-agent-network-manager packages then the network manager tray icon will appear in tray after sys-net2 start.
But if I create disposable sys-net2 then the tray icon won’t show up.
I’ve created disposable sys-net2 like this:

qvm-create --template debian-11-minimal-tst --label red debian-11-minimal-tst-dvm
qvm-prefs debian-11-minimal-tst-dvm template_for_dispvms True
qvm-features debian-11-minimal-tst-dvm appmenus-dispvm 1
qvm-create -C DispVM -l red sys-net2
qvm-prefs sys-net2 virt_mode hvm
qvm-service sys-net2 meminfo-writer off
qvm-prefs sys-net2 netvm ''
qvm-prefs sys-net2 provides_network true

Not sure why it doesn’t work.


I would like to say I am not completely newb to Linux. I have been using different distros as my daily drivers for seven years now. I would place myself to intermediate level in being “Linux-proficient.”

I am missing Network Manager icon. Since that is absent, I am not sure whether my sys-net has internet connection or not.

I think you are right in saying I may be missing drivers for my specific WiFi adapter. I do not have the specs of it off-the-top of my head, but I think pointing out that it is the stock wifi adapter that comes with a Thinkpad X220 would suffice.

I am now reminded of firmware-iwlwifi package being mentioned in Sven’s guide I linked in my OP. I will install that package to my deb-11-min-net template and try again.

Btw, do I need to change sys-firewall’s template, too? Or, can it (for now) stay as the default debian-11-dvm?

That’s a curious observation. I would like to get my sys-net working as disposable. So, that’s a bit strange.

I forgot to change the sys-net2 disposable template:

qvm-create --template debian-11-minimal-tst --label red debian-11-minimal-tst-dvm
qvm-prefs debian-11-minimal-tst-dvm template_for_dispvms True
qvm-features debian-11-minimal-tst-dvm appmenus-dispvm 1
qvm-create -C DispVM -l red sys-net2
qvm-prefs sys-net2 template debian-11-minimal-tst-dvm
qvm-prefs sys-net2 virt_mode hvm
qvm-service sys-net2 meminfo-writer off
qvm-prefs sys-net2 netvm ''
qvm-prefs sys-net2 provides_network true

Now this works fine.


Okay. I managed to get it working. Here I am writing the step by step instructions:

  1. Install debian-11-minimal template. Clone it into a new template and remove the original downloaded template:
    (in dom0) $ qvm-template install debian-11-minimal
    (in dom0) $ qvm-clone debian-11-minimal deb11min-net
    (in dom0) $ qvm-remove -f debian-11-minimal
    Here, deb11min-net template is the one we will modify and use for our network connection needs for sys-net.

  2. Update your whole system (thus update your newly downloaded deb11min-net template):
    (in dom0) $ qubesctl --show-output state.sls update.qubes-dom0
    (in dom0) $ qubes-dom0-update --clean -y
    (in dom0) $ qubesctl --show-output --skip-dom0 --templates state.sls update.qubes-vm

  3. Using apt update and upgrade your deb11min-net template:
    (in dom0) $ qvm-run --pass-io -u root deb11min-net "apt update && apt full-upgrade -y"

  4. Now install the necessary packages for network management:
    (in dom0) $ qvm-run --pass-io -u root deb11min-net "apt install --no-install-recommends -y firmware-iwlwifi qubes-core-agent-networking qubes-core-agent-network-manager"

  5. Shutdown the internet-connected qubes in order to modify sys-net settings:
    (in dom0) $ qvm-shutdown sys-whonix
    (in dom0) $ qvm-shutdown sys-firewall
    (in dom0) $ qvm-shutdown sys-net

  6. Create a disposable vm out of the deb11min-net template, for acting as yet another template for the sys-net, and then base the sys-net on top of this newly created disposable template:
    (in dom0) $ qvm-create --template deb11min-net --label red deb11min-net-dvm
    (in dom0) $ qvm-prefs deb11min-net-dvm template_for_dispvms True
    (in dom0) $ qvm-features deb11min-net-dvm appmenus-dispvm 1
    (in dom0) $ qvm-prefs sys-net template deb11min-net-dvm

  7. Finally, restart your whole QubesOS
    (in dom0) $ sudo reboot now

After doing these steps, you should have a working internet connection using your minimal debian template (deb11min-net).

For comparison, here are the number of packages between debian-11 and our deb11min-net:
debian-11: 1332 packages
deb11min-net: 486 packages

This is 3x less packages, yet giving you the same functionality.

Thanks to @tzwcfq , @unman , @Sven and qubes-os documentation for guiding me.


As I understand it, what that line of code does is to cause your disposable template to show in two places on your menu–(I am assuming the standard xfce menu at the upper left–it’s very different in KDE as I found out last night). Up near the top, you get a reference to this dvm, and if you click on it you will get a new disposable virtual machine (i.e. one with a name like disp1234). Scrolling clear down to the bottom the menu item of the same name lets you open the template. You probably don’t want the first one for your network qube, so I don’t think you want this line in your procedure.

(Fortunately, if you decide you agree, you can undo it without repeating the whole process, just re-issue but use “” (two double quotes, no space) in place of the 1.)

Unfortunatly one can not change the template from fedora-36-minimal to fedora-36-minimal-dvm (or maybe fortunatly, as one could kill /home/user/ with that)… so, I followed your guide with modifications for fedora-36-minimal-dvm and added:

qvm-service sys-net2 clocksync on

Why did you

qvm-service sys-net2 meminfo-writer off

and what is this meminfo-writer for anyhow?

PPS: that’s the cli equivalent for “Include in memory balacing” option in the “Advanced”-tab of “Qube Manager” Qube-Settings.

PS: btw, I’m using my new sys-net for wired uplink only, so a disposable is perfectly fine. For wifi I’ve got a sys-wifi which is a non-disposable and has a bunch of <wifiname.nmconnection>s stored in /rw/config/NM-system-connections/.

Store these in its dvm-template’s /rw/config/NM-system-connections/ and you’re good to go with disposable wifi too. I’m even more extreme. I have one dvm-template per connection with only one wifi firmware per dvm template, meaning I’m not connecting to the same wifis with different devices.

1 Like

Interesting idea.

Hmmm, I was actually about to go the opposite way. Using the same dvm-template for sys-net and sys-wifi, store all nmconnections in there but attach different PCI-devices to them.

The only threat I can infere is an information leak. A pawned sys-wifi (or sys-net using the same dvm-template) enables an attacker to see which network-devices your machine posesses and to which wifis you have been connected to.

PS: okay, I see, that might not be a minor issue since the BSSIDs could be used to uncover your geographical location… :joy:

PPS: on the other hand as sys-net/wifi would be attacked from the local net an attacker already has your geographical location. :thinking:

1 Like

Hahah, you made my day.
Well, I have more. One “disposable” cheap dongle per abroad travel, bought there.

Ok, but what is your threat model here?

Or is this about wifi-frequencies?