What are some possible causes? It happens fairly regularly.
I will have a completely different array of VMs networked and sys-whonix spontaneously starts. So I shut it down and sometimes it will start right back up again. I assume it’s something innocuous like dom0 checking for updates, but it’s somewhat unnerving .
Often times it happens when I have an alternate whonix gw running. Do the Qubes Whonix templates (or dom0) contain any scripts or configurations that assume an active whonix gateway is named sys-whonix (inadvertently triggering the sys-whonix to start when attempting to manage or run processes in the current gateway)?