Minimal Templates

MinimalTemplates · August 31, 2026, 5:05pm

In the documentation for minimal templates, it says:

NetVM, such as the template for sys-net: qubes-core-agent-networking qubes-core-agent-network-manager NetworkManager-wifi network-manager-applet notification-daemon gnome-keyring polkit @hardware-support. If your network devices need extra packages for the template to work as a network VM, use the lspci command to identify the devices, then run dnf search firmware (replace firmware with the appropriate device identifier) to find the needed packages and then install them. If you need utilities for debugging and analyzing network connections, install tcpdump telnet nmap nmap-ncat.

USB qube, such as the template for sys-usb: qubes-usb-proxy to provide USB devices to other Qubes and qubes-input-proxy-sender to provide keyboard or mouse input to dom0.

FirewallVM, such as the template for sys-firewall: at least qubes-core-agent-networking and iproute, and also qubes-core-agent-dom0-updates if you want to use it as the UpdateVM (which is normally sys-firewall).

Are those all of the necessary packages for each of these templates to have secure and identical functioning as the default ones? Is there a package that is missing from the list that the default service templates have which absence could worsen the security of these qubes? If I want to make it disposable, I create a new disposable appvm based on the minimal template with all of those installed, then make it the service’s template? In the documentation there is a lot of discouragement, so I want to make sure that I’m doing things right. It seems simple for something that is for advanced users.

FranklyFlawless · August 31, 2026, 5:29pm

Necessary and identical functionality are mutually exclusive.

That depends on your threat model and use case(s).

MinimalTemplates · August 31, 2026, 5:41pm

I mean compared to the default cubes. Is there a package default cubes have that provides added security but is not included in the minimal templates documentation?

Yes but maybe default service cubes have some other packages that are not “necessary” but add security and are recommended. Do they or are they all included in that documentation? Am I good to go by following that documentation and not installing anything else for identical functioning as the service qubes?

Is this correct for making it identically disposable like default ones are? Thanks in advance.

FranklyFlawless · August 31, 2026, 5:52pm

The documentation is outdated by at least five Fedora versions, I suggest reading the Qubes Builder v2 template recipes for the authoritative and current manifest.

MinimalTemplates · August 31, 2026, 6:09pm

Do you mean this?

FranklyFlawless · August 31, 2026, 6:42pm

No, these two plus the shared core:

github.com/QubesOS/qubes-builder-rpm

template_rpm/packages_fedora_minimal.list

main

xterm
tar
haveged
sudo
python3-urllib3
--exclude=kdegames
--exclude=firstboot
--exclude=xorg-x11-drv-nouveau
--exclude=firewall-config,firewalld
--exclude=gnome-boxes
--exclude=yum-utils

MinimalTemplates · August 31, 2026, 6:44pm

Thank you. My final question

If I want to make it disposable, I create a new disposable appvm based on the minimal template with all of those installed, then make it the service’s template?

FranklyFlawless · August 31, 2026, 6:50pm

Generic documentation is sufficient:

qubist · September 1, 2026, 11:28am

Yes.

I don’t have qubes-input-proxy-sender in sys-usb and everything seems to work fine.

BTW if you decide to have a working ping (iputils-ping), linux-sysctl-defaults seems necessary too.