Need explanation on organizing qubes and installing software

User Support
11

Saying “a threat model of security above everything else” doesn’t say much, but let’s look into what such a workflow would give you. (If you want to learn about creating a threat model, I linked a guide from the Electronic Frontier Foundation in this post.)

You’ll create a templateVM (by cloning one of the official ones, or use one of the official ones directly).

You’ll install software in it. (You mentioned VS Code above, note that it may be a little difficult to follow the official VS Code installation instructions in a templateVM, because the templateVMs are offline by design. If you don’t care about the Miscrosoft-specific bits, you can install VS Codium —the open-source core of VS Code— easily because Debian and RPM packages exist. Worth a look IMHO: https://vscodium.com)

You’ll then configure your apps in an appVM. That appVM will be presumably online since you want to download some Docker/OCI containers to it. In the compartimentalization spirit, you’ll probably restrict the network usage to the minimum to get what you want (e.g. download containers using Docker, but probably not browsing the web).

Then you’ll clone that appVM for each new project/client/need.

What does that give you in comparison with a traditional Linux installation?

  • Most of the filesystem is copied from the templateVM, so malicious modifications to, say, /usr/bin/example won’t persist after you reboot your appVMs.

  • All the clones will share whatever you did in the original appVM (until the moment you cloned it), but nothing you do in a clone will affect the other. That means that the data related to project/client/need A will be properly isolated from the data related to project/client/need B. (Same goes with, for example, malware that found its way through the activities related to project/client/need A and B, for example by browsing to a malicious website.)

Is that good? Does that address concerns you have when working on A and B? Only you can decide that, but as such, it is something that wouldn’t be that easy to achieve with a traditional Linux installation.