What Threats do Minimal Templates Protect Against?

@aquser there is a reason the way you are using it is the default: it’s
easier and works out of the box for the majority of users while not
requiring any extra thought in managing updates and resources.

There are some folks however who do see the advantage in running things
as compartmentalized as possible. For example: should I ever
accidentally attempt to open a PDF in my mail qube, nothing bad can
happen because there is nothing installed that could open it.

I strive to come as close as workable to a 1 qube per app/domain,
because that is obviously safer. What’s not there can’t be exploited or
exfiltrated or even shared/leaked by mistake.

And getting there will definitely teach you about packages, dependencies
and how to resolve those. How much RAM you really need for this or that
application, when paging starts to happen etc. For me that journey has
payed in spades: I’ve never been as happy and in control with a working
environment as now.

Also: we are talking about Debian stable with apt-cacher-ng … I am
quite confident that most days all my debian templates are updated in
less time and bandwidth as it takes to get a single Fedora qube updated.

3 Likes