Qubes OS: Security Through Isolation
summary
Qubes OS isolates tasks into separate VMs (called qubes) built on the Xen hypervisor, enforcing hardware memory and device isolation, GUI per-VM framebuffers and a two-step clipboard plus mediated inter-qube messaging via qrexec/vchan. Root images come from template-based app VMs with snapshot read-only roots and disposable VMs for risky files; disks use encrypted volumes and LVM thin provisioning. USB is owned by a service qube, networking is routed through chained service/VPN qubes, and expect a nontrivial learning curve, hardware compatibility limits and noticeable performance cost.
AI-written summary · about
chapters (8)
- 0:00Introduction to Qubes OS
- 1:34Qubes architecture overview
- 5:00Deep dive into isolation
- 8:15Inter-cube communication
- 10:45Storage and templates
- 13:33Real-world use cases
- 20:24Challenges and conclusion
- 24:35Question and answer session
related talks
22mQubes OS
24mThe future of the desktop is on hypervisor powered containers
21mUsing a cloud to manage a cloud
45mLife Behind the Tinfoil: A Look at Qubes and Copperhead
34mIn-Guest Mechanism to Strengthen Guest Separation
41mSecuring Your Xen-Based Cloud
57mDay 2 Keynote: Security Through Distrusting
22mSandboxes all the way down - A hitchhiker's guide to platform...