Ir para o conteúdo
Life Security

Pesquisar no site

Encontre páginas e seções.

Qubes overview

Última atualização:

Qubes OS starts from an assumption most operating systems avoid: some program on your computer will eventually be compromised. So instead of trying to stop every attack, it splits your digital life into compartments and aims to make a successful attack cost you one compartment, not everything. This page explains how that works, what it protects against, what it doesn’t, and what it costs you.

It’s aimed at people who handle untrusted files, links or devices from strangers, and at people with reason to expect targeted attacks. For most readers a fully updated mainstream system and sensible habits are the better trade. We say below how to tell which group you’re in. Facts about versions and dates are as of October 2026, when the current release is Qubes OS 4.3.

After reading you’ll know what a qube is, what the isolation is built on, why the hardware requirements are strict, and what to try first if you decide to use it.

What Qubes OS is in plain terms

Qubes OS is a security-focused operating system for one person at one desktop. It runs on the Xen hypervisor, a thin layer of software that sits directly on the hardware and splits the machine into separate virtual machines. Qubes calls these compartments qubes. All their windows appear on one desktop, each framed in a color you choose, so you can see at a glance which qube you’re typing into. The project’s own picture is many computers on one desk, with the convenience of a single machine.

Take a concrete case. You get a PDF from a stranger. On a normal system you open it in the same session where your email and saved passwords live. In Qubes, you can open it in a disposable qube, a throwaway compartment that deletes itself when you close it. If the PDF carries malware, it runs in a room with nothing in it. The Qubes documentation describes this as the working assumption behind the whole design: all software has bugs, so the system is built on the expectation that they will be exploited.

How it works

The admin qube and the rest

One special qube, called dom0, administers the whole system. It has no network connection and exists to run the desktop and manage the other qubes. If dom0 were compromised, Qubes says, that would be “game over” for the whole machine, which is why you never run ordinary apps in it. In Qubes 4.3, dom0 is based on Fedora 41.

Everything else is a qube. App qubes are where you run browsers, email and documents. After install you get a starter set (work, personal, untrusted and vault), and the project says a typical person needs around five. Service qubes handle plumbing: a networking qube (sys-net), a firewall qube (sys-firewall), a USB qube (sys-usb) and a Tor gateway (sys-whonix).

Templates

Each app qube is based on a template, which supplies its operating system, usually Fedora or Debian. An app qube can’t modify its template, so if one qube is compromised, the template and every other qube sharing it stay clean. The catch is that software has to be installed in the template, not in the app qube. Anything you install inside an app qube is gone when it restarts.

Isolating the risky hardware

Network cards and USB controllers are common attack routes, so Qubes assigns them to their own qubes. A compromised network driver then has to get past the hypervisor to reach anything of value. That protection depends on a processor feature called an IOMMU (Intel’s name is VT-d, AMD’s is AMD-Vi). Without it, a hostile network qube could use direct memory access to reach dom0. The project says Qubes still offers a security advantage without it, but the network-qube separation stops meaning much.

Moving data between qubes

You can copy text and files between qubes, but only through deliberate actions you take. Qubes uses its own inter-qube file transfer and a separate global clipboard that you push to explicitly. The project argues this is safer than moving files between two physically separate computers, because nothing needs to parse a disk’s file system.

The disk itself is encrypted with LUKS by default, everything except the /boot partition.

What it protects against, and what it doesn’t

Threat What helps Where it falls short
Malware from a risky link or attachment Separate qubes and single-use disposables Anything inside the compromised qube is exposed, including data you put there
A hostile Wi-Fi network or network-card exploit A separate network qube, plus IOMMU Needs hardware support. Without it the separation protects far less
A malicious USB device A separate USB qube Attaching a whole drive to a qube exposes it to the drive’s partition table. The project advises passing only the partition you need
A Xen hypervisor flaw Updates, and Qubes bulletins that say which advisories affect it The hypervisor is the single wall between qubes. In July 2026, one Xen advisory noted a malicious qube may be able to compromise Qubes
Data leaking out of a compromised qube Qube firewall rules, or giving a qube no network The project says its firewall isn’t a leak-prevention mechanism, because two compromised qubes could cooperate through covert channels
Surveillance of what you do online Whonix qubes for Tor Qubes claims no special privacy properties outside Whonix, including in disposables
A tampered laptop Anti Evil Maid, which needs a TPM UEFI Secure Boot isn’t supported out of the box

Two limits sit outside the table. Qubes doesn’t stop you from handing your password to a convincing fake site in the qube where you do your banking, so habits still matter. And a mistake in dom0 undoes the lot.

Common myths

“Qubes makes me anonymous.” It doesn’t. The project says the main way it provides privacy is through the Whonix integration, which routes traffic through Tor. It warns that you’d have to reinvent Whonix to match that in other qubes, and that privacy is difficult even with Whonix. Our Tor overview covers how Tor works and what it doesn’t give you.

“Virtual machines mean perfect isolation.” Isolation is strong, but it depends on Xen, and Xen has vulnerabilities. The Qubes team published security bulletins about Xen flaws on 13 May (QSB-113), 9 June (QSB-115, an HVM I/O port flaw) and 28 July 2026 (QSB-116, covering four advisories), among others. That’s the system working as designed, with a team that tracks and says which Xen advisories affect it. It also shows why updates matter.

“I can use it like any other laptop.” Not quite. Qubes uses the CPU to draw graphics and doesn’t virtualize the GPU, so games and video editing mean dedicating a graphics card to one qube, with security trade-offs and a second GPU to run the desktop. Installing it alongside another operating system, or inside a virtual machine, isn’t recommended either.

Who it suits, and what it costs

The Qubes documentation says it’s built for vulnerable and actively targeted people such as journalists, activists, whistleblowers and researchers, and for power users. It also says that prior Linux experience helps. We think that’s fair: if your main risk is a stolen phone or a phishing email, the effort isn’t worth it. If you routinely open files from strangers or have a specific adversary, it can be.

The costs are concrete.

  • Hardware. The project’s minimum is a 64-bit Intel or AMD processor with virtualization (VT-x with EPT, or AMD-V with RVI) and an IOMMU, 6 GB of RAM and 32 GB of storage. It recommends 16 GB of RAM, a 128 GB or larger SSD, a recent Intel processor and Intel integrated graphics. It doesn’t recommend AMD processors, because on client machines microcode security fixes often arrive only through firmware updates from the vendor. Meeting these requirements isn’t enough to guarantee Qubes runs, so check the project’s hardware compatibility list and certified hardware first.
  • Time and attention. You learn a new way of working: choosing which qube something belongs in, updating templates separately, and keeping dom0 clean.
  • Updates and support. Each release is supported for six months after the next major or minor one. Qubes 4.2 reached end of life on 21 June 2026, and 4.3 is the supported release. Official templates are Fedora and Debian: Fedora 43 and 44, and Debian 13, as of the project’s July 2026 table.
  • Windows. You can run Windows in a qube. Qubes 4.3 reintroduced its Windows Tools. That gives you an isolated Windows, not a safer one.

What to do

  1. Decide whether you need it. Ask what you’re defending against. If it’s accounts, theft and scams, use a mainstream system and the habits in our other pages first. If you handle hostile files or links from strangers, Qubes is a good fit. Threat modeling helps you answer this.
  2. Check hardware before you commit. Look your model up in the hardware compatibility list or choose certified hardware. The project says Qubes can be installed on a USB flash drive of at least 32 GiB, which lets you test on a machine before buying it.
  3. Verify the download. Qubes publishes signatures so you don’t have to trust the website or mirror. The project’s verifying signatures guide explains how.
  4. Update everything right after installing, and keep doing it. The release notes strongly recommend updating immediately after installation. Update dom0 and your templates regularly, and take backups with the built-in backup tool.
  5. Keep dom0 clean. No browser, no email, no downloads. Install software only in templates.
  6. Use disposables for anything untrusted. Open unknown files and links there. Keep banking and sensitive accounts in their own qube, and use color to tell them apart.
  7. Use Whonix qubes if you need Tor. Don’t count on privacy anywhere else in Qubes.

What this page doesn’t cover

We haven’t covered installation step by step, designing a qube layout, Split GPG, the Anti Evil Maid setup, Qubes Air, running Tails in Qubes, or comparing Qubes with other isolation tools. Each deserves its own page. This page is general information, and for a high-risk situation you should get advice from a digital security specialist.

Sources

Perguntas frequentes