Qubes OS is a free and open-source, security-oriented operating system for single-user desktop computing. Qubes OS leverages Xen-based virtualization to allow for the creation and management of isolated compartments (aka Virtual Machines) called qubes. Qubes are creating from templates. Officially supported template VMs include Debian, Fedora, and Whonix. Other community templates are supported.

It's recommended you have a cursory understanding of the Qubes OS ecosystem before starting since it's unlike most OSes out there. This guide is based on Qubes 4.0 where the default Debian template is debian-10.

Setting up Debian 11 (Bullseye)

Update the system: sudo qubes-dom0-update.

Open Qubes Manager to see the default list of qubes. Most are based on Fedora. Right-click on a qube to view its settings. Any AppVM, SystemVM, and dom0 can be changed to a Debian template.

As of 10/4/21, there is no (stable, released) Debian 11 template package. This documentation will be updated when it's available.

It's possible to update the qube "in place". The recommended approach in Qubes is to create new VMs from scratch, instead of updating them. To align with these principals as best as possible, we base the upgrade on a fresh debian-10 template. In other words, don't clone a template you've installed software or changed settings on.

The official instructions can be found here.

The basic summary of commands, assuming you have template named debian-10:

[user@dom0 ~]$ qvm-clone debian-10 debian-11
[user@dom0 ~]$ qvm-run -a debian-11 gnome-terminal
[user@debian-11 ~]$ sudo sed -i 's/buster/bullseye/g' /etc/apt/sources.list
[user@debian-11 ~]$ sudo sed -i 's/debian-security bullseye\/updates/debian-security bullseye-security/g' /etc/apt/sources.list
[user@debian-11 ~]$ sudo sed -i 's/buster/bullseye/g' /etc/apt/sources.list.d/qubes-r4.list
[user@debian-11 ~]$ sudo apt update
[user@debian-11 ~]$ sudo apt upgrade
[user@debian-11 ~]$ sudo apt dist-upgrade

Restart the VM.

SystemVMs (sys-net, sys-firewall) are also fedora by default and can be changed. Either use Qubes Manager, or the commands:

qvm-prefs -s sys-net template debian-11
qvm-prefs -s sys-firewall template debian-11

Restart the VM.

Disposable VMs

Disposable VMs are one-time-only VMs that self-destruct when closed. These are great for opening suspicious emails without worry. Please refer to the official documentation on how to use and create disposables.

To set Debian 11 as the default disposable, you must first create a disposable VM based on debian-11 template. Then, in Qubes Manager > Global Settings, set the default disposable to it.

To change the default disposable of existing VMs, use Qubes Manager > Qube Settings on each VM, or the command qvm-prefs <VM> default_dispvm <DISPOSABLEVM_TEMPLATE>. For example qvm-prefs personal default_dispvm debian-11-dvm.

Removing unused/out of date templates

After creating a Debian 11 template, it's worth deleting debian-10 with qvm-remove debian-10 or in Qubes Manager. Make sure none of your existing VMs reference debian-10, otherwise you'll get an error when trying to remove the template. Check the SystemVMs, disposables, and dom0 if it's claiming you still have a reference.

Note: a common error that prevents removing templates, even after removing references to it, is ERROR: VM installed by package manager: template-vm-name. To remedy, follow the official docs

Read more