AppVM

AppVM stands for application virtual machine. It is a type of virtual machine designed to run a user’s applications in isolation from other software and from the base operating system. The term is most closely associated with security-focused virtualization environments, particularly Qubes OS, which uses virtualization to compartmentalize tasks.

In practice, an AppVM is an independent VM that hosts user applications. Each AppVM is isolated from other AppVMs and from the rest of the system, reducing the impact of a compromise in one area. AppVMs are typically based on a TemplateVM, which provides the common OS libraries and applications. Updates are managed in the TemplateVM and can be shared with linked AppVMs, while each AppVM maintains its own private data and settings. AppVMs can be reset or destroyed to return to a clean state, and disposable VMs (DispVMs) are used for temporary tasks or untrusted inputs.

The security model of AppVMs centers on isolation and policy-driven communication. Applications run in separate VMs, and interactions between VMs—such as file transfers or network access—are controlled by the system’s security policies. This design aims to limit the spread of compromise and reduce the risk to other parts of the system.

Typical use cases include separating work, personal, and financial activities into distinct AppVMs, running risky tasks in disposable VMs, and opening untrusted content without affecting the rest of the environment. Limitations can include added complexity and virtualization overhead, potential performance costs, and the need to manage multiple templates and VMs.