TemplateVM

TemplateVM is a foundational concept within the Qubes OS operating system. Qubes OS utilizes a security-by-compartmentalization approach, where different applications and tasks run in isolated virtual machines known as "Qubes." TemplateVMs are special types of Qubes that serve as read-only bases for creating other Qubes.

A TemplateVM contains a minimal installation of an operating system, such as Linux (various distributions are supported), along with a selection of installed software. When a user wants to create a new Qube for a specific purpose, like browsing the web or working on documents, they choose a TemplateVM as the source. The new Qube, called an AppVM, is then created as a writable snapshot based on the chosen TemplateVM.

This architecture offers significant security and management benefits. Since the TemplateVM is read-only, it cannot be infected by malware or altered by user actions within the AppVMs derived from it. If an AppVM becomes compromised, it can be easily discarded and recreated from its TemplateVM, effectively resetting it to a clean state. Furthermore, updating software only needs to be done once in the TemplateVM, and all derived AppVMs will inherit the updates upon their next startup. This streamlines system maintenance and enhances security by ensuring all personal virtual machines are based on a consistent, up-to-date, and uncompromised foundation.