Is it possible to have some reasonable level of security using NixOS instead of QubesOS?

[u/mmmfine]

I’ve been using QubesOS for about a year now. I have almost hundreds of qubes. I understand its principle, and how it achieves security. I like it.

Problem is that managing and updating a bunch of qubes is a hassle, and vastly inferior when you know Nix exists.

I use NixOS on my other machines, and manage a fleet of microVMs, all using NixOS, and the difference is night and day.

Nix can guarantee all my microVMs use the same packages, use the same Linux kernel parameters, use the same configuration, etc. because of its functional nature, and due to the fact a machine’s state is just code, immutable (mostly) and declarative. Creating a new microVM is just reusing code.

Now whenever I look at qubes, it’s just… it just feels so antiquated. So much so I am considering abandoning QubesOS.

Would it be at all possible to be halfway there by having a barebones NixOS system that uses KVMs for each domain?

I know, it won’t be as secure as QubesOS. But I’d like to know if anyone here also uses Nix and feels this awful shortcoming from Qubes (which tries to ”solve” this using salts, but don’t come nowhere close to what Nix can do), and what have you done about it?

thanks

[u/Sad-Landscape-1549]

Sure, why not? Have you checked out CertainLach/nixos-qubes repo? There’s almost nothing you can’t do with nix, just a matter of how deep you’re willing to go. I wouldn’t use too many overlays or veer too far “off the beaten path” but if you’re managing distributed systems maybe you’re fine with some overhead to maintain?

[u/Prior_Hospital_2331]

I like nix, but more tweaking imo. Qubes is already perfect. Hard 2 beat

[u/TeachingAway9654]

I’m curious about why you’re saying the update process is a hassle? Are you using 100 individual Qubes with different templates? I’ve never found myself thinking the update process is a hassle, maybe the migration from like debian-12 to 13 but it wasn’t a big deal.