Jump to content
Main menu
Main menu
move to sidebar
hide
Navigation
Main page
Recent changes
Random page
freem
Search
Search
Appearance
Create account
Log in
Personal tools
Create account
Log in
Pages for logged out editors
learn more
Contributions
Talk
Editing
Openai/695158d7-1b68-800b-a02f-4817bf1f6d25
(section)
Add languages
Page
Discussion
English
Read
Edit
Edit source
View history
Tools
Tools
move to sidebar
hide
Actions
Read
Edit
Edit source
View history
General
What links here
Related changes
Special pages
Page information
Appearance
move to sidebar
hide
Warning:
You are not logged in. Your IP address will be publicly visible if you make any edits. If you
log in
or
create an account
, your edits will be attributed to your username, along with other benefits.
Anti-spam check. Do
not
fill this in!
== gpt-5-2 == === User: Hi, I'm installing qubes os, I deleted all partitions and I have a choice to make: Partition, LVM2 Volume Group anf Btr… === Hi, I'm installing qubes os, I deleted all partitions and I have a choice to make: Partition, LVM2 Volume Group anf Btrfs Volume. What are the pros/cons/risks of each option? === Assistant: Good question — this choice does matter in Qubes OS, because it affects reliability, performance, and how easy it is to… === Good question — this choice does matter in Qubes OS, because it affects reliability, performance, and how easy it is to recover or manage storage later. Below is a Qubes-specific breakdown (not just generic Linux advice). ==== What it is ==== * Traditional disk partitions (e.g. /, /boot, maybe /home) * Usually formatted as ext4 ===== - Simplest & most robust ===== * Very predictable behavior * Lowest risk of installer bugs or edge cases * Easier manual recovery from a live USB * Slightly lower overhead → marginally better performance ===== - Inflexible - Hard to resize later - No snapshots ===== * Disk space allocation is fixed at install time ===== - Almost none ===== * If you mis-size a partition, fixing it later can be painful ===== - First-time Qubes users ===== * Laptops where reliability matters * Systems without huge storage needs * Anyone who values stability over features ==== What it is ==== * Disk → LVM Physical Volume → Volume Group → Logical Volumes * Usually with ext4 on top * Qubes traditionally uses LVM ===== - Flexible resizing - Grow/shrink volumes later ===== * Clean separation: - dom0 - VM storage - swap * Well-tested with Qubes * Easier disk replacement or migration * Can be combined with full disk encryption (LUKS) cleanly ===== - More complex than plain partitions ===== * Slight learning curve if you ever manage it manually ===== - Very low ===== * If LVM metadata gets corrupted (rare), recovery is harder than plain partitions * Still far safer than Btrfs in Qubes ===== - Most users ===== * Anyone who might: - Add disks later - Resize VM storage - Use Qubes long-term * Officially the safest “advanced” option 🟢 This is the option most Qubes developers expect you to use ==== What it is ==== * Copy-on-write filesystem with snapshots, subvolumes, compression * No LVM needed (Btrfs manages space internally) ===== - Snapshots (rollback system state) ===== * Easy resizing * Built-in checksums (detects silent data corruption) * Compression can save disk space * Fast cloning of data ===== - Not fully mature in Qubes ===== * Snapshots do NOT integrate cleanly with Qubes VM model * Harder to debug when something goes wrong * Higher RAM usage * Copy-on-write can hurt performance in VM-heavy workloads ===== - Recovery is much harder than ext4/LVM ===== * Btrfs + Qubes has had historical edge cases * If dom0 Btrfs breaks → system is often unrecoverable * Snapshots can give a false sense of safety ===== - You’re new to Qubes ===== * This is your main machine * You don’t already know Btrfs internals ===== - Advanced users ===== * Experimentation * Secondary/test systems * People who already trust Btrfs and accept risk ==== | | | | | ==== | --- | --- | --- | --- | | | | | | | | | | | | | | | | | | | | | Qubes security comes from VM isolation, not fancy filesystems — stability matters more than features. ==== For 99% of Qubes users: ==== : If you want maximum simplicity: : Avoid Btrfs unless you know exactly why you want it. If you want, tell me: * SSD or HDD? * Disk size? * Laptop or desktop? * Do you plan full-disk encryption? I can give you an optimal partition/LVM layout tailored to your setup. === User: Thanks! === Thanks! I have -Thinkbook 13X G4 IMH -m.2 2240 drive 1 TB I plan full encryption, BUT I'd like to have like a >700 GB unencrypted volume for occasional movies/series, how can I do that? Also what does Attack surface mean? Why is simple partition better than LVM2? Isn't it supposed to be less advanced/secure? Also, can I set up some reliable snapshots of cubes or even the core system in LVM2? === Assistant: Great questions — you’re thinking about exactly the right trade-offs for Qubes 👍 === Great questions — you’re thinking about exactly the right trade-offs for Qubes 👍 I’ll go step by step and keep it practical + security-accurate, not hand-wavy. === This is absolutely possible and fairly clean in Qubes. === ==== You have: ==== * ThinkBook 13X G4 * 1 TB NVMe 2240 SSD (fast, but space-constrained thermally → keep it simple) ===== - ~250–300 GB ===== * LUKS → LVM2 → ext4 * Contains: - dom0 - all VMs - swap ===== - ~700–750 GB ===== * Plain partition * ext4 or exFAT ==== ### ==== When Qubes installer asks about storage: # Create two partitions - nvme0n1p1 → Qubes system (encrypted) - nvme0n1p2 → Media (unencrypted) # On p1: - Enable LUKS encryption - Inside LUKS → LVM2 Volume Group # On p2: - Format as: - ext4 → Linux-only - or exFAT → also readable from Windows ⚠️ Do not put media inside dom0 directly. ==== ### ==== Mounting it in dom0 and browsing files there. ===== 1. Create a dedicated AppVM (e.g. media-vm) ===== # Attach the unencrypted partition only to that VM # Play videos inside that VM This keeps: * dom0 clean * untrusted media isolated You can even create: * media-online VM (networked) * media-offline VM (no network) === Attack surface = how much code exists that could be exploited === More layers → more bugs → more potential exploits. ==== ### ==== * Kernel code: filesystem only * Very mature * Minimal metadata * Almost no background logic ➡️ Smallest attack surface ===== Adds: ===== * Device mapper * Volume metadata * Mapping logic But: * Used for ~20 years * Well audited * Mostly inactive after boot ➡️ Slightly larger surface, still very safe ===== Adds: ===== * Copy-on-write * Snapshots * Compression * Checksumming * Background balancing * Much more kernel code ➡️ Largest attack surface Not “insecure”, but: * More bugs historically * More recovery complexity * More kernel exposure ===== : ===== LVM: * Does not weaken encryption * Does not reduce VM isolation * Only adds complexity, not vulnerability in practice Qubes developers explicitly support and expect LVM. === ## === * dom0 live system * Running AppVM disks * Whole-system rollback like Timeshift Why? * Qubes uses: - Multiple VM disks - Xen - Heavy IO concurrency * LVM snapshots here = crash-prone & inconsistent ==== ### ==== Qubes already provides: * VM snapshots * Disposable VMs * Template-based rollbacks This is far safer than filesystem snapshots. ===== Possible but risky: ===== * Offline snapshot of shut down VM * Backup before system upgrade Requires: * dom0 expertise * booting from rescue media * Manual restore ⚠️ Not recommended as daily safety net ==== | | | ==== | --- | --- | | | | | | | | | | | | | Qubes is designed so that: : === ### === * Encrypted LUKS + LVM2 for Qubes * Separate unencrypted ext4/exFAT partition for media ===== - Media partition attached to media AppVM ===== * Not dom0 ===== - Btrfs on dom0 ===== * Snapshotting live dom0 * Mounting untrusted media in dom0 If you want, I can: * Draw an exact partition table * Give installer click-by-click steps * Show how to attach the media partition to a VM * Suggest filesystem (ext4 vs exFAT) based on your use Just tell me 👍 === User: If I set up 3 partitions 200GiB LVM2 for system, 700GiB ext4 for media and the rest 53,87GiB exfat/ntfs which one shoul… === If I set up 3 partitions (200GiB LVM2 for system, 700GiB ext4 for media and the rest ~53,87GiB exfat/ntfs (which one should I choose and why?)), can I easily resize it later, add other partitions and so on? If no, is there a way to add unencrypted storage in the LVM2? What is LUKS? === Assistant: Excellent, now you’re down to the real storage-design questions 🙂 === Excellent, now you’re down to the real storage-design questions 🙂 I’ll answer in the same order and be very concrete. === Short answer: yes, but with different levels of pain depending on the layer. === ==== <syntaxhighlight>| 200 GiB | 700 GiB | ~54 GiB | ==== | LUKS+LVM | ext4 | exFAT/NTFS | </syntaxhighlight> ===== - Easy ===== * Tools: gparted, parted * Can grow or shrink (shrinking requires filesystem check) * Very reliable ===== - Limited ===== * Growing: usually OK * Shrinking: often requires backup + recreate * Tools are worse than ext4 ===== - Growing: OK ===== * Shrinking: OK-ish * Linux tools are mature * But NTFS brings other issues (see below) ===== This is where LVM shines. ===== You can: * Resize logical volumes easily * Add new logical volumes * Add more encrypted storage inside LUKS * Move space between system/VM storage But: * The outer partition (the LUKS container) must still have free space to grow ==== You cannot magically take space from an unencrypted partition and add it into an already-encrypted LUKS container without moving partitions around. ==== That means: * Shrink unencrypted partition * Move it on disk * Grow LUKS partition * Grow LVM PV * Grow logical volume ➡️ Possible, but not fun === ### === LVM itself: * Does not encrypt * Everything inside a Volume Group shares the same encryption state If the PV is inside LUKS → everything in that VG is encrypted If the PV is unencrypted → everything is unencrypted ==== You can do this: ==== <syntaxhighlight>VG_ENC (inside LUKS) ├─ root ├─ var ├─ swap └─ vm-pool VG_CLEAR (no LUKS) └─ media </syntaxhighlight> ===== - Partition A → LUKS → LVM → Qubes system ===== * Partition B → LVM (no LUKS) → media LV ===== - Flexible resizing within each VG ===== * Cleaner than raw partitions * Still simple conceptually ===== - Slightly more complex installer setup ===== * Still can’t move space between encrypted ↔ unencrypted without repartitioning === ### === Use exFAT unless you ''specifically'' need NTFS ====== - Very simple filesystem ====== * Native Linux support * Low overhead * No journaling → less write amplification * Works perfectly with: - Windows - Linux - macOS * Ideal for “scratch / exchange” storage ====== - No permissions ====== * No journaling (less crash-safe) * Not ideal for important data ===== Choose NTFS only if: ===== * You need Windows ACLs * You need files >4 GB (exFAT also supports this) * You plan to dual-boot Windows ====== - Much more complex driver ====== * More kernel attack surface * Slower metadata ops * Occasional mount issues after improper shutdowns ➡️ NTFS is overkill here ===== | | | ===== | --- | --- | | | | | | | | | | === LUKS = Linux Unified Key Setup === It is: * A full-disk encryption standard * Uses strong crypto (AES-XTS by default) * Implemented in the Linux kernel ===== - Encrypts an entire block device (partition, disk) ===== * Everything inside looks like random data when locked * Protects against: - Stolen laptop - Offline disk access ===== <syntaxhighlight>[ Disk / Partition ] ===== ↓ LUKS ↓ (decrypted view) ↓ LVM / FS </syntaxhighlight> ===== - Multiple passphrases ===== * Key rotation * Hardware acceleration (AES-NI) * Well audited and widely trusted Qubes strongly recommends LUKS. === ### === <syntaxhighlight>| 300 GiB | 700 GiB | | LUKS+LVM | ext4 | </syntaxhighlight> Skip the small exFAT unless you truly need it. ===== <syntaxhighlight>| 300 GiB | 600 GiB | 100 GiB | ===== | LUKS+LVM | ext4 | exFAT | </syntaxhighlight> === ✔️ Use LUKS + LVM2 for Qubes === ✔️ Use ext4 for media ✔️ Use exFAT for small exchange partition ✔️ Keep unencrypted storage outside LUKS ✔️ Accept that encrypted ↔ unencrypted resizing is possible but painful If you want, next I can: * Propose exact partition sizes * Walk through the Qubes installer screens * Show how to attach media/exFAT partitions to AppVMs * Help you decide if the 3rd partition is even worth it Just say the word 👍 === User: How much GiB of storage is needed for one cube if we ignore the size of the programs inside? === How much GiB of storage is needed for one cube if we ignore the size of the programs inside? === Assistant: Good question — this gets to the heart of how Qubes actually stores things. === Good question — this gets to the heart of how Qubes actually stores things. I’ll give you realistic numbers, not marketing ones, and explain why. ==== For one AppVM (“qube”), ignoring user data and installed programs: ==== : That’s the baseline storage footprint of an AppVM. ==== In Qubes, an AppVM’s disk is layered: ==== ===== - Shared ===== * Stored once, no matter how many AppVMs use it * Does not count per qube ➡️ 0 GiB per qube ===== This is the main per-qube cost. ===== Typical size: * Default: 2 GiB * Actually used on disk (empty): ~300–600 MiB * Grows as you add files Contains: * /home/user * App settings * Browser profiles * Downloads (unless redirected) ===== - Ephemeral ===== * Backed by sparse storage * Typically <100 MiB when idle * Discarded on shutdown (unless persistent) ===== - VM config ===== * Device mapping * Xen bookkeeping ➡️ ~50–150 MiB ==== | | | ==== | --- | --- | | | | | | | | | | | | | Rounded up safely: : ==== Because: ==== * Default private.img limit = 2 GiB * People leave browser cache / downloads there * Safety margin But the actual disk usage is usually lower. ==== Templates are the real storage users. ==== Typical TemplateVM sizes: * debian-12: ~4–6 GiB * fedora-39: ~6–8 GiB But: * Each template is stored once * Shared by unlimited AppVMs ==== Let’s say: ==== * 3 templates → ~20 GiB * 30 AppVMs → ~30 GiB * dom0 → ~5–8 GiB ➡️ ~60 GiB total for a very VM-heavy setup Plenty of headroom. ==== ### ==== * Leave private.img at 2 GiB * Increase only for specific qubes (browsers, dev) ===== - Media → media qube ===== * Downloads → dedicated storage qube * Dev builds → separate work qube ==== - Baseline per qube: ~1 GiB ==== * Configured limit: usually 2 GiB * Templates dominate storage * Qubes scales very well in storage usage If you want, next I can: * Estimate how many qubes you can realistically run * Suggest which qubes need larger private storage * Help you pre-plan LVM logical volume sizes Just tell me 👍 === User: If I want to use Qubes mainly for sorting stuff school/job/music/nature/sports/fitness ect, how much storage would you … === If I want to use Qubes mainly for sorting stuff (school/job/music/nature/sports/fitness ect), how much storage would you recommend? === Assistant: Short answer first, then the reasoning. === Short answer first, then the reasoning. : That gives you a lot of headroom and stays comfortable for years. ==== You described: ==== * school * job * music * nature * sports * fitness That maps very cleanly to separate AppVMs, which is exactly what Qubes is good at. Let’s estimate conservatively. ==== You’ll realistically need: ==== | | | | --- | --- | | | | | | | | | | ➡️ ~15–20 GiB total ==== Let’s assume: ==== * 6–8 AppVMs (school, job, music, fitness, etc.) Baseline: * ~1 GiB per qube ➡️ ~8 GiB ==== Typical sizes: ==== * PDFs, DOCX, notes → tiny * Even thousands of files → a few GB Let’s be generous: * 20–30 GiB ==== - dom0 root ==== * logs * updates * metadata ➡️ ~6–8 GiB ==== Qubes upgrades, temp files, future qubes, mistakes. ==== ➡️ +20–30 GiB ==== | | | ==== | --- | --- | | | | | | | | | | | | | | | | | | | ==== ### ==== : ===== : ===== ===== : ===== Since you have a 1 TB NVMe, there’s no reason to go tight. ==== Given your earlier plan: ==== * Qubes encrypted system: 150–200 GiB * Unencrypted media: 700+ GiB This: * Avoids future resizing pain * Lets you add more qubes freely * Costs you nothing on a 1 TB disk ==== ### ==== * school * work * music * fitness * personal ===== - Explicit moves = better mental model ===== * Less accidental data leaks ===== - Encrypted ===== * No network * Important documents only ==== : ==== You’ll never worry about space again. If you want, I can: * Suggest a qube layout by category * Show how to move files safely between qubes * Help design a vault + backup strategy Just tell me 😊 === User: Please show me how to move files safely between cubes/other partitions/external drives, how vaulg works and how to use … === Please show me how to move files safely between cubes/other partitions/external drives, how vaulg works and how to use it, how should I set up automatic backups (ideally in a way when they will automatically start when I connect either a drive or a NAS) and anything else you think I might need. === Assistant: Great — this is exactly the “daily-ops” knowledge that makes Qubes pleasant instead of frustrating. === Great — this is exactly the “daily-ops” knowledge that makes Qubes pleasant instead of frustrating. I’ll keep it practical, step-by-step, and aligned with how Qubes is meant to be used. === ## === This is the safest and most common method. ===== - One-way copy ===== * Explicit user action * No shared filesystem * Minimal attack surface ===== 1. In the source qube, select file(s) ===== # Right-click → Copy to other AppVM # Choose destination qube # Files appear in: ``<code> ~/QubesIncoming/<source-qube>/ <syntaxhighlight> ===== - Documents ===== * PDFs * Music files * Anything you want to keep ✅ This is what you should use 90% of the time ==== ### ==== * Explicit copy → explicit paste * Auto-clears after timeout ===== - Ctrl+C in source qube ===== * Ctrl+Shift+C (global) * Switch qube * Ctrl+Shift+V ===== - Passwords ===== * URLs * Short notes ❌ Don’t use for files ❌ Don’t leave sensitive data sitting there ==== Avoid unless you fully understand the risk ==== Why? * Continuous access * Larger attack surface * Easy data leaks If you must use them (e.g. dev work), keep them: * Temporary * Read-only if possible * Never involving Vault or dom0 === Qubes handles this very safely via block device attachment. === ==== ### ==== * Device is never exposed to dom0 filesystem * Attached to a dedicated qube * You control read/write explicitly ===== Create a qube called: ===== </syntaxhighlight> sys-usb (already exists) backup-vm (for backups) media-vm (for movies/music) </code>`` ===== 1. Plug in USB drive ===== # Qubes popup appears # Attach device to: - backup-vm (for backups) - media-vm (for media) # Mount inside that qube # Copy files normally Dom0 never touches the filesystem contents. ==== Same process: ==== * Attach the block device to media-vm * Mount it there * Use it like a normal disk === ## === A high-security AppVM designed for: * Passwords * Important documents * Keys * Personal identity data ===== - ❌ No network ===== * ❌ No USB * ❌ No shared folders * ✅ Encrypted at rest (via LUKS) ==== 1. Create new AppVM: - Name: vault - Networking: None ==== # Increase private.img if needed (5–10 GiB is plenty) # Never install browsers # Use only: - File manager - Password manager (KeePassXC is common) ==== ### ==== * From other qube → Copy to other AppVM → vault * Appears in ~/QubesIncoming/ ===== - Only copy specific files ===== * Never bulk export ==== : ==== === Qubes has a built-in backup system. Use it. === ==== - Backups are offline snapshots ==== * VM-level, not filesystem-level * Strong encryption * Consistent state This avoids snapshot corruption problems. ==== ### ==== * backup-vm (network optional) * External USB drive or * NAS (via network) ==== Always enable: ==== * Backup encryption * Strong password * Separate from disk LUKS password ==== - ✔ Vault ==== * ✔ Personal/work qubes * ✔ Templates * ❌ Disposable qubes * ❌ sys-usb / sys-net ==== Qubes does not auto-backup on plug-in by default, but you can get 90% there safely. ==== ===== 1. Plug in backup drive ===== # Attach to backup-vm # Run backup from Qubes menu # Done Takes ~1–2 minutes when practiced. ===== In backup-vm: ===== * Create a script that: - Detects mounted backup drive - Runs qvm-backup Then: * You manually trigger it (one click) * Much safer than full automation ===== - Attach network to backup-vm ===== * Mount NAS share * Backup target = mounted share Works very well, especially scheduled weekly. ==== | | | ==== | --- | --- | | | | | | | | | | | | | === ## === Use for: * Random PDFs * Unknown websites * Email attachments Nothing persists → zero cleanup. ==== - Browsing happens here ==== * Files only moved out deliberately ==== Example: ==== * personal * untrusted * vault * media * work Helps avoid mistakes. ==== - ❌ Mounting USB in dom0 ==== * ❌ Browsing from Vault * ❌ Shared folders everywhere * ❌ Assuming backups without testing restore === - File copy > shared access === * Vault = one-way sink * Backups are VM snapshots * Dom0 stays boring and empty * Explicit actions = security If you want next, I can: * Give you a recommended qube layout * Show exact commands for backups * Help you design a NAS backup workflow * Suggest password manager setup inside Vault Just tell me what you want to tackle next 👍 === User: Thank you, I'll look into it later, now I need to install the system first 😅 === Thank you, I'll look into it later, now I need to install the system first 😅 What is the difference between luks1 and luks2? is 2 just newer better...? Sector size: automatic/512/4096 PE Size: 2^1 - 2^6, default is 2^2 so 4 MiB what to choose? === Assistant: Totally fair 😄 — install first, tune later is the right mindset. === Totally fair 😄 — install first, tune later is the right mindset. I’ll give you clear “pick this” answers, with just enough explanation so you know why. === ## === : Yes — it really is “newer and better” in a meaningful way, and Qubes supports it well. ==== | | | | ==== | --- | --- | --- | | | | | | | | | | | | | | | | | | | | | | | | | ===== - Argon2 protects against GPU/ASIC brute-force attacks ===== * More robust metadata layout * Easier future upgrades * Actively maintained ===== - Ancient bootloaders ===== * Very old Linux kernels * Dual-boot with legacy tools ➡️ None of that applies to Qubes. ==== LUKS2 does not reduce compatibility with: ==== * LVM * ext4 * Qubes boot flow === ## === : ==== - Your NVMe is 4K physical sectors ==== * The kernel knows this * LUKS will align correctly Forcing: * 512 → pointless * 4096 → can cause weird alignment issues with some tools Automatic is: * Optimal * Safest * Default for a reason === This affects how LVM allocates space. === Default shown: : ==== : ==== ==== - LVM divides storage into chunks called extents ==== * Logical volumes are built from these extents ==== - Good balance: - Flexibility - Performance ==== * Fine-grained resizing * Negligible overhead * Default for almost all installs ==== | | | ==== | --- | --- | | | | | | | | | | Changing it gives you no benefit here. === ✔ LUKS version: LUKS2 === ✔ Sector size: Automatic ✔ PE size: 2² = 4 MiB ✔ Filesystem: ext4 ✔ Volume type: LVM2 === When the installer asks: === : ✔ Use manual partitioning ✔ Create your unencrypted media partition now ✔ Don’t plan to “fix it later” — resizing encrypted layouts is annoying You’re making all the right calls so far 👍 Install it, get it booting, and when you’re back: * I’ll help you verify encryption * Set up media + vault + backups * Tune templates & qubes Good luck with the install — you’ve got this 😄 === User: "Filesystem: ext4" === "Filesystem: ext4" emm small issue - there is no option for filesystem. help === Assistant: No worries — this is normal in the Qubes installer. === No worries — this is normal in the Qubes installer. You didn’t miss anything 👍 This trips up a lot of people. ==== In Qubes OS, when you choose: ==== * LUKS encryption * LVM2 volume group the installer automatically uses ext4 for: * dom0 root * VM storage volumes 👉 There is no manual filesystem chooser for these volumes in the GUI. This is intentional. ==== When you select: ==== <syntaxhighlight>LUKS2 → LVM2 </syntaxhighlight> Qubes creates (simplified): <syntaxhighlight>/dev/nvme0n1pX └─ LUKS (encrypted) └─ LVM VG ├─ root → ext4 ├─ var → ext4 ├─ swap └─ qubes_dom0 → ext4 </syntaxhighlight> All relevant filesystems are ext4 by default. You only get filesystem choice when: * Creating unencrypted custom partitions * Or using Btrfs (which you are not) ==== ### ==== For example: * Media partition → ext4 * Exchange partition → exFAT Those options appear because: * They’re outside the Qubes-managed encrypted stack ==== Yes — 100%. ==== For Qubes: * ext4 is the most tested * Lowest risk * Best recovery story * Best performance under VM-heavy workloads There is no benefit to XFS/Btrfs here. ==== After install, in dom0 terminal: ==== <syntaxhighlight lang="bash">lsblk -f </syntaxhighlight> You’ll see: <syntaxhighlight>ext4 / (dom0) ext4 /var/lib/qubes </syntaxhighlight> So you can confirm everything. ==== - ❌ You didn’t miss a menu ==== * ✅ ext4 is automatically used * ✅ This is the safest and intended setup * ✅ You’re doing it right Finish the install 👌 When it boots successfully, come back and we’ll do: * first boot sanity checks * verify encryption * attach your media partition safely You’re on the home stretch 😄 === User: I think I explained it wrong, wait... === I think I explained it wrong, wait... I selected encrypt WHEN creating the LVM2, so the rest has to be unencrypted. I just didn't manually create the ESP and Swap, soo do I guess I should make them both manually? and Swap should have the same size as my RAM, right? Does it have to be precise or can I just put 33GiB there for 32GB RAM and be good to go? Can I easily swap between Wayland and Xfce? And one extra question: Is there ever any reason to create LVM2/btrfs volume, and then inside create another volume, and another one inside... all either encrypted or unencrypted? === Assistant: Great, thanks for the clarification — that helped a lot. === Great, thanks for the clarification — that helped a lot. I’ll go step-by-step, very explicitly, and I’ll also explain why things work the way they do in Qubes, not just what to click. You’re actually very close now. === ### === ESP = EFI System Partition * Required for UEFI boot * Must be unencrypted * FAT filesystem (vfat) * Usually 300–600 MiB * Mounted at /boot/efi UEFI firmware cannot read LUKS, so if ESP is inside encrypted LVM → boot is impossible That error message: : means: 👉 Anaconda (installer) tried to put ESP inside encrypted LVM 👉 That is not allowed ==== On your 1 TB NVMe: ==== <syntaxhighlight>/dev/nvme0n1 ├─ ESP 500 MiB vfat UNENCRYPTED ├─ Qubes_LUKS 150 GiB luks2 │ └─ LVM VG "Notebook" │ ├─ root │ ├─ var │ ├─ swap │ └─ qubes-vm-pool ├─ Media ~700 GiB ext4 UNENCRYPTED └─ Exchange ~50 GiB exFAT UNENCRYPTED </syntaxhighlight> ==== ### ==== You already did this ✔ ===== 1. Select your disk (nvme0n1) ===== # Create new partition: - Size: 500 MiB - Type: EFI System Partition - Filesystem: vfat - Mount point: /boot/efi - ❌ DO NOT encrypt This fixes your installer error. ===== 1. Create new partition: - Size: 150 GiB - Type: Physical Volume (LVM) - ✔ Encrypt - Encryption: LUKS2 ===== # Create Volume Group: - Name: Notebook ⚠️ Do NOT manually create logical volumes inside Qubes does this automatically. ===== You have 32 GB RAM. ===== Qubes recommendation: * If you want hibernate → swap ≥ RAM * If no hibernate → 8–16 GB is fine ✔ Your idea is correct: : Steps: * New partition * Type: swap * Size: 33 GiB * ❌ unencrypted is OK (or encrypted if you want) ===== #### ===== * ext4 * Unencrypted * Can be resized later ✔ ====== Choose: ====== * exFAT ✅ recommended * NTFS is worse on Linux (journaling overhead, permissions weirdness) If exFAT doesn’t appear: * Choose unformatted * Reformat later with: <syntaxhighlight lang="bash">mkfs.exfat /dev/nvme0n1pX </syntaxhighlight> === ✔ Does NOT need to be exact === For 32 GB RAM: * 32–36 GB → perfect * 33 GB → totally fine Linux doesn’t care about precision here. === Short answer: Almost never === ===== - Separate encryption domains ===== * Different snapshot policies * Multi-OS servers * ZFS-on-LUKS-on-LVM (admins only) ===== - Complexity explodes ===== * Recovery becomes painful * No security gain in Qubes * Qubes already layers: - Xen → LUKS → LVM → VM volumes ✔ One encrypted LVM is correct === ### === Garuda Dragonized Gaming uses: * KDE Plasma * Wayland (by default) ===== #### ===== * X11-based * Extremely stable * Well-integrated with Qubes security model * Clipboard isolation works perfectly * Recommended ====== - Keyboard-driven tiling ====== * Very fast * Still experimental in Qubes * Clipboard + window isolation less mature ===== ✔ Yes: ===== * Install Sway later * Choose session at login 👉 Install Xfce only for now === ❌ Do NOT enable root === Qubes design: * Admin actions via sudo * Root login disabled reduces attack surface * This is intentional ✔ Leave it disabled === Attack surface = how many ways an attacker can get in === More complexity = more bugs = more ways in That’s why: * ext4 > btrfs * single LVM > nested LVM * fewer services > safer system This is why simple partitioning is safer, not weaker. === ### === * A normal disk partition formatted as btrfs ===== - Internal logical structure inside btrfs ===== * Like folders with snapshot ability In Qubes: * btrfs is not recommended * Snapshots don’t integrate with VM storage safely * Recovery is worse than ext4 ✔ Stick to ext4 === : === Yes — you’re absolutely right. Qubes installer assumes: * You let it auto-partition * You don’t manually mix ESP + LUKS Manual partitioning is powerful but dangerous That’s why it doesn’t protect you from foot-guns. You didn’t do anything stupid — you just went advanced too early. === ✔ ESP: 500 MiB vfat, unencrypted === ✔ LUKS2 → LVM → 150 GiB (no manual LVs) ✔ Swap: 33 GiB ✔ Media: ext4 ✔ Exchange: exFAT or unformatted ✔ Xfce only ✔ Root disabled Then Begin Installation will unlock. If you want, next we can: * verify encryption after install * mount media safely in qubes * set up automatic backups * explain VM storage math (how fast it fills) You’re doing great — this is hard mode Linux 😄 === User: I just need to clarify the difference between swap on === I just need to clarify the difference between swap on "/dev/nvme0n1" and encrypted swap in " /dev/nvme0n1 ├─ Qubes_LUKS 150 GiB luks2 │ └─ LVM VG "Notebook" │ ├─ swap " What if I have both? === Assistant: Excellent question — this is a very important distinction, and it’s good you’re clarifying it before installing. === Excellent question — this is a very important distinction, and it’s good you’re clarifying it before installing. I’ll explain it cleanly, precisely, and with consequences, then tell you what to actually do. === Swap is disk space used as: === * memory overflow (RAM pressure) * hibernation storage (RAM image written to disk) Anything in swap can contain sensitive data: * passwords * encryption keys * clipboard contents * VM memory pages So where swap lives matters a lot in Qubes. === Example: === <syntaxhighlight>/dev/nvme0n1pX swap UNENCRYPTED </syntaxhighlight> ===== - Raw swap partition ===== * Firmware + OS can access it without password * Survives reboots (unless wiped manually) ===== - If attacker steals your laptop → swap can be read ===== * VM memory pages may leak * Breaks Qubes threat model for high-risk users ===== - Desktop PC ===== * No sensitive data * No travel / theft risk 👉 Not recommended for Qubes === Example: === <syntaxhighlight>/dev/nvme0n1 └─ Qubes_LUKS (locked at boot) └─ LVM VG "Notebook" └─ swap </syntaxhighlight> ===== - Swap exists inside encrypted container ===== * Unreadable without passphrase * Automatically unlocked at boot ===== - Safe against disk theft ===== * VM memory protected * Matches Qubes security assumptions 👉 This is the correct choice === Linux can use multiple swap devices simultaneously. === Example: <syntaxhighlight lang="bash">swapon --show </syntaxhighlight> Output: <syntaxhighlight>/dev/dm-1 33G 0B -2 /dev/nvme0n1p7 16G 0B -3 </syntaxhighlight> ===== - Uses both ===== * Prefers one based on priority * Memory pages can land on either ===== - Sensitive data may spill into unencrypted swap ===== * You lose the security benefit * Hard to reason about what’s protected 👉 Having both is actively dangerous === Qubes: === * Assumes swap is secure * dom0 + VMs may swap * Some VM memory pressure will hit swap If any swap is unencrypted, Qubes can leak secrets there. === ### === * One swap only * Inside encrypted LUKS/LVM * Size: - No hibernate → 8–16 GiB - Hibernate → RAM size or more ===== - Create extra swap partitions ===== * Mix encrypted + unencrypted swap * Use swapfiles on unencrypted FS === You have: === * 32 GB RAM * Laptop * Encryption-focused install 👉 Recommendation: <syntaxhighlight>Encrypted swap inside LUKS/LVM Size: 32–33 GiB No other swap anywhere </syntaxhighlight> Let Qubes create it automatically inside the encrypted VG. === - Swap = memory === * Memory = secrets * Secrets must be encrypted * One swap only If you want, next we can: * verify swap encryption after install * tune swappiness for Qubes * decide whether you even need swap with 32 GB RAM You’re asking exactly the right questions 👍 === User: Soo I have 3 options for storage configuration: === Soo I have 3 options for storage configuration: -Automatic -Custom -Advanced Custom (Blivet-GUI) When I think about it I should've tried the Custom one first... Anyway, after "deleting" (not yet just pending operation) all partitions, I can choose between LVM and LVM Thin Provisioning. Which one should I choose? Also, does the Advanced Custom have any benefit? from what I can see after clicking "Click here to create them automatically", I can still edit them. Soo I just have an additional template? === Assistant: You’re thinking about this exactly the right way now. === You’re thinking about this exactly the right way now. Let’s straighten this out cleanly so you can pick once, confidently, and move on. ==== ### ==== * Qubes decides everything * Encrypted LUKS2 * LVM Thin * Sensible sizes * Lowest risk * Least control 👉 Best if you don’t care about unencrypted media partitions. ===== - Semi-guided ===== * You choose LVM vs LVM Thin * You choose encryption * Qubes still creates correct layout * Good balance 👉 This is what you should use. ===== - Full manual control ===== * No guard rails * Easy to break EFI / encryption / boot * Needed only for: - Multi-disk - Dual-boot - Special layouts - Separate unencrypted partitions (your case) 👉 Only use Blivet if you need custom unencrypted partitions ==== This choice matters. ==== ==== ### ==== * Volumes are fully allocated upfront * Disk space reserved immediately ===== - Extremely reliable ===== * Simple recovery * Predictable behavior * Fewer edge cases ===== - Less flexible ===== * Slightly less space-efficient ==== ### ==== * Volumes grow on demand * Space is shared dynamically * VM disks are sparse ===== - Recommended by Qubes ===== * Efficient storage usage * Fast VM creation * Snapshot-friendly * Standard Qubes setup ===== - More complex internally ===== * If pool fills → VMs pause * Requires monitoring free space ==== 👉 LVM Thin Provisioning ==== This is: * What Qubes expects * What qubes-dom0 tooling assumes * What documentation is written for Choosing classic LVM gains you nothing here. ==== Security concern myth: ==== : Reality: * LVM thin runs in dom0 kernel * Attackers don’t get dom0 anyway * Risk is negligible * Benefit is huge (VM storage efficiency) Qubes devs explicitly design for LVM Thin. ==== You observed something important. ==== ===== When you click: ===== : Blivet: * Generates the same layout as Custom * But exposes it visually * Lets you edit before commit ===== - You can: - Add unencrypted partitions - Resize system LVM - Verify ESP location ===== * No functional difference otherwise ===== - You can accidentally: - Encrypt ESP - Delete boot - Create multiple swaps - Break alignment ===== ==== You want: ==== * Encrypted system * Unencrypted media * Correct Qubes layout * Minimal pain ===== 1. Choose Advanced Custom (Blivet-GUI) ===== # Delete all partitions # Manually create: - ESP (500 MiB, vfat, unencrypted) # Click Create automatically # Choose: - Encryption: ON - LVM Thin Provisioning # Resize the encrypted VG to ~150 GiB # Create unencrypted media + exchange partitions # Do not touch internal LVs This gives you: * Safety of automatic layout * Control where you need it * No EFI/LUKS issues ==== ✔ LVM Thin, not classic ==== ✔ One encrypted VG only ✔ ESP outside encryption ✔ No extra swap ✔ Media unencrypted ==== - Choose LVM Thin Provisioning ==== * Advanced Custom only because you need extra partitions * “Create automatically” is safe — think of it as a template you can edit * You’re now making correct, informed choices If you want, next we can: * check final layout before clicking Begin Installation * explain how Qubes uses thin pools internally * or finally get this thing installed 😄 === User: in Custom, It created 4 things /boot/efi, /boot, /, swap. === in Custom, It created 4 things (/boot/efi, /boot, /, swap). Each one has a Device Type and File System: efi has standart partition and efi system partition boot has standard partition and ext4 / has LVM Thin Provisioning and ext4, encrypted swap has LVM and swap, encrypted I have many questions: # I can't find LVM Thin in custom advanced anywhere. Why? # to be able to use hibernation, I have to increase swap to 33, right? # I have the ability to add a new mountpoint, I can select /home, /var and swap, but they are all encrypted and under qubes-dom0 soo again, how to get unencrypted partitions outside qubes-dom0 and thin provisioning together? is it possible? === Assistant: You’re not crazy — what you’re seeing is exactly how the Qubes installer is designed, and the confusion comes from a re… === You’re not crazy — what you’re seeing is exactly how the Qubes installer is designed, and the confusion comes from a real limitation / design choice, not from you missing a button. I’ll answer your 3 questions directly, then give you the one correct mental model that makes everything click, and finally tell you the only two ways to get what you want. ==== Qubes supports LVM Thin Provisioning only for the Qubes-managed storage pool. ==== That pool lives inside the encrypted qubes-dom0 LVM. Everything outside that pool: * is not managed by Qubes * is not thin-provisioned * must be created as normal disk partitions There is no supported way to mix: : from the Custom screen alone. That’s why you’re stuck. ==== ## ==== Because LVM Thin is not a partition type. It is: * a storage backend decision * made before partitioning * applied automatically by Qubes only to qubes-dom0 ===== - In Custom → storage configuration choice ===== * Internally, for: - / (dom0 root) - VM volumes - template/app qubes ===== - Blivet Advanced GUI ===== * Manual partition creation * Extra mountpoints So: * You are not supposed to create thin pools manually there * Qubes does it for you after you choose “LVM Thin Provisioning” 👉 This is by design, not a bug. ==== Yes — and this part is simple. ==== You have 32 GiB RAM. To hibernate: * swap ≥ RAM * encrypted * accessible early in boot ✔ 33 GiB encrypted swap inside qubes-dom0 is perfect If swap is smaller: * hibernation will fail * system resumes from cold boot ==== This is the core question, and the answer is: ==== ===== Custom mode: ===== * Controls only the Qubes system * Everything it creates belongs to qubes-dom0 * Everything under it is encrypted * Everything uses thin provisioning That’s why: * /home, /var, /swap → all encrypted * No option for “unencrypted media” here ==== There are only two valid ways. ==== === You were almost there before — you just needed this rule: === : ===== 1. Choose Advanced Custom (Blivet-GUI) ===== # Delete everything # Manually create: - ESP - 600 MiB - vfat - /boot/efi - unencrypted - /boot - 1 GiB - ext4 - unencrypted - Media partition - ~700 GiB - ext4 or unformatted - unencrypted # Leave unallocated space (~150 GiB) # Select that free space → Create automatically # Choose: - ✔ Encryption - ✔ LVM Thin Provisioning What happens: * Qubes creates: - LUKS2 - LVM VG - Thin pool - dom0 root - encrypted swap * Your media partition stays untouched and unencrypted This does work, but only if you let Qubes create the thin pool itself. === 1. Choose Automatic === # Enable: - Encryption - LVM Thin # Install # After install: - Boot live Linux - Shrink the encrypted VG - Create unencrypted media partition in freed space This is safer for beginners but requires post-install resizing. ==== Qubes assumes: ==== * dom0 is sacred * VM storage must be managed centrally * Thin provisioning must be 100% predictable Allowing users to: * add arbitrary thin LVs * mix encryption domains * mount unencrypted volumes inside dom0 would: * break the threat model * create footguns * make support impossible So the installer is intentionally restrictive. ==== 1️⃣ You can’t find LVM Thin in Advanced because it’s not a partition option ==== 2️⃣ Yes, 33 GiB encrypted swap is correct for hibernation 3️⃣ Unencrypted partitions must be outside qubes-dom0, created manually before Qubes creates its thin pool If you want, next I can: * draw the exact final disk layout in ASCII * give you a “click-by-click” checklist for Blivet * explain how to safely mount the unencrypted media in Qubes later Just tell me 👍 === User: is there any real difference between esp - /boot - media - LVM and esp - /boot - LVM - media? === is there any real difference between esp - /boot - media - LVM and esp - /boot - LVM - media? I just like the second one better... Also I really don't wanna mess this up, can you please explain in detail the esp and boot creation? you told me to pick vfat as system partition for esp, right? What about efi system partition? isn't it made for this? I have: Filesystem Label Mountpoint Please explain what to type where === Assistant: Great questions — this is the last confusing bit, and once it clicks you’ll be able to install without fear. === Great questions — this is the last confusing bit, and once it clicks you’ll be able to install without fear. I’ll go slow and very explicit, exactly as you asked. === ### === ===== ### ===== No functional difference at all. Linux does not care about physical order on disk. The only hard rules are: * ESP must be unencrypted * /boot must be unencrypted * LVM must not include ESP or /boot * Media can be anywhere and unencrypted So yes — you can absolutely do: <syntaxhighlight>[ESP] [ /boot ] [ LVM (encrypted) ] [ media ] </syntaxhighlight> If you like that layout better, use it 👍 === This is critical to understand. === ==== ### ==== * Read by UEFI firmware * Contains bootloader files (.efi) * Loaded before Linux exists ===== - Unencrypted ===== * FAT filesystem * Flagged as EFI System Partition * Mounted at /boot/efi ===== - 300–600 MiB (use 600 MiB) ===== ==== ### ==== * Contains: - Linux kernel - initramfs - GRUB config * Loaded after firmware, before encrypted root ===== - Unencrypted ===== * ext4 filesystem * Mounted at /boot ===== - 1 GiB ===== ===== UEFI firmware: ===== * can read FAT * cannot read ext4 * cannot read LUKS Linux bootloader: * can read ext4 * unlocks LUKS later So: <syntaxhighlight>Firmware → ESP (FAT) Bootloader → /boot (ext4) Kernel → unlocks LUKS → root filesystem </syntaxhighlight> === This is the most common mistake. === They are not alternatives — they are both required. ===== | | | ===== | --- | --- | | | | | | | | | | | | | | | | Explanation: * vfat = filesystem format * EFI System Partition = special partition flag * You need both If you choose: * vfat + standard partition ❌ * EFI System Partition + ext4 ❌ Boot may fail. === You said the GUI has: === <syntaxhighlight>Filesystem Label Mountpoint </syntaxhighlight> ===== | | | ===== | --- | --- | | | | | | | | | | And ensure: * Device Type = EFI System Partition * Not encrypted ===== | | | ===== | --- | --- | | | | | | | | | | | | | | | | ===== You do not set filesystem here manually. ===== You set: * Device type: LVM (Thin Provisioning) * Encryption: ✔ enabled * Size: ~150 GiB Qubes will: * Create LUKS2 * Create VG * Create thin pool * Format ext4 automatically ===== Option A — format now: ===== | | | | --- | --- | | | | | | | | | | Option B — format later: | | | | --- | --- | | | | | | | | | | Both are fine. === ❌ Do NOT: === * Encrypt ESP * Encrypt /boot * Put ESP inside LVM * Put /boot inside LVM * Assign mountpoint to media in dom0 === Your final disk should look like this: === <syntaxhighlight>/dev/nvme0n1 ├─ p1 600 MiB vfat /boot/efi (ESP) ├─ p2 1 GiB ext4 /boot ├─ p3 150 GiB LUKS2 → LVM Thin → qubes-dom0 └─ p4 ~700 GiB ext4 (media, unmounted) </syntaxhighlight> === Before you click: === * ESP shows vfat, EFI System Partition, /boot/efi * /boot shows ext4, unencrypted * LVM shows encrypted, thin * Media has no mountpoint If all four are true → you are 100% safe. You are absolutely right to be cautious — this is the hard part of Qubes installation. If you want, paste the exact partition list as shown in the installer and I’ll double-check it before you click Begin Installation. === User: emm I have issue with ESP: === emm I have issue with ESP: there is no Device Type for any of the partitions, only label. Why? === Assistant: Good catch — and this explains a lot. === Good catch — and this explains a lot. You’re not missing anything; you’re just looking in the wrong screen for that option. In Anaconda/Blivet the partition “device type” (ESP flag) is not shown as a field like filesystem/label/mountpoint. It’s inferred from how you create the partition. Let me explain exactly what’s going on and how to fix it. ==== In the Blivet GUI: ==== * Filesystem / Label / Mountpoint → editable fields * Partition type (ESP / standard) → set by which “Add” action you use So if you create a “normal partition” and later set: * filesystem = vfat * mountpoint = /boot/efi …that does NOT automatically mark it as an ESP. You must create it as an EFI System Partition from the start. ==== ### ==== Make sure you’re clicking the disk, not free space inside LVM. ===== You should now see partition type options, usually something like: ===== * Standard Partition * EFI System Partition * LVM * RAID * etc. 👉 Select “EFI System Partition” here (This is where the “device type” is chosen.) ===== Once you selected EFI System Partition, now fill: ===== | | | | --- | --- | | | | | | | | | | | | | | | | Click Add. ==== After adding it: ==== * It should be listed as EFI System Partition * Filesystem: vfat * Mountpoint: /boot/efi * No encryption icon If it only says “Standard Partition”, delete it and re-create it the correct way. ==== UEFI firmware: ==== * looks specifically for partition type GUID = ESP * ignores plain FAT partitions If ESP flag is missing: * Installer may succeed * System will not boot This is why Anaconda is strict about ESP placement. ==== /boot is a normal partition, so here you do use: ==== * Standard Partition * Filesystem: ext4 * Mountpoint: /boot * Size: 1024 MiB * Unencrypted No special flag needed. ==== : ==== That’s exactly the trap: * vfat ≠ ESP * mountpoint ≠ ESP * partition type = ESP ==== - ESP is chosen when adding the partition ==== * You won’t see “Device Type” as a field * vfat + /boot/efi is not enough * Must explicitly choose EFI System Partition If you want, next you can: * describe exactly what buttons you see when clicking + * or paste the text layout shown in the installer I’ll walk you through the next click if needed — you’re very close now. === User: sorry my bad, there is Device type, but eeh... === sorry my bad, there is Device type, but eeh... As we talked about it few hours ago - there are 3 options - Partition, LVM2 Volume Ground and Btrfs Volume THERE IS NO F"ING EFI AAAAAAAA . . . help. === Assistant: 😅 breathe — you’re fine. === 😅 breathe — you’re fine. This is pure installer UI nonsense, not you doing something wrong. What’s happening is very specific to the Qubes / Anaconda version you’re using. ==== In your installer, ==== 👉 “EFI System Partition” is NOT a device type anymore That’s why you only see: * Partition * LVM2 Volume Group * Btrfs Volume This is normal. In this UI version: * ESP is defined by filesystem + mountpoint * NOT by a separate “EFI” device type Older screenshots / guides show an explicit “EFI System Partition” option — yours doesn’t have it. ==== You must create a normal Partition, and then set the correct attributes. ==== ===== 1. Select the disk (nvme0n1) ===== # Click Add # Choose: - Device type: Partition # Set these fields: ===== | | | ===== | --- | --- | | | | | | | | | | | | | | | | ⚠️ Important In your installer: * EFI System Partition appears under Filesystem, not Device Type * This filesystem choice automatically sets the correct GPT type GUID 👉 This is why you didn’t see it before. ==== - ❌ Filesystem = vfat ==== * ❌ Filesystem = FAT32 * ❌ Device type = LVM * ❌ Encryption enabled If you choose plain vfat, the installer may not flag it as ESP. ==== Create another partition: ==== | | | | --- | --- | | | | | | | | | | | | | | | | ==== Anaconda has three different ESP models depending on distro/version: ==== # ESP as a device type (old Fedora screenshots) # ESP as a filesystem (your case) # ESP auto-created only (some installers) Qubes uses #2. That’s why guides contradict each other. ==== After creation, the ESP entry should show: ==== * Filesystem: EFI System Partition * Mountpoint: /boot/efi * Not encrypted If yes → ✔ firmware will boot If not → delete and redo ==== <syntaxhighlight>nvme0n1 ==== ├─ p1 600 MiB EFI System Partition /boot/efi ├─ p2 1 GiB ext4 /boot ├─ p3 150 GiB LUKS2 → LVM Thin qubes-dom0 └─ p4 ~700 GiB ext4 / unformatted media </syntaxhighlight> ==== You did nothing wrong. ==== You didn’t miss anything. You’re just dealing with: * a security-focused distro * a half-redesigned installer * documentation from 3 different eras That combo is brutal. If you want, paste exactly what you see in the ESP row (filesystem + mountpoint), and I’ll confirm “YES this will boot” before you click Begin Installation. === User: how do I check if it will boot? === how do I check if it will boot? btw I had dual boot XOS (uncluttered windows) and garuda. Everything is backed up, even the browser that is additionally synced there was terrible clutter because, despite the vivaldi propaganda, jt starts to slow down at around 1 000 tabs. I need around 15 000 to 20 000 sorted, and I like workspaces much more than factories. Anyway... if I fuck up I can just retry, it'll just be extra hassle. Which mountpoint should I type for unencrypted media 750GiB ext4? just "/"? === Assistant: You’re good 😄 And yes — you can always retry. === You’re good 😄 And yes — you can always retry. Nothing you’re doing here can brick the hardware. Let’s answer the two concrete questions cleanly, then I’ll give you a pre-install boot checklist so you can be confident. ==== ### ==== That would overwrite the system root and break the install. ===== Leave the mountpoint EMPTY. ===== That is intentional. Why: * dom0 should not auto-mount untrusted data * You will attach/mount this partition later inside a VM (sys-usb / sys-files / personal qube) * Qubes security model expects external/unencrypted storage to be VM-mounted, not dom0-mounted ===== | | | ===== | --- | --- | | | | | | | | | | | | | This is 100% correct. ==== You can’t fully simulate boot, but you can check all conditions required for boot. ==== ===== #### ===== * Filesystem: EFI System Partition * Mountpoint: /boot/efi * Size: 300–600 MiB * Not encrypted ✔ If yes → UEFI firmware can load bootloader ====== - Filesystem: ext4 ====== * Mountpoint: /boot * Size: ~1 GiB * Not encrypted ✔ If yes → kernel + initramfs can load ====== - ESP and /boot are outside LVM ====== * LVM partition starts after them ✔ If yes → no “EFI cannot be luks” error ====== - / is assigned only to qubes-dom0 root ====== * No other partition uses / ✔ If yes → root filesystem is unambiguous ====== Top-left must say: ====== : ❌ If you still see a red warning → do not continue ==== From the installer terminal (Ctrl+Alt+F2): ==== <syntaxhighlight lang="bash">lsblk -f </syntaxhighlight> You should see something like: <syntaxhighlight>nvme0n1p1 vfat EFI /boot/efi nvme0n1p2 ext4 boot /boot nvme0n1p3 crypto_LUKS └─lvm ext4 qubes_dom0 / nvme0n1p4 ext4 media </syntaxhighlight> If ESP + /boot are mounted and not encrypted → ✔ boots. ==== You’re absolutely right: ==== * UEFI installs are deterministic * Worst case = reinstall * No firmware damage possible * You already backed up everything (👏) This mindset is healthy. ==== 15 000–20 000 tabs: ==== * Browsers are not designed for this (even Vivaldi) * Qubes + workspaces + multiple qubes is actually a very good mental model * You’ll probably end up with: - research qube - school qube - job qube - archive qube - “parking” qube for tab hoarding We can optimize that later (RAM, swap, browser profiles, tmpfs). ==== - How to check it will boot? → ESP + /boot unencrypted, correct mountpoints, no installer errors ==== * Mountpoint for unencrypted media? → Leave it empty If you want, paste the final partition list exactly as shown (just text), and I’ll say either: ✅ “Install now” or ❌ “Fix this one thing first” You’re at the finish line. === User: One more thing: which one of these can be easily read by Linux, Windows and Android? === One more thing: which one of these can be easily read by Linux, Windows and Android? f2fs ntfs swap vfat xfs === Assistant: Good question — this one has a clear, practical answer, and it’s important if you want the partition to be readable eve… === Good question — this one has a clear, practical answer, and it’s important if you want the partition to be readable everywhere. I’ll go filesystem by filesystem, then give you a final recommendation. ==== ### ==== 👉 vfat (FAT32) 👉 or exFAT (if available — better) From your list, vfat is the only universally safe option. ==== ### ==== Flash-Friendly File System * ✅ Linux: yes * ❌ Windows: no * ❌ Android (external storage): usually no (kernel-dependent) Use case: internal flash on Android phones Verdict: ❌ Not cross-platform ===== Windows native filesystem ===== * ✅ Windows: yes * ✅ Linux: yes (via ntfs-3g) * ⚠️ Android: sometimes, often read-only or unreliable Cons: * Slower on Linux * Permission weirdness * Journaling overhead * Android support varies wildly by device/vendor Verdict: ⚠️ Works, but not ideal ===== - ❌ Linux: not a filesystem ===== * ❌ Windows: no * ❌ Android: no Verdict: ❌ Not for storage ===== Old but extremely compatible ===== * ✅ Linux: yes * ✅ Windows: yes * ✅ Android: yes Cons: * 4 GB max file size * No permissions * No journaling Verdict: ✅ Maximum compatibility ===== High-performance Linux filesystem ===== * ✅ Linux: yes * ❌ Windows: no * ❌ Android: no Verdict: ❌ Linux-only ==== Even though it wasn’t on your list: ==== * ✅ Linux * ✅ Windows * ✅ Android * No 4 GB file limit * Designed for removable media If your installer later allows it, exFAT is the best choice. ==== ### ==== * Filesystem: exFAT (best) * If not available → vfat (FAT32) ===== - Filesystem: ext4 ===== ==== For cross-platform partitions in Qubes: ==== * Leave them unmounted in dom0 * Attach the block device to a VM * Mount inside the VM that needs it ==== | | | | | | ==== | --- | --- | --- | --- | --- | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If you want, I can also: * explain why exFAT might not show up in the installer * show how to reformat later safely * help you choose between vfat vs exFAT vs ntfs based on file sizes You’re asking the right last questions — this is exactly where most people stop 👍 === User: Thank you, I'll set up exfat later. === Thank you, I'll set up exfat later. ntfs - permission weirdness and journaling overhead - What does it mean? just for fun - how could I paste a file into swap as a "hidden file" without some binary/hex editor? === Assistant: Happy to explain 🙂 === Happy to explain 🙂 I’ll keep this conceptual but concrete, no installer stuff anymore. ==== ### ==== NTFS does not use Linux-style permissions (rwx, UID, GID). It uses Windows ACLs (Access Control Lists), which are much more complex. Linux has to emulate these when mounting NTFS. ===== When Linux mounts NTFS (via ntfs-3g or kernel driver), it usually: ===== * Fakes permissions * Applies one set of permissions to all files * Ignores per-file ownership Example: <syntaxhighlight lang="bash">-rwxrwxrwx everyone everyone file.mp4 </syntaxhighlight> But this is not real security — just a mount-time illusion. ===== - You can’t rely on Unix permissions ===== * chmod, chown often do nothing or behave strangely * Some apps break assumptions (especially sandboxed ones) * Qubes isolation logic prefers predictable permissions That’s the permission weirdness. ==== ### ==== A journaling filesystem logs changes before committing them. Purpose: * Crash recovery * Consistency guarantees ===== NTFS journaling is: ===== * Always on * Designed for Windows I/O patterns * Heavier than Linux ext4 defaults ===== - Extra writes (bad for SSD endurance) ===== * Slower metadata operations * Higher CPU usage * Worse performance for many small files On Windows → optimized On Linux → tolerated, not ideal ===== - ext4: native, optimized, predictable ===== * exFAT: simple, no journaling, low overhead ==== Short answer: ==== 👉 Not in any meaningful or reliable way Long answer (the fun part): ===== Swap: ===== * Has no directory structure * No filenames * No metadata * Just raw memory pages dumped to disk So there is no such thing as a “hidden file” in swap. ==== ### ==== You can: # Load a file into RAM # Lock memory pressure # Let the kernel swap it out Example (conceptual): <syntaxhighlight lang="bash">cat secret.txt > /dev/null & stress --vm 1 --vm-bytes 99% </syntaxhighlight> Now parts of secret.txt may end up in swap. But: * You don’t control where * It may be fragmented * It may be overwritten anytime * You can’t reliably recover it This is more of a forensics accident than storage. ===== You could: ===== * Disable swap * Write directly to /dev/nvme0n1pX (swap partition) * Re-enable swap Example: <syntaxhighlight lang="bash">swapoff /dev/nvme0n1pX dd if=secret.txt of=/dev/nvme0n1pX bs=4K seek=12345 swapon /dev/nvme0n1pX </syntaxhighlight> Why this is terrible: * Kernel will overwrite it * No persistence * High chance of corruption * Extremely detectable * One reboot = gone This is basically abusing disk blocks, not hiding data. ===== (For learning, not recommending.) ===== * Use LUKS hidden volume (plausible deniability) * Or steganography inside filesystems * Or sparse files with unusual extents * Or encrypted containers inside unencrypted FS Swap is one of the worst places to hide anything. ==== This is why Qubes insists: ==== * Encrypted swap * Controlled VM memory * Minimal dom0 exposure Because swap leaks are real, but they are: * accidental * unreliable * forensic artifacts, not storage ==== ### ==== * Permission weirdness = ACL mismatch + fake Unix perms * Journaling overhead = extra writes + slower Linux performance ===== - Not a filesystem ===== * No filenames * No reliable storage * Anything written there is temporary garbage ===== : ===== If you want a similarly fun deep dive next time: * how deleted files still exist on ext4 * how SSDs break forensic assumptions * how Qubes memory isolation really works Just say the word 😄
Summary:
Please note that all contributions to freem are considered to be released under the Creative Commons Attribution-ShareAlike 4.0 (see
Freem:Copyrights
for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource.
Do not submit copyrighted work without permission!
Cancel
Editing help
(opens in new window)
