Qubes OS Daily Commands: The Updates and Operations Cheatsheet

Qubes ships a widget for almost everything — Updater, Devices, Clipboard, Disk Space — and for daily use the GUI is genuinely the right tool. But underneath it there's a second interface: a family of qvm-* and qubes-* tools you run from a dom0 terminal that do everything the widgets do, plus a few things the widgets don't — batch updates, scripted backups, firewall rules, template surgery, automation. This post is that interface, organized by what you actually reach for day to day.

The timing for writing this down isn't random. In the first two weeks of November 2026 alone, the project published QSB-121, QSB-122, and QSB-123. Back in August, QSB-118 disclosed a dom0 code-execution bug in qvm-copy-to-vm itself. On Qubes, updating isn't routine maintenance — it's the primary security control, and the commands below are that control in executable form.

One note before we start: every command here runs in a dom0 terminal unless I say otherwise.

Ground Rules

Updates

Templates only reach the network through the updates proxy in sys-net — that's why they don't get "normal" internet access. The updater talks to that proxy on their behalf, so you're never routing template traffic through your actual netvm directly.

Checking and Applying

Two details worth knowing here. By default, qubes-vm-update updates qubes that have known updates or whose last check is older than 7 days (--update-if-stale; use --update-if-available to narrow that to just known updates, --force-update to widen it to everything regardless). And by default it leaves running qubes untouched afterward — add -r (--apply-to-sys) to restart service qubes whose template was updated, which the manpage itself calls the recommended option, or -R to also shut down running app qubes (unsaved data is lost, so save first). Qubes with the skip-update feature set to 1 are skipped unless you target them directly.

What to Restart Afterward

Also watch the calendar, not just the package list: templates have their own upstream end-of-life dates, and the project flagged Fedora 43's approaching end of life on November 1, 2026. Unsupported templates stop receiving security updates entirely — no QSB is going to save you there.

Firmware

Daily Operations

Survey and Status

Qube Lifecycle

Running Commands in a Qube

Files Between Qubes

A footnote on history worth keeping in mind: in August 2026, QSB-118 disclosed that a malicious qube could inject a command into dom0 through a crafted filename in qvm-copy-to-vm's error dialog — patched by updating normally (qubes-core-dom0-linux 4.3.22). It's a good miniature of the whole Qubes trust model: the copy tools stay safe because dom0 gets patches the moment the security team ships them, not because the tools are somehow immune to begin with.

Devices

The Devices widget does all of this with clicks; reach for the CLI when scripting or when the widget's picker is slower than typing would be. One warning straight from the manpage: only dom0 exposes PCI devices, and some of them (the host bridge, for instance) must never leave it.

Network and Firewall

Rules are evaluated in order and the first full match wins — order matters, and reset is your undo button if you've gotten rules tangled.

Storage

Templates

Backups

Organization

Troubleshooting and Discovery

The Daily Routine

# dom0 terminal — the whole update ritual
sudo qubes-dom0-update --check-only   # what's waiting in dom0?
sudo qubes-dom0-update                # apply it
qubes-vm-update -T -r                 # templates + restart service qubes
# or: qubes-vm-update -r              # every updatable qube (dom0 excluded)
sudo reboot                           # only if Xen/kernel/microcode changed
# then read any QSB the updater points you at — and do what it says

The Takeaway

The widgets are your daily driver; the terminal is for when you need scale, scripts, or an answer the widget just won't give you. But the two halves are really one habit: check, update, restart what the update touched, read the bulletin. QSB-118 showed what the alternative looks like — a single stale dom0 package standing between a compromised qube and total control. The commands above are short. The discipline they encode is the operating system.

Further reading:

• How to update — Qubes OS documentation — the official procedure this post's first half is built on
• Command-line utilities — qubes-core-admin-client — manpages for every qvm-* tool
• qubes-vm-update manpage — targeting, selection, and propagation flags in full
• QSB-118: Dom0 arbitrary code execution in qvm-copy-to-vm error reporting — why "update normally" is the security model
• Qubes Security Pack (qubes-secpack) — signed QSBs, canaries, and how to verify them
• How to copy and move files and copying from dom0 — the file-transfer rules in detail
• qubes-cheatsheet (Jeeppler) — the community cheatsheet this one updates for the 4.x era