Overview
How VM isolation, shared storage, and whole-machine generations fit together.
AirlockOS uses Xen for VM isolation and Qubes to manage the VMs and control communication between them. By default, VMs run NixOS with only the software needed for their role. Nix builds their software and configuration as part of a whole-machine generation, allowing dom0 and the VMs to be deployed and rolled back together.
Virtualization and Qubes services
Dom0 runs on Xen alongside the other VMs. It is the privileged control VM: it administers the machine and assigns devices to the VMs that use them. Applications run in other VMs, keeping their processes and private files separate from dom0.
Airlock retains Qubes' management services. qubesd and libvirt manage VMs,
while QubesDB supplies their runtime settings. Inter-VM remote procedure calls
use Qubes' qrexec transport and are allowed or denied by Qubes policy. A VM's
network connection is separate from permission to make these calls.
VM topology
The default configuration includes the VMs below.
| VM | Responsibility |
|---|---|
dom0 | Administers the machine and activates system generations. |
sys-gui | Runs GNOME and drives the display. |
sys-net | Owns the physical network devices. |
sys-firewall | Provides the network path and applies firewall rules for other VMs. |
sys-ctrl | Enforces GUI review and approval for system changes and builds approved system generations. |
sys-clipboard | Runs the shared clipboard service in a separate VM. |
usr-home | Runs personal applications with internet access and stores their files. |
usr-assistant | Provides a workspace for an AI agent to prepare system changes for review and approval. |
This table describes the default setup. You can add VMs to separate applications and control which VMs they can communicate with.
The sys-clipboard VM runs the shared clipboard service on the
Hermit unikernel.
This is an experiment in using a specialized runtime for a
single service instead of a full NixOS system. For more information, see
sys-clipboard: a Hermit unikernel.