KUHBS Kuh Build System Qubes OS KUHBS Kuh Build System
English KUHBS Qubes OS website
Menu

Documentation

Installing Application KUHBs

Understand the separate my-kuhbs application catalog, Surf disposable browser sessions, KeePassXC credentials, persistent apps, and configured backup paths.

my-kuhbs is a separate application catalog. KUHBS core does not install it. Treat the whole selected checkout as trusted local code: audit the exact commit, then add the catalog and enable only the definitions you intend to use.

An enabled definition appears as a card in My KUHBS. Create builds its declared Qubes OS resources and only the launchers explicitly listed in its YAML. A service definition may intentionally provide no normal application launcher.

Browsers and passwords

  • Surf — unnamed DisposableVM (udp) browsing. Every configured browser launcher starts a fresh unnamed session and discards that session when it closes.
  • KeePassXC — a persistent no-network password-manager AppVM. Keep required website addresses and credentials here, then copy only the current URL and login into Surf.
  • Tor — unnamed DisposableVM access through a Qubes OS Whonix workstation base when that definition and base are present.

For normal browsing, use fresh Surf sessions instead of preserving a persistent browser profile. Logging in again is intentional. Do not keep browser cookies, extensions, saved sessions, or history merely for convenience.

Persistent applications

Communication, office, synchronization, and media definitions commonly use persistent AppVMs or StandaloneVMs because account or local application state must survive. Some definitions use named DisposableVMs with a persistent provider. Read the exact topology rather than assuming persistence from an application name.

Documents can contain malicious content. A no-network Office VM limits one path out; it does not make every document harmless. Open unknown files in a separate disposable session before moving selected output into a persistent KUH.

Check persistence before Create

Backup behavior is explicit in each current kuhb.yml. A persistent KUH participates only when it has a backup block with configured paths. Removing that block disables both Backup and Restore even if an old archive still exists. Named and unnamed DisposableVMs do not own KUHBS path backups.

Before Create, answer three questions:

  1. Which named KUH keeps application data?
  2. Which exact paths enter its KUHBS archive?
  3. Should any of that state return after the next clean rebuild?

Next: Restoring Data from Your Previous Operating System .