The pitch
QixOS is the unification of two operating systems: QubesOS and NixOS. So to explain QixOS I have to explain both.
QubesOS
QubesOS is a security focused operating system designed around isolation through virtual machines. It lets you create many VMs where each VM is a security domain used for a different purpose. You browse in one VM, keep documents in another, do your banking in a third.
Qubes comes with a GUI that makes working with many VMs seamless. You run a standard Linux desktop and barely notice that you are running multiple VMs.
The Qubes project is among the most serious security engineering teams working on operating systems. Security is priority #1 and the whole design embodies that.
NixOS
NixOS is a Linux distribution where you configure the entire operating system through a configuration file written in a functional language called nix.
Nix also has the biggest package repository in the world, nixpkgs.
Packages are install recipes written in the nix language.
The ecosystem is deterministic, so packages are reproducible.
Configurations are too: a NixOS configuration maps deterministically to a specific system.
Because configuration is files, it can be shared.
You version control it, and nix flakes let you share configurations, packages and libraries by copying git URLs.
Solving orthogonal problems
Qubes and Nix shine at different things.
Qubes solves security, virtualization and an ergonomic UI for both. Nix solves package management, configuration management, and sharing configurations reproducibly.
The problems are orthogonal and the solutions are not in tension. Combining them gets you both.
QixOS
QixOS is the attempt at unifying the two in a usable, well architected way.
It installs as an isolated sub-system of QubesOS, managed through an admin VM usually called qixos-admin.
You declare a cluster of qubes in a .nix file and apply it with a tool called qixos-rebuild.
On top of that, QixOS lets each AppVM be configured independently through its own NixOS configuration. In Qubes an AppVM shares its template’s root filesystem and services. In QixOS it does not.
That has three consequences. Templates no longer need to run essentially any software. AppVMs can be swapped between templates without issue. And an AppVM configuration can be shared between people without the author having to be trusted by dom0, the admin VM or the template.
Nubes
A nube is a nix qube: an AppVM whose contents come from a configuration rather than from whatever you installed by hand.
A nube is a file, so you can diff it, roll it back and send it to someone. There is a community repository for sharing them. A development nube or a hardened browsing nube becomes something you fetch instead of something you build.
What the pieces can reach
The admin VM creates and manages QixOS VMs. It has no access to the rest of your Qubes VMs.
One thing to know before relying on it: a template can read the /nix/store contents and configurations of every AppVM built from it.
That is deliberate, and it is what makes independent AppVM configuration work.
It does mean you should not put secrets into the nix configuration files.
This is standard practice and is well trodden ground in the nix ecosystem already.
Why now
Writing software is getting cheap. There is going to be far more of it and a lot of it will be good.
That means you will want to try more software. Trying software means running a stranger’s code. More people are shipping code than ever, and less of it has been read by anyone.
Two things make trying it affordable.
Isolation makes trying cheap. A new tool runs in its own nube with no path to anything else. Delete the nube and it is gone.
Packaging makes auditing cheap. The same tools that make software cheap to write make it cheap to package. An LLM can turn a project into a nix derivation, and a derivation is small and declarative: inputs, build steps, pinned output. Reading a derivation is far easier than reading the code it builds.
Derivations can be submitted to nixpkgs or other audited repositories. Once a package is there the normal supply chain applies: review, history, many eyes on the diff.
Status
QixOS is in public alpha.