Which is the more secure way to run commands on VMs using dom0?

[unch...@dnmx.cc]

There seems to be several different ways:
`qvm-run VMNAME -- COMMAND`
`qvm-run --service -- VMNAME qubes.VMShell+ or qubes.VMExec+`
`qrexec-client -d VMNAME user:COMMAND`
and perhaps others... also changing the options etc.

So which is the more secure way, when no input/output from/to dom0 is
needed? (or a way other than the mentioned ones)

[unman]

Define "the more secure way". All are good. For simplicity use qvm-run.

[Demi Marie Obenour]

qvm-run --no-shell is best. It doesn't use a shell.
--
Sincerely,
Demi Marie Obenour (she/her/hers)

[qubist]

On Sat, 22 Aug 2026 01:04:28 -0400 Demi Marie Obenour wrote:

> qvm-run --no-shell is best. It doesn't use a shell.

According to the man page --service means "Start RPC service instead
of shell command." Isn't that the same?

Also what does best mean? In what context? How are the other worse?