Why does Qubes not work with nested virtualization?

[pub...@enkore.de]

Nested Virtualization seems to work generally well, albeit slower, even with different hypervisors.

Despite the advice given in the install docs:

> Note: We don’t recommend installing Qubes in a virtual machine! It will likely not work.

I tried it an the Kernel comes up, as does the installer; X does not work, though it normally does in the same environment (sans Qubes).

The development "workflow" for qubes being what it is, running qubes under a hypervisor would be a great help there.

Cheers, Marian

[Jean-Philippe Ouellet]

It actually does work for limited use cases. I sometimes run Qubes
inside Qubes for quickly testing things ;) The outer VM must be HVM,
and the inner-inner VMs must be PVM, or else you must enable some
less-tested and potentially dangerous code paths in Xen (nestedhvm=1)
which Qubes (on purpose) does not enable by default.

The main issue is networking does not work because Qubes relies on
being able to pci-passthrough a network card to sys-net, and this
(emulating pci passthrough) is afaik not implemented by qemu.

I suspect this is not actually what you meant though, and perhaps you
are asking about running Qubes inside e.g. virtualbox or vmware on
windows or osx? Well, in that case many of the security guarantees of
qubes (device isolation, boot sequence semi-protection, etc.) can not
be made since the outer system has full control and is fully exposed.
Then there is also the problem the outer hypervisors not correctly
emulating or exposing the hardware-assisted virtualization cpu
features to their guests. (IIRC virtualbox still doesn't? Don't quote
me on that though... I haven't tried it myself.)