{"slug": "xen", "name": "Xen", "category": "infra", "category_name": "Infrastructure and DevOps", "description": "", "recommenders": 5, "commenters": 9, "warners": 1, "score": 4.362, "rising": 1.02, "first": "2025-12-30", "latest": "2026-09-13", "why": "the attack surface of the Xen hypervisor itself is fairly minimal", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 5, "neutral": 4, "compare": 2, "warn": 1}, "spark": [0, 1, 0, 0, 0, 0, 0, 1, 1, 2, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "the attack surface of the Xen hypervisor itself is fairly minimal", "kind": "", "icon": true, "domain": "xenproject.org", "github_repo": null, "official_url": "https://xenproject.org", "pricing": "", "aliases": ["Xen"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 792073425, "item_id": 49504589, "url": "https://news.ycombinator.com/item?id=49504589", "by": "lrvick", "date": "2026-08-31", "stance": "recommend", "quote": "ripping off the best ideas from xen/Qubes", "excerpt": "Sigh. Qubes had some great security design and implemented it the only way time/funds would allow: by cobbling together a lot of unfortunately very complex and broken things built for a different security model decades ago. Qubes is the least bad option for laptops (until Stagex Work ships which I am designing) but there is no reasonable server OS. I am ripping off the best ideas from xen/Qubes and starting over with", "context": "", "use_case": "", "switched_from": "", "story": "Omarchy: Any User Process Can Escalate to Root"}, {"id": 790524690, "item_id": 49407793, "url": "https://news.ycombinator.com/item?id=49407793", "by": "TacticalCoder", "date": "2026-08-23", "stance": "recommend", "quote": "was running Xen happily more than two decades ago", "excerpt": "That's a great article too. I hope we'll see it comig back frontpage once in a while. He differentiates between \"things that last\" (knowledge that transfers) and the rest... Something has to be said about dodging a lot of the last shiny new tech that's going to invariably be tomorrow's long lost and not regretted turd. I make my friends laugh when I say that if there's one tech I know nothing about I don't feel bad b", "context": "", "use_case": "", "switched_from": "", "story": "I dream of quieter computing"}, {"id": 782164416, "item_id": 48885276, "url": "https://news.ycombinator.com/item?id=48885276", "by": "dredmorbius", "date": "2026-07-12", "stance": "recommend", "quote": "the attack surface of the Xen hypervisor itself is fairly minimal", "excerpt": "The email in question actually addresses one of the first, if not the first, x86 hypervisor product, Xen, relying on both my memory of the time (I did some work with Xen in the mid aughts) and Wikipedia: <https://en.wikipedia.org/wiki/Timeline_of_virtualization_technologies>. The Xen hypervisor itself was pretty minimal, as I understand mostly serving to time-slice CPU cycles among guest domains and partition memory ", "context": "", "use_case": "", "switched_from": "", "story": "Theo de Raadt: \"You've been smoking something mind altering\" (2007)"}, {"id": 775571841, "item_id": 48473240, "url": "https://news.ycombinator.com/item?id=48473240", "by": "avsm", "date": "2026-06-10", "stance": "recommend", "quote": "We've had this in Xen since forever!", "excerpt": "I looked at this last year when it came out in Tahoe: https://anil.recoil.org/notes/apple-containerisation and this looks like more of the same. They've now added a WSL-style virtual machine layer, but there's no x86 container story (Apple's killing Rosetta) so I imagine some qemu shimming will be required. There's still no equivalent to VPNKit or GVisor for networking so you'll be bridging I think. See: https://cacm", "context": "", "use_case": "", "switched_from": "", "story": "macOS Container Machines"}, {"id": 743062066, "item_id": 46441379, "url": "https://news.ycombinator.com/item?id=46441379", "by": "gucci-on-fleek", "date": "2025-12-30", "stance": "recommend", "quote": "high-quality practical implementations [2]", "excerpt": "> Now hardware virtualization. I like how AArch64 generalizes this: there are 4 levels of privilege baked into the architecture. Each has control over the lower and can call up the one immediately above to request a service. Simple. Let's narrow our focus to the lowest three: EL0 (classically the user space), EL1 (the kernel), EL2 (the hypervisor). EL0, in most operating systems, isn't capable of doing much on its ow", "context": "", "use_case": "", "switched_from": "", "story": "Toro: Deploy Applications as Unikernels"}]}], "caveats": [], "who": [], "tags": [], "use_cases": ["pci passthrough in qubes", "hypervisor"], "compared": [{"slug": "kvm", "name": "KVM", "co": 5, "switched_from": 0, "switched_to": 1}, {"slug": "qubes-os", "name": "Qubes OS", "co": 5, "switched_from": 0, "switched_to": 0}, {"slug": "proxmox", "name": "Proxmox", "co": 4, "switched_from": 0, "switched_to": 0}, {"slug": "linux", "name": "Linux", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=48882189", "title": "Theo de Raadt: \"You've been smoking something mind altering\" (2007)", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=49675902", "title": "Linux Zoom client proactively reading everything written to X11 clipboard", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49496918", "title": "Arbitrary code execution in QubesOS via copy-to-VM error reporting backchannel", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49499854", "title": "Omarchy: Any User Process Can Escalate to Root", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49405682", "title": "I dream of quieter computing", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49075417", "title": "Ask HN: How to deal with security implications of running/installing projects?", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {"recommend": 1}, "2026-01": {"neutral": 2}, "2026-02": {}, "2026-03": {}, "2026-04": {"neutral": 1}, "2026-05": {}, "2026-06": {"recommend": 1}, "2026-07": {"compare": 2, "recommend": 1}, "2026-08": {"recommend": 2, "neutral": 1}, "2026-09": {"warn": 1}, "2026-10": {}}, "quotes": [{"id": 795022577, "item_id": 49688911, "url": "https://news.ycombinator.com/item?id=49688911", "by": "fsflover", "date": "2026-09-13", "stance": "warn", "quote": "", "excerpt": "> Honestly, I wish there was a Qubes/KVM variant. Relayed Issue: https://github.com/QubesOS/qubes-issues/issues/7051", "context": "", "use_case": "", "switched_from": "", "story": "Linux Zoom client proactively reading everything written to X11 clipboard"}, {"id": 792127728, "item_id": 49507983, "url": "https://news.ycombinator.com/item?id=49507983", "by": "throwawayffffas", "date": "2026-08-31", "stance": "neutral", "quote": "They use Xens pci passthrough, you can setup a pci device to be assigned to a vm.", "excerpt": "They use Xens pci passthrough, you can setup a pci device to be assigned to a vm. The vm runs it's own driver and has direct access to the device, you typically have to hide the device from dom0 for it to work flawlessly and hardware support is required. But I believe the kernels do not interact with each other in a direct way. I used to have crashes on trying to restart a vm with a pci device attached probably relat", "context": "", "use_case": "PCI passthrough in Qubes", "switched_from": "", "story": "Arbitrary code execution in QubesOS via copy-to-VM error reporting backchannel"}, {"id": 792073425, "item_id": 49504589, "url": "https://news.ycombinator.com/item?id=49504589", "by": "lrvick", "date": "2026-08-31", "stance": "recommend", "quote": "ripping off the best ideas from xen/Qubes", "excerpt": "Sigh. Qubes had some great security design and implemented it the only way time/funds would allow: by cobbling together a lot of unfortunately very complex and broken things built for a different security model decades ago. Qubes is the least bad option for laptops (until Stagex Work ships which I am designing) but there is no reasonable server OS. I am ripping off the best ideas from xen/Qubes and starting over with", "context": "", "use_case": "", "switched_from": "", "story": "Omarchy: Any User Process Can Escalate to Root"}, {"id": 790524690, "item_id": 49407793, "url": "https://news.ycombinator.com/item?id=49407793", "by": "TacticalCoder", "date": "2026-08-23", "stance": "recommend", "quote": "was running Xen happily more than two decades ago", "excerpt": "That's a great article too. I hope we'll see it comig back frontpage once in a while. He differentiates between \"things that last\" (knowledge that transfers) and the rest... Something has to be said about dodging a lot of the last shiny new tech that's going to invariably be tomorrow's long lost and not regretted turd. I make my friends laugh when I say that if there's one tech I know nothing about I don't feel bad b", "context": "", "use_case": "", "switched_from": "", "story": "I dream of quieter computing"}, {"id": 785210209, "item_id": 49075638, "url": "https://news.ycombinator.com/item?id=49075638", "by": "fsflover", "date": "2026-07-27", "stance": "compare", "quote": "It is more secure than Xen, which it relies on", "excerpt": "Have you considered Qubes OS, https://qubes-os.org? It is more secure than Xen, which it relies on, https://www.qubes-os.org/security/xsa/#statistics.", "context": "", "use_case": "", "switched_from": "", "story": "Ask HN: How to deal with security implications of running/installing projects?"}, {"id": 782164416, "item_id": 48885276, "url": "https://news.ycombinator.com/item?id=48885276", "by": "dredmorbius", "date": "2026-07-12", "stance": "recommend", "quote": "the attack surface of the Xen hypervisor itself is fairly minimal", "excerpt": "The email in question actually addresses one of the first, if not the first, x86 hypervisor product, Xen, relying on both my memory of the time (I did some work with Xen in the mid aughts) and Wikipedia: <https://en.wikipedia.org/wiki/Timeline_of_virtualization_technologies>. The Xen hypervisor itself was pretty minimal, as I understand mostly serving to time-slice CPU cycles among guest domains and partition memory ", "context": "", "use_case": "", "switched_from": "", "story": "Theo de Raadt: \"You've been smoking something mind altering\" (2007)"}, {"id": 782159088, "item_id": 48884943, "url": "https://news.ycombinator.com/item?id=48884943", "by": "rurban", "date": "2026-07-12", "stance": "compare", "quote": "Then they talked Xen, which at least has a security boundary. Now everybody switched to kvm with none.", "excerpt": "There was no abuse and bad attitude. He was telling the truth about Linux hypervisors. And it got worse since then. Then they talked Xen, which at least has a security boundary. Now everybody switched to kvm with none. Only speed matters, security not at all.", "context": "", "use_case": "hypervisor", "switched_from": "", "story": "Theo de Raadt: \"You've been smoking something mind altering\" (2007)"}, {"id": 775571841, "item_id": 48473240, "url": "https://news.ycombinator.com/item?id=48473240", "by": "avsm", "date": "2026-06-10", "stance": "recommend", "quote": "We've had this in Xen since forever!", "excerpt": "I looked at this last year when it came out in Tahoe: https://anil.recoil.org/notes/apple-containerisation and this looks like more of the same. They've now added a WSL-style virtual machine layer, but there's no x86 container story (Apple's killing Rosetta) so I imagine some qemu shimming will be required. There's still no equivalent to VPNKit or GVisor for networking so you'll be bridging I think. See: https://cacm", "context": "", "use_case": "", "switched_from": "", "story": "macOS Container Machines"}, {"id": 767408801, "item_id": 47963050, "url": "https://news.ycombinator.com/item?id=47963050", "by": "kuhsaft", "date": "2026-04-30", "stance": "neutral", "quote": "", "excerpt": "You know that Xen is just a hypervisor right? Dom0 (the admin Qube) is running the Linux kernel and is vulnerable like any other Linux system. DomU (App Qubes) also run the Linux kernel and are just as vulnerable. You can check your DomU kernels using this guide: https://doc.qubes-os.org/en/latest/user/advanced-topics/managing-vm-kernels.html If your Dom0 or DomU is running kernel < 6.18.22, or between 6.19.0 and 16.", "context": "", "use_case": "", "switched_from": "", "story": "Copy Fail \u2013 CVE-2026-31431"}, {"id": 748643297, "item_id": 46790206, "url": "https://news.ycombinator.com/item?id=46790206", "by": "TacticalCoder", "date": "2026-01-27", "stance": "neutral", "quote": "I used to run Xen back in the early hardware-virt days", "excerpt": "> Void is as good as I could have wanted. If that ever goes, I guess it's either BSD or a cave somewhere. If systemd-less Linux ever go, there are indeed still the BSDs. But I thought long and hard about this and already did some testing: I used to run Xen back in the early hardware-virt days and nowadays I run Proxmox (still, sadly, systemd-based). An hypervisor with a VM and GPU passthrough to the VM is at least so", "context": "", "use_case": "", "switched_from": "", "story": "Lennart Poettering, Christian Brauner founded a new company"}, {"id": 744690129, "item_id": 46543133, "url": "https://news.ycombinator.com/item?id=46543133", "by": "fsflover", "date": "2026-01-08", "stance": "neutral", "quote": "I do have to somewhat trust Xen", "excerpt": "I do have to somewhat trust Xen, but Qubes' isolation relies on hardware virtualization (VT-d), which statistically has much less security issues than Xen itself. Most Xen advisories do not affect Qubes: https://www.qubes-os.org/security/xsa/", "context": "", "use_case": "", "switched_from": "", "story": "Kernel bugs hide for 2 years on average. Some hide for 20"}, {"id": 743062066, "item_id": 46441379, "url": "https://news.ycombinator.com/item?id=46441379", "by": "gucci-on-fleek", "date": "2025-12-30", "stance": "recommend", "quote": "high-quality practical implementations [2]", "excerpt": "> Now hardware virtualization. I like how AArch64 generalizes this: there are 4 levels of privilege baked into the architecture. Each has control over the lower and can call up the one immediately above to request a service. Simple. Let's narrow our focus to the lowest three: EL0 (classically the user space), EL1 (the kernel), EL2 (the hypervisor). EL0, in most operating systems, isn't capable of doing much on its ow", "context": "", "use_case": "", "switched_from": "", "story": "Toro: Deploy Applications as Unikernels"}]}