Last tested on Debian unstable, on September 27th, 2026.
Spectrum is a compartmentalization linux distribution, based in NixOS, using Cloud Hypervisor as the virtual machine monitor. Its goal is one virtual machine per application.
It’s an early project, don’t use it for anything important or sensitive, because many security properties are still missing and there is no update mechanism. Everything is built from source with Nix.
I am testing this in Debian unstable. I want to use it to run claude code in a very safe container.
Install the required packages:
sudo apt update
sudo apt install git curl xz-utils qemu-system-x86 qemu-utils libvirt-daemon-system virt-manager ovmf cpu-checker
sudo adduser "$USER" libvirt
sudo adduser "$USER" kvm
Log out and back in so the group changes take effect, then confirm KVM is usable:
kvm-ok
It should say KVM acceleration can be used. If not, virtualization is off in firmware; reboot into BIOS/UEFI and enable Intel VT-x or AMD SVM before going further.
Check nested virtualization. For intel processors:
cat /sys/module/kvm_intel/parameters/nested
For AMD processors:
cat /sys/module/kvm_amd/parameters/nested
Y or 1 means it is enabled. N or 0 means enable it persistently:
# Intel
echo "options kvm_intel nested=1" | sudo tee /etc/modprobe.d/kvm-nested.conf
# AMD
echo "options kvm_amd nested=1" | sudo tee /etc/modprobe.d/kvm-nested.conf
sudo update-initramfs -u
sudo reboot
After the reboot, check again.
Install nix:
sh <(curl -L https://nixos.org/nix/install) --daemon
Start a new shell, then check:
nix --version
Add the binary cache. Edit /etc/nix/nix.conf and add:
extra-substituters = https://cache.dataaturservice.se/spectrum/
extra-trusted-public-keys = spectrum-os.org-2:foQk3r7t2VpRx92CaXb5ROyy/NBdRJQG2uX2XJMYZfU=
Restart the daemon:
sudo systemctl restart nix-daemon.service
Clone spectrum:
git clone https://spectrum-os.org/git/spectrum
Build a live image:
nix-build spectrum/release/live
Copy the image out of the read-only Nix store so libvirt can use it:
cp "$(readlink --canonicalize result)" ~/spectrum-live.raw
chmod u+w ~/spectrum-live.raw
qemu-img resize --format raw ~/spectrum-live.raw 20G
Move the image somewhere the libvirt-qemu user can read it, and make sure that network is up:
sudo mv ~/spectrum-live.raw /var/lib/libvirt/images/
sudo virsh net-start default
sudo virsh net-autostart default
Spectrum requires UEFI or the Boot Loader Specification, so the domain must use OVMF rather than SeaBIOS. Define it with virt-install:
virt-install \
--connect qemu:///system \
--name spectrum \
--memory 6144 \
--vcpus 4 \
--cpu host-passthrough \
--boot firmware=efi,firmware.feature0.name=secure-boot,firmware.feature0.enabled=no,firmware.feature1.name=enrolled-keys,firmware.feature1.enabled=no \
--disk path=/var/lib/libvirt/images/spectrum-live.raw,format=raw,bus=virtio \
--network network=default,model=virtio \
--video virtio \
--graphics spice \
--import \
--osinfo detect=off,name=linux2022
Created together with Claude Opus 5 
