# Spectrum

**URL:** https://collective.flashbots.net/t/spectrum/6064
**Category:** References
**Tags:** software
**Created:** [September 27, 2026, 7:33am UTC](https://collective.flashbots.net/t/spectrum/6064 "2026-09-27T07:33:27Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![guayabyte](https://collective.flashbots.net/user_avatar/collective.flashbots.net/guayabyte/32/4_2.png) [@guayabyte](https://collective.flashbots.net/u/guayabyte)
#### Post date: [September 27, 2026, 7:33am UTC](https://collective.flashbots.net/t/spectrum/6064/1 "2026-09-27T07:33:27Z")

</div>

> Last tested on Debian unstable, on September 27th, 2026.

[Spectrum](https://spectrum-os.org/) is a compartmentalization linux distribution, based in [NixOS](https://nixos.org/), using [Cloud Hypervisor](https://github.com/cloud-hypervisor/cloud-hypervisor) as the virtual machine monitor. Its goal is one virtual machine per application.

It’s an early project, don’t use it for anything important or sensitive, because many security properties are still missing and there is no update mechanism. Everything is built from source with Nix.

I am testing this in Debian unstable. I want to use it to run claude code in a very safe container.

Install the required packages:

```auto
sudo apt update
sudo apt install git curl xz-utils qemu-system-x86 qemu-utils libvirt-daemon-system virt-manager ovmf cpu-checker
sudo adduser "$USER" libvirt
sudo adduser "$USER" kvm

```

Log out and back in so the group changes take effect, then confirm KVM is usable:

```auto
kvm-ok

```

It should say `KVM acceleration can be used`. If not, virtualization is off in firmware; reboot into BIOS/UEFI and enable Intel VT-x or AMD SVM before going further.

Check nested virtualization. For intel processors:

```auto
cat /sys/module/kvm_intel/parameters/nested

```

For AMD processors:

```auto
cat /sys/module/kvm_amd/parameters/nested

```

`Y` or `1` means it is enabled. `N` or `0` means enable it persistently:

```auto
# Intel
echo "options kvm_intel nested=1" | sudo tee /etc/modprobe.d/kvm-nested.conf

# AMD
echo "options kvm_amd nested=1" | sudo tee /etc/modprobe.d/kvm-nested.conf

sudo update-initramfs -u
sudo reboot

```

After the reboot, check again.

Install nix:

```auto
sh <(curl -L https://nixos.org/nix/install) --daemon

```

Start a new shell, then check:

```auto
nix --version

```

Add the binary cache. Edit `/etc/nix/nix.conf` and add:

```auto
extra-substituters = https://cache.dataaturservice.se/spectrum/
extra-trusted-public-keys = spectrum-os.org-2:foQk3r7t2VpRx92CaXb5ROyy/NBdRJQG2uX2XJMYZfU=

```

Restart the daemon:

```auto
sudo systemctl restart nix-daemon.service

```

Clone spectrum:

```auto
git clone https://spectrum-os.org/git/spectrum

```

Build a live image:

```auto
nix-build spectrum/release/live

```

Copy the image out of the read-only Nix store so libvirt can use it:

```auto
cp "$(readlink --canonicalize result)" ~/spectrum-live.raw
chmod u+w ~/spectrum-live.raw
qemu-img resize --format raw ~/spectrum-live.raw 20G

```

Move the image somewhere the `libvirt-qemu` user can read it, and make sure that network is up:

```auto
sudo mv ~/spectrum-live.raw /var/lib/libvirt/images/
sudo virsh net-start default
sudo virsh net-autostart default

```

Spectrum requires UEFI or the Boot Loader Specification, so the domain must use OVMF rather than SeaBIOS. Define it with `virt-install`:

```auto
virt-install \
  --connect qemu:///system \
  --name spectrum \
  --memory 6144 \
  --vcpus 4 \
  --cpu host-passthrough \
  --boot firmware=efi,firmware.feature0.name=secure-boot,firmware.feature0.enabled=no,firmware.feature1.name=enrolled-keys,firmware.feature1.enabled=no \
  --disk path=/var/lib/libvirt/images/spectrum-live.raw,format=raw,bus=virtio \
  --network network=default,model=virtio \
  --video virtio \
  --graphics spice \
  --import \
  --osinfo detect=off,name=linux2022

```

Created together with [Claude Opus 5](https://claude.ai/artifact/RjnjV5hzSoLRku1BZZLLnU?sk=BlMMovPS5Z1CYhSlnHroMg#3b0dde9f-c362) 🛡📜