Whonix ™ for VirtualBox with CLI
Whonix ™ with CLI is a version suited for advanced users -- those who want Whonix ™ without a GUI. Everyone else should install the user-friendly Whonix ™ VirtualBox with graphical user interface (GUI) Xfce.
Please follow these steps to install Whonix ™ CLI
1. Download Whonix ™ CLI for Windows, MacOS and Linux
Optional: Verify the Whonix ™ Images cryptographically
Digital software signatures can increase security but this requires knowledge. Learn more about digital software signature verification.
How to verify the Whonix ™ Images : Whonix ™ virtual machine images are cryptographically signed by Whonix ™ developer Patrick Schleizer using OpenPGP and signify.
Do you already how to perform digital software verification using an OpenPGP and/or signify key?
2. Install VirtualBox
Linux instructions and further install directions
- Use the recommended VirtualBox version : latest (click for more information)
- For Windows and Mac: Just download and install.
- For Linux follow instructions below:
Hosts using a non-Debian OS:
Install VirtualBox as per the normal mechanism for your Linux distribution. Whonix ™ has has been tested with, expects VirtualBox version
For example VirtualBox version
5.2.18 has been reported to not be compatible.
18.04LTS) APT repository ships only VirtualBox version
5.2.18 and Whonix ™ will probably not work.
You might want to release-upgrade to Ubuntu
21.04) and install the
virtualbox package from the
hirsute-updates backports repository which provides at time of writing VirtualBox version
- These instructions are for host operating systems running Debian
bullseye, which is recommended.
- Other Debian releases might work, but this is untested.
- To acquire the Recommended VirtualBox version tested with Whonix ™, package
virtualboxshould be installed from Debian
fasttrackrepository according to the following instructions. 
1. On the host.
Open a terminal.
2. Add Debian the
Update the package lists.
Install the Debian
fasttrack signing key.
Add the Debian
3. Update the package lists again. 
4. Install VirtualBox and Linux kernel headers.
5. Add your current user to group
The procedure of installing the VirtualBox host software is complete.
3. Import Whonix ™ into VirtualBox
For Whonix ™ VirtualBox import instructions, please press on expand on the right.
There are also Video Tutorials.
If you still need help, please check the Support page.
For command line import instructions, see footnote. 
4. Start Whonix ™
Starting Whonix ™ is simple:
- Start VirtualBox
- Double-click the Whonix-Gateway ™ and Whonix-Workstation ™
First time users and more
First time users information
- If you do not know what metadata or a man-in-the-middle attack is.
- If you think nobody can eavesdrop on your communications because you are using Tor.
- If you have no idea how Whonix ™ works.
For additional VirtualBox guides and information, please press on expand on the right.
Footnotes and Experimental Spectre / Meltdown Defenses → press Expand
Testers only! For more information please press on expand on the right.
These experimental Spectre/Meltdown defenses are related to issues outlined in Firmware Security and Updates. Due to the huge performance penalty and unclear security benefits of applying these changes, it may not be worth the effort. The reason is VirtualBox is still likely vulnerable, even after:
- A host microcode upgrade.
- A host kernel upgrade.
- A VM kernel upgrade.
- A "not vulnerable" result from spectre-meltdown-checker run on the host.
- Installation of the latest VirtualBox version. 
- All Spectre/Meltdown-related VirtualBox settings are tuned for better security as documented below.
To learn more, see: VirtualBox 5.2.18 vulnerable to spectre/meltdown despite microcode being installed and the associated VirtualBox forum discussion.  Users must patiently wait for VirtualBox developers to fix this bug.
VBoxManage modifyvm "Whonix-Gateway" --ibpb-on-vm-entry on VBoxManage modifyvm "Whonix-Gateway" --ibpb-on-vm-exit on VBoxManage modifyvm "Whonix-Gateway" --l1d-flush-on-vm-entry on VBoxManage modifyvm "Whonix-Gateway" --l1d-flush-on-sched on VBoxManage modifyvm "Whonix-Gateway" --spec-ctrl on VBoxManage modifyvm "Whonix-Gateway" --nestedpaging off VBoxManage modifyvm "Whonix-Gateway" --mds-clear-on-vm-entry on VBoxManage modifyvm "Whonix-Gateway" --mds-clear-on-sched on
VBoxManage modifyvm "Whonix-Workstation" --ibpb-on-vm-entry on VBoxManage modifyvm "Whonix-Workstation" --ibpb-on-vm-exit on VBoxManage modifyvm "Whonix-Workstation" --l1d-flush-on-vm-entry on VBoxManage modifyvm "Whonix-Workstation" --l1d-flush-on-sched on VBoxManage modifyvm "Whonix-Workstation" --spec-ctrl on VBoxManage modifyvm "Whonix-Workstation" --nestedpaging off VBoxManage modifyvm "Whonix-Workstation" --mds-clear-on-vm-entry on VBoxManage modifyvm "Whonix-Workstation" --mds-clear-on-sched on
The above instructions only apply to the default VM names Whonix-Gateway ™ and Whonix-Workstation ™. Therefore, if Multiple Whonix-Workstation ™ and/or Multiple Whonix-Gateway ™ are configured, then repeat these instructions using the relevant name/s.
This is non-ideal but required since VirtualBox in unavailable in official Debian
bullseyerepository and difficult to install due to VirtualBox Installation Challenges. Alternatively you could install VirtualBox from the Oracle (virtualbox.org) Repository, but this comes with different risks. VirtualBox might be updated by VirtualBox developers before being tested with Whonix ™ which could then lead to issues. (Described in footnote here.)
This is to acquire the Debian
fasttrackrepository package sources.
Optional: See: https://www.virtualbox.org/manual/ch02.html#install-linux-vboxusers
~/.config/VirtualBox/VBoxSVC.loglog if not done.
On the Linux platform.
1. Read License Agreement:vboxmanage import Whonix-XFCE-18.104.22.168.ova --vsys 0 --eula show --vsys 1 --eula show2. Import Whonix-Gateway and Whonix-Workstation ™.vboxmanage import Whonix-XFCE-22.214.171.124.ova --vsys 0 --eula accept --vsys 1 --eula accept
5.2.18or above is required since only that version comes with Spectre/Meltdown defenses. See https://forums.whonix.org/t/whonix-vulerable-due-to-missing-processor-microcode-packages/5739/22.
- Also see the following Whonix ™ forum discussion: Whonix ™ vulerable due to missing processor microcode packages? spectre / meltdown / retpoline / L1 Terminal Fault (L1TF)
--ibpb-on-vm-[enter|exit] on|off: Enables flushing of the indirect branch prediction buffers on every VM enter or exit respectively. This could be enabled by users overly worried about possible spectre attacks by the VM. Please note that these options may have sever impact on performance.
There is a mistake in the VirtualBox manual stating
enterwhich does not work. It is actually
--l1d-flush-on-vm-enter on|off: Enables flushing of the level 1 data cache on VM enter. See Section 13.4.1, “CVE-2018-3646”.
For users not concerned by this security issue, the default mitigation can be disabled using
VBoxManage modifyvm name --l1d-flush-on-sched off
Since we want to enable the security feature we set
--spec-ctrl on|off: This setting enables/disables exposing speculation control interfaces to the guest, provided they are available on the host. Depending on the host CPU and workload, enabling speculation control may significantly reduce performance.
According to this VirtualBox ticket
--spec-ctrlshould be set to
--nestedpaging on|off: If hardware virtualization is enabled, this additional setting enables or disables the use of the nested paging feature in the processor of your host system; see Section 10.7, “Nested paging and VPIDs” and Section 13.4.1, “CVE-2018-3646”.