Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

Original Article ↗ Hacker News Discussion ↗

Quickemu, a wrapper around QEMU, is drawing interest for making it far easier to spin up reasonably tuned virtual machines for Windows, macOS and Linux compared with manual QEMU configuration or heavier tools like Proxmox. Commenters highlight its convenience and desktop focus, including one-command VM creation and decent performance, but note limitations around GPU acceleration, macOS version support, and ARM/Mac hosts. Security practices are a major point of contention: while the tool verifies downloaded ISOs via checksums over HTTPS, several voices argue it should adopt GPG-based signature verification to strengthen the trust chain.

What Quickemu Is and Who It’s For

  • Described as a wrapper around QEMU that picks sane defaults and hides complex configuration.
  • Aimed more at desktop users who occasionally need VMs, not at lab/datacenter use like Proxmox.
  • Often compared to GNOME Boxes or VirtualBox in terms of UX, but built on QEMU/KVM.

Advantages vs Other Tools

  • Main benefit: very fast, low-friction VM creation (especially Windows/macOS) without learning QEMU flags.
  • Downloads OS images and applies OS‑specific default configs; useful as a “recipe book” of good QEMU settings.
  • Some users find this saves far more than “2 minutes,” especially for Windows 11 (TPM, etc.).
  • Others argue virt-install/virt-builder, virt-manager, GNOME Boxes, Incus/LXD, systemd-nspawn, or Proxmox already cover most needs, depending on use case.

Performance, GPU, and macOS Support

  • Several users report poor interactive performance with Windows under VirtualBox (e.g., video conferencing), hoping QEMU/Quickemu gives better GPU acceleration.
  • Confusion/uncertainty about how well GPU acceleration works with a single GPU, especially on AMD iGPUs.
  • macOS support includes older versions (Monterey and earlier); lack of Ventura/Sonoma is seen as a downside due to Apple’s security-patch policy.
  • Running older macOS on Apple Silicon with good performance is reported as unrealistic; performance considered “slow as hell.”

Security Concerns Around ISO Downloads

  • Tool fetches ISOs and checksums from official HTTPS sources, then verifies hashes.
  • Critics say:
    • Checksums and files from the same site are vulnerable if that site is compromised.
    • Better practice would be embedded upstream GPG keys and signature verification with revocation.
    • Tools should be held to higher standards than manual downloads.
  • Defenders argue:
    • This is already stricter than what most users do.
    • Remaining risks mostly involve a compromised upstream distro site.
  • macOS signatures are reportedly checked; none available for Windows; Linux signatures not yet integrated.

Codebase Size and Trust

  • Some are wary of running ~5000 lines of Bash that download and execute things, given shell-script “footguns” and global state.
  • Others say the scripts are relatively clean and readable compared to typical large Bash projects.
  • One detailed critique notes fragile global-variable flows and potential rm -rf pitfalls, highlighting maintenance risk.
  • Broader point: everyone relies on trust rather than fully auditing large software; opinions differ on whether a giant Bash wrapper is a good trust target.