Keeping the System Updated

What updates itself

Three kinds of software, three update stories:

• Security fixes for debs install themselves. The unattended-upgrades package, installed by default, runs once a day and applies security updates without asking ^{1 2}.
• Snaps refresh themselves, checking four times a day ³.
• Everything else waits for you: non-security deb updates, and Flatpaks ^{2 4}.

On the desktop, the Software Updater app pops up when updates are waiting and installs them with a click. From the terminal, it’s the pair you know:

me@garden-laptop:~$ sudo apt update
me@garden-laptop:~$ sudo apt upgrade

How unattended-upgrades works

It does the equivalent of apt update and apt upgrade, limited to the sources it’s allowed to use ¹. The pieces ¹:

• /etc/apt/apt.conf.d/20auto-upgrades turns it on and sets how often, in days:

  APT::Periodic::Update-Package-Lists "1";
  APT::Periodic::Unattended-Upgrade "1";
  

  Setting both to "0" turns it off.

• /etc/apt/apt.conf.d/50unattended-upgrades says what to install. Its Allowed-Origins list includes the release and its -security pocket (and Ubuntu Pro’s security pockets if you have them); the -updates line is commented out with //. Uncomment it to have all regular updates installed automatically too.

• Two systemd timers, apt-daily.timer and apt-daily-upgrade.timer, run it at a random time each day. If the computer was off then, it runs soon after the next start, which is why apt is sometimes busy just after you log in. (Timers are next module.)
• Logs go in /var/log/unattended-upgrades/.

Adding a third-party repository does not make unattended-upgrades install from it; it needs to be added to Allowed-Origins by name ¹.

It won’t restart the computer on its own unless you set Unattended-Upgrade::Automatic-Reboot "true"; in 50unattended-upgrades; the default is false ¹. For a desktop that’s right. For a home server that should keep itself patched, it’s worth turning on, with a time set for the reboot.

Kept back, and reboots

Two messages you’ll meet:

“Packages have been kept back.” Ubuntu releases many updates in phases: a random subset of machines gets an update first, and only if no problems turn up does it go to everyone ⁵. Until your machine’s turn, apt upgrade holds that package back. You don’t need to do anything; it arrives within days ⁵. (apt policy package shows the details.)

Restarts. Most updates take effect without a reboot. When a shared library is updated, programs already running keep the old copy in memory until they restart; Ubuntu’s needrestart restarts the affected services automatically, apart from a few it leaves alone, such as the login screen ¹. A new kernel needs a full reboot. Updates that need one create the file /var/run/reboot-required ¹:

me@garden-laptop:~$ [ -f /var/run/reboot-required ] && echo "restart needed"

A weekly routine

Put it in your dotfiles (Git course, module 7), so every machine has it. In bash_aliases:

# Update debs, then snaps and Flatpaks if present, then say if a restart is needed
update-all() {
    sudo apt update && sudo apt upgrade || return
    if command -v snap >/dev/null; then sudo snap refresh; fi
    if command -v flatpak >/dev/null; then flatpak update; fi
    if [ -f /var/run/reboot-required ]; then echo "Restart needed."; fi
}

A function rather than an alias, since it’s several steps (Shell course, module 8). || return stops if apt fails, and command -v skips snap or flatpak on a machine without them, such as WSL, so the same dotfiles work everywhere. Run update-all once a week, read what apt proposes before saying yes, and restart if asked. Commit it and pull it on your other machines.

A new release every two years

Your updates stay within your release: 26.04 stays 26.04. Every two years there’s a new LTS, and moving to it is a release upgrade ⁶:

• LTS to LTS, one at a time. From 24.04 you go to 26.04; from 22.04 you’d stop at 24.04 first ⁶.
• Offered after the first point release, like 26.04.1, usually several months after the April release, once early problems are fixed ⁶.
• It takes up to an hour and is interactive ⁶.

To prepare: plug in a laptop, check there’s several gigabytes of free space, back up your files, and install all current updates and restart ⁶. Then either the Software Updater offers the new release, or ⁶:

me@garden-laptop:~$ sudo do-release-upgrade

It shows what it will install and remove, and warns if you have packages from PPAs or third-party repositories; those are a common cause of trouble, and they may be disabled during the upgrade, so check them afterward in Software & Updates, Other Software ^{6 7}. At the end it offers to remove obsolete packages, then restarts.

There’s no hurry: 24.04 LTS has security updates until May 2029, and 26.04 until May 2031 ⁸.

Ubuntu Pro, free for personal use on up to five machines, adds Expanded Security Maintenance: ten years of security updates instead of five, covering the community universe packages too ⁸. On the desktop, turn it on in the Security Center app ². It’s worth having on any machine you’ll keep for years.

Your turn

So

Security updates for debs install themselves daily through unattended-upgrades (settings in 20auto-upgrades and 50unattended-upgrades, logs in /var/log/unattended-upgrades/), and snaps refresh themselves; other deb updates and Flatpaks are yours to run, weekly, with apt update, apt upgrade, snap refresh, and flatpak update, which fit nicely in a dotfiles function. “Kept back” packages are phased updates and arrive on their own; /var/run/reboot-required says when to restart. Every two years, after the first point release, do-release-upgrade moves you to the next LTS, one at a time, after a backup.