Container updates should be deliberate. Base OS security patches are a good candidate for automation, because they’re frequent, usually small, and important.
Debian
Per the Debian wiki:
sudo apt install unattended-upgrades apt-listchanges
sudo dpkg-reconfigure -plow unattended-upgradesBy default it installs updates from the security origin. Settings live in /etc/apt/apt.conf.d/50unattended-upgrades.
Ubuntu
Ubuntu Server enables unattended security upgrades by default. See Automatic updates to check or change the configuration.
Reboots
Kernel and libc updates need a reboot to take effect. You can either:
- enable
Unattended-Upgrade::Automatic-Reboot "true";with anAutomatic-Reboot-Timein a quiet window, or - leave reboots manual and check for
/var/run/reboot-requiredweekly.
Where not to use it blindly
Proxmox VE hosts have their own upgrade guidance (apt dist-upgrade, cluster ordering). See our Proxmox post. Keep hypervisors on a deliberate update routine.
Check it’s working
Logs are in /var/log/unattended-upgrades/. Do a quick sudo unattended-upgrade --dry-run --debug after configuring.
Checklist
- Installed and enabled (Debian) / verified (Ubuntu)
- Security origin only
- Reboot strategy chosen
- Hypervisors kept on a manual routine