Canonical published 887 Ubuntu Security Notices (USNs) for Ubuntu 24.04 LTS in twelve months, and 203 of them fixed a package on the server image Canonical ships for virtual machines. Every one of those 203 went out through the -security pocket, which is the Ubuntu source unattended-upgrades installs from by default, so on a stock server the defaults select every fix. Twenty of the 203 were kernel updates, one every 17 days at the median, and unattended-upgrades reboots for none of them unless you turn that on.
We counted from Canonical's own data: the Ubuntu Security Notices feed, each notice's binary packages matched against the package manifest of the 24.04 server cloud image Canonical publishes for virtual machines, with the same count for 26.04. The defaults come from the unattended-upgrades, needrestart and apt packages in the archive, checksum-verified and unpacked. No server ran these updates for this post. What follows is what the shipped code selects, not a log we watched.
Installed is not the same as running, and a published fix is not always one the server can install. Those gaps are most of what patching means when CloudSpinx runs Linux servers for companies in Kenya.
- fix running
- fix running, after a restart you did not plan
- old code still running
What unattended-upgrades installs by default
Four origins are allowed in the shipped 50unattended-upgrades: the release itself, -security, and Ubuntu Pro's two streams, ESM Apps and ESM Infra. The -updates line is commented out, so a bug fix that is not a security fix waits for someone to run apt. Third-party repositories are not on the list either. Ubuntu's documentation says the tool ships "with only official Ubuntu repositories configured", so it never upgrades a Docker engine or a PostgreSQL build you added from the vendor's own repository.
The hour comes from apt's timers. apt-daily-upgrade.timer fires at 06:00 with up to 60 minutes of random delay, and systemd reads that 06:00 in the server's own time zone. A server whose clock is set to UTC therefore starts its install run between 09:00 and 10:00 Nairobi time, at the start of the working day.
That would matter less if installing were all it did.
needrestart restarts your services in the same run
The 24.04 and 26.04 server images carry needrestart as well, and APT calls it after every install through a DPkg::Post-Invoke hook, unattended runs included. Called from that hook on Ubuntu, needrestart switches itself to automatic mode unless you have set a restart mode or an interface yourself, and Ubuntu's documentation dates that behavior to 24.04. So when a library fix lands, each systemd service still holding the old copy in memory, bar the exclusion list in needrestart.conf, gets systemctl restart in that same run.
Of the 183 non-kernel notices, 105 touched a library package on the stock image (by Debian's naming, a package whose name starts with lib), and 9 of those were glibc or OpenSSL. Every dynamically linked daemon loads glibc. A restart is a blip for nginx. For a database primary it drops every open connection, and the application finds out at whatever hour the timer fired.
The shipped config also lists services needrestart leaves alone in automatic mode: dbus, docker, systemd-logind, the gettys and libvirt, among others. A process started inside a login session (a tmux pane, an app someone launched by hand) is listed and left alone. All of those keep the old library until someone restarts them or the server reboots. One difference between releases: 26.04's list also covers keepalived and LXC, where 24.04's covers neither (only lxcfs), so 24.04's needrestart restarts keepalived. The Launchpad bug that added keepalived says it "should not be automatically restarted after an update as other services which depend on it might get disrupted", and its 24.04 task is still open.
Two changes put the restarts back under your control. Move the install to an hour you chose, in the zone you mean:
# systemctl edit apt-daily-upgrade.timer
[Timer]
OnCalendar=
OnCalendar=*-*-* 01:00 Africa/NairobiThe empty OnCalendar= clears Ubuntu's 06:00 before yours is set, and the 60-minute random delay still applies. Then keep anything you restart on your own schedule out of the automatic list:
# /etc/needrestart/conf.d/50-local.conf
$nrconf{override_rc}->{qr(^postgresql)} = 0;Evaluated in Perl with the shipped 26.04 config, that line matches a [email protected] unit and leaves nginx.service restartable. The catch is that an excluded service now runs old code until you restart it, which is a calendar someone has to own. If nobody on your side does, that is the work the Linux scoping form is for.
Does unattended-upgrades reboot after a kernel update?
No. Automatic-Reboot is false in the code and commented out in the shipped file. The new kernel is installed beside the old one and the server keeps running the kernel it booted with. In twelve months, twenty notices covered the generic kernel the 24.04 server image boots, never more than 51 days apart and once only 5. 26.04's generic kernel had 8 in its first six months.
Turning the reboot on is a two-line change with a trap in it. Set Automatic-Reboot to true without a time and it reboots right after any install that asks for one, because Automatic-Reboot-Time defaults to "now", with users logged in or not. On a UTC server that reboot lands in the Nairobi working morning. Always set the time, and remember it is read on the server's clock. Our server setup checklist does.
Livepatch closes part of the gap without a reboot. Canonical issued 7 Livepatch notices for the 24.04 kernel over the same twelve months, the service covers kernel vulnerabilities rated high or critical, and Canonical's own page says it "is not a replacement for rebooting". It comes with Ubuntu Pro, free on up to 5 machines for personal use.
The fixes only Ubuntu Pro gets
160 of the 887 notices, 18%, shipped their fix only to ESM Apps, the Pro stream that covers the universe repository. None touched the stock image. They hit universe packages a server only has when someone adds them: ImageMagick had 12 of them, FFmpeg 7, with pip, GIMP and Roundcube in the list. Until Pro is attached and ESM Apps enabled, apt has no source for those fixes, so unattended-upgrades has nothing to install and the vulnerable version stays. 26.04 already had 74 such notices in six months.
Pro costs USD 500 a year per server with unlimited VMs on Canonical's price list. Before paying, check whether the universe package is needed at all. Removing the one nothing uses is cheaper and closes the same notices.
Count it on your own server
Three commands give you your server's version of these numbers:
uname -r; ls /boot/vmlinuz-* # the kernel you run against the ones installed
sudo needrestart -r l # what still runs old code; lists, restarts nothing
pro security-status # installed packages by origin, and what Pro would addThen the reboot arithmetic. Twenty kernels a year is twenty reboots if you want each fix running within days of its release, or twelve if a month of lag is acceptable. Time one reboot of your own server, from the command to the application answering, and multiply by your number. A 99.9% month allows 43.2 minutes down in 30 days, and an unscheduled morning restart of the database counts against it like any other outage.
One Ubuntu server, someone who reboots it monthly and reads /var/log/unattended-upgrades/, nothing installed from universe: you do not need us for this. It is the same test as managed against unmanaged servers, whether anyone owns the calendar, and we earn the fee on the estate where nobody does. For the payments platform in our managed infrastructure case study, hardening and patching sit on our side of the line, and the platform team usually hears about it after it is done. Tell us how many servers, which Ubuntu releases and who reboots them today, through the scoping form with the output of those three commands pasted into the notes box, or on WhatsApp at +254 713 403 044. You get each server back marked patched, installed but not running, or not covered, plus the reboot calendar we would run and one monthly figure for running it. Free, and it commits you to nothing.