For most Linux servers on Ubuntu or Debian, yes, automatic security updates are a sound default, with exceptions for systems that need a controlled change window. Ubuntu applies most security updates daily by default on releases since 16.04 LTS, and Debian points admins to the unattended-upgrades package.
What the distributions offer
Ubuntu's security documentation says that since 16.04 LTS, releases automatically apply most security updates daily by default. Older releases can enable unattended upgrades. Ubuntu also says you can update manually with an apt update and upgrade, and recommends against cherry-picking updates from individual packages.
Debian's security page says the unattended-upgrades package can keep a computer current with the latest security and other updates automatically, and its wiki holds more detailed setup notes.
Both distributions backport fixes to the version they shipped, as Debian's FAQ describes, to keep changes small. That makes security-only updates less likely to change behaviour than moving to a new upstream version. It does not make them risk free.
A decision table
| System type | Suggested approach | Reason |
|---|---|---|
| Stateless web or app nodes behind a load balancer | Automatic, with staggered timing | Easy to replace, easy to roll back |
| Developer workstations and build agents | Automatic | Low blast radius, quick feedback |
| Databases and queues | Controlled window | Restarts affect data and clients |
| Systems under change freeze or regulatory sign-off | Controlled window, with evidence | Approvals required |
| Internet-facing edge systems | Automatic for security fixes, plus monitoring | Exposure justifies speed |
This table is guidance, not a rule. Your own risk appetite decides.
Make automatic updates safer
- Stagger. Update a canary group first, then the rest hours or a day later. Do not update every node in a cluster at once.
- Limit scope to security updates. Leave feature and major version changes for planned work.
- Watch for services that need a restart. A library update can leave an old copy running in memory. Check which services need restarting after an update, and schedule it.
- Handle kernels with a plan. A new kernel needs a reboot unless you use a live patching service. Ubuntu lists live kernel patching among Ubuntu Pro features. Pick a reboot window and a way to confirm the running kernel.
- Log and report. Keep the update logs. You will need them to show a compliance team when a fix landed.
- Keep a rollback path, such as snapshots or the ability to reinstall the previous package version.
What automatic updates do not cover
- Applications you installed outside the package manager, such as vendor tarballs and bundled libraries.
- Container images. Updating the host does not update the packages inside an image. Rebuild images and redeploy.
- Language dependencies in your own code.
- Packages in repositories that carry less support. Ubuntu notes that its universe and multiverse repositories get best-effort security updates, and extended coverage needs an Ubuntu Pro subscription. Check which repository a package comes from.
The advisory feeds still matter. They tell you what changed and why, and they cover what the auto-updater does not. See our guide to subscribing to Ubuntu and Debian advisories.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at the packages inside an image and the findings against them. Host auto-updates would not touch any of those.
Safeguard scans container images and dependencies, and can open fix PRs when you turn that on. It is off by default, with every category on Manual. Try a free scan.
Quick check
Do automatic updates fix my container images?
No. Host updates do not change packages inside an image. Rebuild and redeploy images.
Is a reboot needed after automatic kernel updates?
Usually yes, unless you use a live patching service. Plan a window and confirm the running kernel version.
Sources
- Ubuntu, About CVEs
- Debian, Security information
- Debian, Security FAQ
Last reviewed: 19 October 2026.
