Ubuntu 10.04 LTS Lucid Lynx: Release Facts, Kernel 2.6.32, Security

Ubuntu 10.04 LTS "Lucid Lynx" was released on 29 April 2010 with Linux kernel 2.6.32 and a GNOME desktop, and its support ended on 9 May 2013 for desktops and on 30 April 2015 for servers. Canonical's current Expanded Security Maintenance and Ubuntu Pro pages do not list 10.04, so no paid extension covers it in October 2026.

Canonical called Lucid the third LTS release, and it was the first LTS to bring Upstart native jobs, Plymouth, GRUB 2, ext4 and the Ubuntu Software Center to users who only moved between long term releases. It still turns up in old appliances, embedded controllers and forgotten virtual machines, which is why it is worth knowing exactly what shipped. Below are the release facts with a citation for each, what changed since 8.04 LTS "Hardy Heron", the security defaults as Ubuntu documented them at the time, and how to find and retire Lucid wherever it is still running. Where an official page does not state a fact, we say so.

Key takeaways

• Released 29 April 2010, codename Lucid Lynx. The date comes from Canonical's end of life announcements and the archived Ubuntu wiki Releases page.
• Kernel 2.6.32, specifically the 2.6.32-21.32 Ubuntu kernel based on upstream 2.6.32.11, according to the archived 10.04 technical overview.
• GNOME desktop, described as "the latest GNOME desktop environment." None of the official pages we fetched names the GNOME point version for 10.04. Kubuntu 10.04 shipped KDE SC 4.4.
• Support: three years on desktops, ending 9 May 2013, and five years on servers, ending 30 April 2015. Ubuntu Netbook Edition 10.04 was not an LTS and got 18 months.
• No ESM, no Legacy add-on. Canonical's release cycle and ESM pages start their LTS coverage at 14.04, so a Lucid machine has had no official security updates since 30 April 2015.
• Security defaults: AppArmor 2.5 with enforcing profiles for a dozen services and Evince, ufw installed but switched off, SHA512 password hashes, an encrypted home directory option, and compiler hardening (stack protector, Fortify Source, RELRO) on by default.
• New boot stack versus 8.04: Upstart native jobs, Plymouth, GRUB 2 and ext4.
• Upgrade path: 10.04 goes to 12.04 LTS. In 2026, rebuilding on a supported release is usually the honest answer.

What are the Ubuntu 10.04 LTS release facts?

The current 10.04 release notes are the 2010 known issues page and do not state the kernel, GNOME version or support dates. Those come from Canonical's announcement list and from archived official wiki and ubuntu.com pages, cited with the original URL and the Wayback Machine snapshot we read.

What happened when: the Lucid timeline

The 10.04 announcement told 8.04 LTS users they "may wish to wait for 10.04.1 LTS, due in July 2010." The archived Releases page dates 10.04.1 to 17 August 2010, so the first point release arrived a few weeks later than that plan.

How long was Ubuntu 10.04 LTS supported?

The release announcement set the promise in one line: "Ubuntu 10.04 LTS will be supported for three years on desktops and five years on servers." The two end of life notices from the Ubuntu Release Team then confirmed each date.

The desktop notice says that after 9 May 2013, "Ubuntu Security Notices will no longer include information or updated packages for Ubuntu 10.04 Desktop," while the server stayed covered for two more years. The server notice of 30 April 2015 says "No more package updates will be accepted to 10.04, and it will be archived to old-releases.ubuntu.com in the coming weeks."

Why Lucid has no ESM

Expanded Security Maintenance and Ubuntu Pro came later. The Ubuntu Pro page now says Pro "extends the life of every Ubuntu LTS from 5 years of standard security maintenance for the Main repository to 10 years for the entire Ubuntu Archive," and the Legacy add-on adds five more for 15 years in total. But the LTS rows on the release cycle page start at 14.04 LTS, and the ESM page lists 14.04 and 16.04 as its oldest covered releases, with 12.04 under "Outdated or non-LTS releases." Ubuntu 10.04 appears on neither page. In practice, a Lucid system has received nothing from Canonical's archive since April 2015.

For how the modern model works, see our explainer on the Ubuntu support lifecycle: LTS, interim, ESM, Legacy and HWE and the history of Ubuntu Pro and ESM by release.

What kernel does Ubuntu 10.04 LTS use?

Lucid shipped Linux 2.6.32. The archived LucidLynx/TechnicalOverview states: "Ubuntu 10.04 LTS includes the 2.6.32-21.32 kernel based on 2.6.32.11." The 2.6.32-21.32 string is the Ubuntu package version, so on a freshly installed 10.04 machine uname -r prints a 2.6.32 release followed by the ABI number and a flavour such as generic or server.

The kernel brought several defaults that mattered for security and stability:

• Kernel mode setting (KMS) on most common video chipsets, per the 10.04 release notes, which also document the nomodeset boot option for machines where KMS broke video output.
• Nouveau as the default driver for nVidia hardware, replacing the older nv driver, according to the archived technical overview.

The kernel lifecycle page starts its charts at 14.04, and none of the pages we fetched describes a hardware enablement kernel for 10.04. The next kernel came with 10.10 "Maverick Meerkat," whose release notes say it shipped "the 2.6.35-22.33 kernel which is based on the 2.6.35.4 Upstream stable kernel."

What desktop does Ubuntu 10.04 LTS ship?

GNOME, with Compiz as the default window manager, which the archived 10.04 release candidate overview mentions in its known issues. The archived technical overview says only that 10.04 "includes the latest GNOME desktop environment" and does not give a version number. The release notes refer to GNOME menus ("System", "Preferences") and the GNOME panel. Since 9.10 shipped GNOME 2.28 according to its own archived technical overview, Lucid was GNOME 2 based, but the exact 10.04 GNOME version is not stated in the official pages we fetched.

What the official pages do describe for the desktop:

• New look. Two new themes, Ambiance and Radiance, plus new wallpaper and icons (technical overview). The 10.10 release notes add that the Ubuntu font "was first seen in the new Ubuntu 10.04 logo design."
• Me Menu and social integration. A panel menu built on Gwibber for Twitter, identi.ca, Facebook and other networks, with a new backend on desktopcouch (technical overview; Desktop Edition press release, archived).
• Ubuntu One. Folder sync with sharing to existing contacts, and the Ubuntu One Music Store inside Rhythmbox.
• Ubuntu Software Centre 2.0, described in the press release as a sleeker way to find new software and keep track of it, with the ability to single out software provided by Ubuntu or by Canonical partners.

Window button placement is not mentioned in any of the official pages we fetched, so we do not state where the buttons sat.

Upstart and Plymouth: what changed in boot, and does it matter for security?

Lucid was the first LTS where the whole boot sequence was new compared with the previous LTS. Most of the change landed in 9.10 and carried into 10.04.

Upstart native jobs

The archived 9.10 technical overview says Ubuntu had "transitioned to Upstart native jobs" for boot performance. The 10.04 release notes document what that meant for administrators upgrading from 8.04:

• Upstart reads job files from /etc/init. The old /etc/event.d directory is no longer used, and "No automatic migration of changes to /etc/event.d is possible." Any local hardening you had put in an /etc/event.d job had to be rewritten by hand.
• Network handling moved to Upstart, so "all network devices are now handled in a hotplug manner." Bonded interfaces had to be configured in hotplug style or they might not come up at boot.
• Upstart jobs cannot run inside a chroot.

Why this matters for security: hand written service hardening in /etc/event.d could be silently lost on upgrade from 8.04, so anyone auditing an upgraded Lucid server should compare /etc/init against it.

Plymouth and boot output

The release notes say that "With the introduction of plymouth, boot-time messages from startup scripts are no longer displayed above the login prompt on tty1." They go to tty7, which on a server is reached with Alt+F7, and all boot output is also written to /var/log/boot.log. New Server installs show no splash by default, so administrators see boot feedback directly, but the notes warn this "prevents prompts from reaching the user in the event of filesystem mounting failures."

For incident review, that means boot time failures on Lucid are in /var/log/boot.log, not on the console.

GRUB 2

GRUB 2 became the default boot loader for new installs in 9.10, replacing GRUB Legacy, and existing systems were not converted automatically "as automatically reinstalling the boot loader is an inherently risky operation" (9.10 technical overview, archived). The 10.04 notes add two warnings that touch security:

• On upgrade, if you choose to keep a locally edited GRUB Legacy menu.lst, "your system will not be set up to boot from any newly-installed kernels." That means a kernel security update could install cleanly and never run. The notes give a step by step fix that moves local options into the kopt variables and then installs the maintainer's version.

AppArmor in Ubuntu 10.04

AppArmor had been in Ubuntu since before 8.04, and Lucid shipped AppArmor 2.5, according to the feature matrix on the archived Security/Features wiki page (snapshot from May 2011). That page lists 8.04 LTS on AppArmor 2.1 and 10.10 on 2.5.1.

The same page tracks which shipped profiles were enforcing by default, release by release:

The Firefox and Apache entries carry a footnote on the wiki: the profile "Will be disabled by default and be opt-in for advanced users." Lucid therefore enforced AppArmor on network daemons and on the PDF viewer, but not on the browser.

The 10.04 release notes explain the Evince choice: it "now ships with an enforcing AppArmor profile. This greatly increases security by protecting users against flaws in the historically problematic PDF and image libraries." The trade off was that users with a home directory outside /home had to adjust the home tunable in /etc/apparmor.d/tunables/home or Evince would fail.

SELinux was available from universe, but AppArmor was the default. For how the two compare today, see SELinux or AppArmor: which mandatory access control for a server.

Firewall: was ufw on by default in 10.04?

No. The archived Security/Features page says ufw "is installed by default in Ubuntu (users must explicitly enable it)." The matrix lists ufw as the configurable firewall from 8.04 onward.

What changed between 8.04 and 10.04 was what ufw could do:

• 8.10: "Service-aware" ufw. Common services informed ufw of the ports they needed, so an administrator could open a service by name (IntrepidIbex/TechnicalOverview, archived).
• 9.10: filtering by interface and egress filtering through the ufw command (KarmicKoala/TechnicalOverview, archived).
• 10.04 Server: the press release lists "Uncomplicated Firewall extended to all common services."

ufw being off fit Ubuntu's "No Open Ports" policy on the same wiki page: a default install has no listening services, except network infrastructure such as the DHCP client and mDNS through Avahi. The 10.04 release notes add that avahi-daemon starts even when a conflicting .local DNS domain is present.

Our ufw first steps guide covers the modern tool; the concepts have not changed much since Lucid.

Encrypted home directories and disk encryption

Lucid's encryption options came from two releases before it:

• 8.10 added the encrypted Private directory: ecryptfs-utils was promoted to main, with "support for a secret encrypted folder in your Home Folder," set up with ecryptfs-setup-private (IntrepidIbex/TechnicalOverview, archived).
• 9.04 added encrypted home. The Security/Features page says "As of Ubuntu 9.04, support for encrypted home was added, allowing users to encrypt all files in their home directory," supported in the Alternate Installer and in the desktop installer through the preseed option user-setup/encrypt-home=true, and the 9.04 kernel added encrypted file names for eCryptfs.

So on 10.04, the matrix row for eCryptfs reads "~/Private or ~, filenames." Full disk encryption with LVM was available from the alternate installer only, as it had been since 6.06. Neither TPM backed encryption nor UEFI Secure Boot appears in any of the 10.04 pages we fetched.

The 10.04 release notes add one operational caveat: encrypted partitions configured in /etc/crypttab to unlock at boot must have their file systems listed in /etc/fstab, or "the passphrase prompt is not guaranteed to be displayed at boot time."

Compiler hardening and kernel protections

This is where Lucid moved furthest from 8.04 LTS. The Security/Features matrix compares the two LTS releases directly:

A few of these deserve a sentence each.

SHA512 password hashes. The wiki says that since MD5 is "considered broken," Ubuntu 8.10 and later used salted SHA512 hashes (crypt id 6). A system upgraded from 8.04 keeps old MD5 hashes until each user changes their password.

Compiler defaults. The 8.10 overview says "The gcc compiler now defaults to enabling several security hardening features and warnings." The wiki defines Fortify Source as building with -D_FORTIFY_SOURCE=2 at optimisation level 1 or higher, which adds compile time and run time checks in glibc, and RELRO as marking relocation tables read only after load to shrink the area open to overwrites.

PIE and BIND_NOW. PIE carried a 5 to 10 percent performance cost on x86 at the time, so Ubuntu built only security sensitive packages that way; the wiki's 10.04 list includes OpenSSH, Apache, BIND, OpenLDAP, Postfix, CUPS, Samba, Dovecot, MySQL 5.1, Evince and Firefox. The 9.10 overview says those PIE programs also got BIND_NOW so that RELRO could protect the whole table.

What Lucid did not have yet: the same matrix shows symlink and hardlink restrictions and the ptrace scope restriction arriving in 10.10, and kernel module RO/NX and kernel address display restriction arriving in 11.04, so none of those restrictions is present on a 10.04 kernel.

Updates, notifications and archive trust

Lucid kept the update model it inherited from 9.04. The 10.04 release notes say update-manager launches directly instead of showing a panel icon, and "Users are notified of security updates on a daily basis, but for updates that are not security-related, users will only be prompted once a week."

Since 8.10, APT also installs packages listed in Recommends by default, which means more packages to track when you build an SBOM of an old Lucid system.

The release notes also contain one of the earliest supply chain warnings you will find in an Ubuntu release note, in a section titled "Security Issue when upgrading from Lucid Alpha 2." A package, libmysqlclient16 version 7.0.9-1, "was present in the Ubuntu archive by mistake and was retracted," but because its version number was higher than the real package, upgrades would never replace it. Systems installed before Alpha 3 had to run an explicit apt-get install of libmysqlclient16 from lucid "to ensure that you have the official package installed on your Lucid system and will receive security support for it."

The lesson still applies: a package with a higher version than the distribution's own build will block every later security update for that package, and nothing in a normal upgrade warns you. An inventory that records exact versions is how you spot it. For the broader history of archive signing keys and repository trust, see Linux distribution package signing.

Which new network services and server packages shipped?

The Server Edition press release lists applications added or updated since 8.04 LTS and available as install options. None of them listen by default on a fresh install, in line with the no open ports policy, but each one is a version to track on any surviving Lucid server:

On the desktop side, the network facing additions were Ubuntu One file sync, the Ubuntu One Music Store, and the Me Menu's social network accounts through Gwibber. On the server side, the press release lists EC2 images bootable from EBS and cloud-init for configuring instances at first boot.

A CVE example: Shellshock on Ubuntu 10.04

The best known flaw fixed during Lucid's server life is CVE-2014-6271 in Bash, often called Shellshock. USN-2362-1, published 24 September 2014, says Bash "incorrectly handled trailing code in function definitions," which could be used to bypass environment restrictions such as SSH forced command environments. The notice lists 10.04 LTS among affected releases and gives the fixed package as bash 4.1-2ubuntu3.1 for Lucid. The Ubuntu CVE tracker entry shows the same version for 10.04 lucid as fixed.

By then only 10.04 Server was still supported. A 10.04 Desktop machine that stopped at its May 2013 end of life never received an official fix for this or anything after it, even though it ran the same Bash package.

To confirm the fix on a Lucid server that was updated before April 2015, check that the installed bash package version is 4.1-2ubuntu3.1 or later. The USN's own instruction is that "a standard system update will make all the necessary changes." We are describing the fix and how to confirm it, not how the flaw works in practice.

What changed from Ubuntu 8.04 LTS to 10.04 LTS?

Many of the differences arrived in the three interim releases between the two LTS versions. This table shows where each change first appeared.

Sources: the archived Releases page for dates; the archived IntrepidIbex, KarmicKoala and LucidLynx technical overviews for kernels, GNOME and features; the archived Security/Features page for security rows; and the 8.10, 9.04, 9.10 and 10.04 release notes for ext4, Upstart and rsyslog. The 8.04 to 9.04 init row follows from the 10.04 note that Upstart stopped using /etc/event.d in 9.10. Blank cells mean the pages we fetched state no change.

We could not fetch the 9.04 technical overview (the archive service rate limited our requests), so the 9.04 kernel and GNOME versions are not stated here. The 8.04 kernel is covered in the Ubuntu release history hub.

The upgrade paths in 2010

The 10.04 release notes say users of 9.10 and 8.04 LTS could upgrade directly; anyone on 8.10 or 9.04 had to step through one of those first.

Why some embedded systems still carry Lucid era packages, and how to find them

Lucid's five year server promise, its minimal installation profile for virtual machines and EC2 images, and its 256 MB memory floor made it an easy base for devices that were then shipped and left alone. Three patterns keep it around:

1. Appliances with a frozen root file system that a vendor built on 10.04 and never rebased.
2. Virtual machine templates and cloud images cloned for years because the application on them is hard to move.
3. Copied user space, where a build copies binaries and libraries from an old Lucid host into a newer image whose base looks modern.

How to find them:

• Ask the system. On a running machine, the release and kernel commands in the next section identify Lucid immediately: a codename of lucid and a kernel that starts with 2.6.32.
• Look at package versions in an SBOM. Lucid package versions follow the Ubuntu suffix pattern, and the USNs for 10.04 list the exact fixed versions per release, such as bash 4.1-2ubuntu3.1. Matching installed versions against those lists tells you both that a component came from Lucid and whether it had its last fix. Our guide to checking whether a distro backported a security fix explains why the upstream version number alone misleads you here.
• Check the base image metadata. How to check if your base image operating system is end of life walks through reading the release files inside an image.

Once you have found it, the decision is the one in upgrade, extend, isolate or retire end of life software. For Lucid, "extend" is not an option, because no official extended coverage exists.

How do you check and upgrade an Ubuntu 10.04 system?

These steps use commands from Canonical's documentation and Ubuntu manual pages. The first three only read state.

Step 1: Confirm the release

The Ubuntu Desktop docs use this command; on a Lucid machine the description names Ubuntu 10.04 and a point release:

lsb_release --description

The lsb_release manual page documents the all option, which also prints the release number and the codename, lucid:

lsb_release -a

Step 2: Check the running kernel

The uname manual page documents the kernel release option. On Lucid, it prints a 2.6.32 kernel:

uname -r

Step 3: Accept that there is no coverage to check

On supported releases you would run pro status and pro security-status here. For 10.04 there is nothing to attach. The release cycle page and ESM page do not list 10.04, and the server end of life notice says no more package updates are accepted. Any Lucid package that has had a CVE since April 2015 is unpatched by Canonical.

Step 4: Decide between an upgrade chain and a rebuild

The official path out, from the end of life notices, is "via Ubuntu 12.04," and from there to 14.04. The archived 10.04 technical overview describes the mechanism: install update-manager-core, set the prompt to lts, and run the release upgrader. The Ubuntu Server docs give the current form of the same command:

sudo do-release-upgrade

The Server docs add that "The system is not considered upgraded until this reboot occurs."

Two honest warnings. First, 12.04 and 14.04 are themselves out of standard support, so an upgrade chain from 10.04 means four or more hops before you reach a release with full coverage. Second, the server end of life notice said 10.04 would be archived to old-releases.ubuntu.com, so the package sources configured on an untouched Lucid system no longer point at a mirror that carries it. None of the official pages we fetched documents reconfiguring a Lucid system for old-releases before an upgrade, so we do not give steps for it.

For a server whose workload you understand, rebuilding on a supported LTS and moving the application is almost always faster and safer than a five hop upgrade. For an appliance, the fix has to come from the vendor.

Step 5: Keep old ISOs off the network

old-releases.ubuntu.com/releases/lucid/ lists the 10.04.4 LTS desktop, server and alternate images for i386 and amd64, and /releases/10.04.0/ holds the original images. Use them offline for forensic comparison, never for anything on a network.

Common mistakes

• Treating "LTS" as "still supported." Lucid has been out of support since 2015 on servers and 2013 on desktops. The LTS label describes the original promise, not current status.
• Assuming Ubuntu Pro covers it. Pro coverage starts at 14.04 on Canonical's pages. Buying a subscription does nothing for 10.04.
• Reading the upstream version as the patch level. A Lucid Bash reports 4.1 whether it is patched or not. Only the full Ubuntu package version, compared with the USN, tells you whether a fix is present.
• Installing a kernel update without booting it. With a locally kept GRUB Legacy menu.lst, new kernels install but never boot. Always check the running kernel with uname, not just the installed packages.
• Forgetting that ufw ships disabled. On Lucid, ufw is installed but off. A Lucid server with services on it and no explicit firewall rules exposes those services.
• Leaving desktop installs on the server timetable. A Lucid desktop missed every fix after May 2013, including Shellshock.

FAQ

Is Ubuntu 10.04 still supported?

No. Desktop support ended on 9 May 2013 and server support on 30 April 2015. Canonical's ESM and release cycle pages do not list 10.04, so no paid extension exists either.

When was Ubuntu 10.04 released?

On 29 April 2010, as both end of life notices from the Ubuntu Release Team state.

What kernel does Ubuntu 10.04 use?

Linux 2.6.32. The archived 10.04 technical overview says it shipped "the 2.6.32-21.32 kernel based on 2.6.32.11."

What desktop does Ubuntu 10.04 use?

GNOME, with the new Ambiance and Radiance themes, the Me Menu and new indicators. The GNOME point version is not stated in the official pages we fetched. Kubuntu 10.04 used KDE SC 4.4.

Did Ubuntu 10.04 use systemd?

No. Lucid used Upstart native jobs in /etc/init, introduced in 9.10. systemd arrived in a much later release; our 16.04 LTS post covers the first LTS that shipped it.

Was the firewall enabled by default in Ubuntu 10.04?

No. ufw was installed but users had to enable it, according to the Security/Features wiki page of the time.

Does Ubuntu 10.04 have AppArmor?

Yes, AppArmor 2.5, enforcing for a dozen services and Evince. The Firefox and Apache profiles shipped disabled.

Can I upgrade Ubuntu 10.04 directly to 22.04 or 24.04?

No. The official path is to 12.04 LTS, then one LTS at a time. Rebuilding is usually the better route.

Where can I download Ubuntu 10.04 ISOs?

From old-releases.ubuntu.com/releases/lucid/. Use them only offline.

Fix it without waiting for upstream

On Lucid, upstream for the operating system has been closed since April 2015, so every OS package CVE since then stays open unless you rebuild. The application dependencies you build on top of an old base, and the images you ship, are a different story: those you can move to fixed versions today, independent of the distribution.

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

Safeguard scans repositories, container images and SBOM files and matches the components it finds against vulnerability databases, so an image built on an old Ubuntu base, or one carrying libraries copied from a Lucid host, shows its OS packages and versions next to its application dependencies:

safeguard scan --dir .
safeguard scan --image your-image:tag
safeguard scan --sbom sbom.json

Results are written as JSON under ./output, and the platform shows every project that contains a given component and version. Safeguard does not patch a host kernel or appliance firmware and cannot bring back official updates for 10.04; for those, rebuilding on a supported release is the fix.

In this Safeguard CLI session you install the CLI, run safeguard to open the interactive terminal and ask it to fix the lodash CVE in a repository. It reads the finding and advisory, asks before each command, edits package.json to lodash 4.17.21, runs npm install and npm test with your approval, prints a summary and pushes nothing. When you rebuild a service off a Lucid base, the same flow brings the service's own dependencies to fixed versions at the same time.

Click through it at your own pace, or open it full screen.

This demo sets up the Safeguard runner on your own machine, approves it with its device code, then scans from the terminal. For teams auditing old appliance images or VM templates that should not leave the building, it means the scan runs on a machine you control. Our guide to how the local runner and offline mode work covers the details.

Click through it at your own pace, or open it full screen.

This demo connects Claude to the Safeguard MCP server with OAuth and chooses which tools Claude can use. Once connected, you can ask Claude which of your projects still carry a component version you are tracking, for example the Bash, PHP 5.3 or MySQL 5.1 builds that shipped with 10.04, while you plan which services to rebuild first.

Click through it at your own pace, or open it full screen.

To try it yourself, download Safeguard from safeguard.sh/download and follow the CLI docs.

For every Ubuntu version with its kernel and support dates, see our Ubuntu release history hub; to follow notices for the releases you still run, see how to subscribe to Ubuntu and Debian security advisories.

Quick check

Sources

• Ubuntu release notes: Ubuntu 10.04 LTS
• Ubuntu release notes: Ubuntu 10.10
• Ubuntu release notes: Ubuntu 9.10
• Ubuntu release notes: Ubuntu 9.04
• Ubuntu release notes: Ubuntu 8.10
• Ubuntu release notes: Ubuntu 8.04 LTS
• Ubuntu release notes: Ubuntu 12.04 LTS
• Ubuntu release notes index
• ubuntu-announce: Ubuntu 10.04 LTS released (April 2010)
• ubuntu-announce: Ubuntu 10.04 Desktop End of Life reached on May 9, 2013
• ubuntu-announce: May 2013 thread index (8.04 and 10.04 Desktop end of life)
• ubuntu-announce: Ubuntu 10.04 reaches End of Life on April 30 2015
• ubuntu-announce: Ubuntu 10.04 End of Life reached on April 30, 2015
• wiki.ubuntu.com/LucidLynx/TechnicalOverview (Wayback Machine snapshot, May 2011)
• wiki.ubuntu.com/KarmicKoala/TechnicalOverview (Wayback Machine snapshot, November 2011)
• wiki.ubuntu.com/IntrepidIbex/TechnicalOverview (Wayback Machine snapshot, June 2011)
• wiki.ubuntu.com/Security/Features (Wayback Machine snapshot, May 2011)
• wiki.ubuntu.com/Releases (Wayback Machine snapshot, December 2015)
• ubuntu.com/getubuntu/releasenotes/1004overview (Wayback Machine snapshot, May 2010)
• ubuntu.com/news/ubuntu-10.04-desktop-edition (Wayback Machine snapshot, May 2010)
• ubuntu.com/news/ubuntu-10.04-server-edition (Wayback Machine snapshot, May 2010)
• Ubuntu: Release cycle
• Ubuntu: Kernel lifecycle and enablement stack
• Ubuntu: Expanded Security Maintenance
• Ubuntu: Ubuntu Pro
• Ubuntu security notice USN-2362-1
• Ubuntu CVE tracker: CVE-2014-6271
• Ubuntu Server documentation: How to upgrade your Ubuntu release
• Ubuntu Desktop documentation: Switch between an LTS and interim release
• Ubuntu manpages: lsb_release(1)
• Ubuntu manpages: uname(1)
• Old Ubuntu releases: lucid
• Old Ubuntu releases: 10.04.0
• Old Ubuntu releases index

Last reviewed: 23 October 2026.