Ubuntu ships unattended-upgrades, which refreshes package lists and installs available upgrades once a day by default. Two files control it. Automatic reboots are off by default, so a kernel update can sit waiting until you restart. On a laptop you use daily, decide on purpose whether to reboot yourself or let the machine do it.
What it does
Ubuntu's server documentation says unattended-upgrades is installed by default and applies security updates without user interaction. If it is missing, install it:
sudo apt install unattended-upgrades
Each run refreshes package lists and then installs available upgrades. By default it runs once a day.
The two files
Schedule and enablement live in /etc/apt/apt.conf.d/20auto-upgrades, with two settings:
- APT::Periodic::Update-Package-Lists
- APT::Periodic::Unattended-Upgrade
A value of 1 runs daily, 2 every two days, and 0 disables the action.
The main options live in /etc/apt/apt.conf.d/50unattended-upgrades. That file holds allowed origins, blocked packages and reboot settings. Logs for each run go to /var/log/unattended-upgrades/.
Reboot options
Set in the 50unattended-upgrades file:
- Unattended-Upgrade::Automatic-Reboot reboots without confirmation when needed. Default is false.
- Unattended-Upgrade::Automatic-Reboot-WithUsers allows a reboot while users are logged in. Default is true.
- Unattended-Upgrade::Automatic-Reboot-Time sets the time, such as now, a clock time or a number of minutes. Default is now.
Note the interaction. With the first option left false, nothing reboots on its own, so updates that need a restart wait for you.
What to choose on a laptop
A laptop is not a server. You probably do not want a surprise reboot in the middle of work. A reasonable pattern:
- Leave automatic updates on.
- Leave Automatic-Reboot false.
- Set a calendar reminder, or a habit, to restart at least weekly.
- Check the logs folder if something looks off.
On a build machine that nobody sits at, setting Automatic-Reboot with a quiet time may suit you better. Pick the time deliberately, because the default is now.
Blocked packages
The same file lets you blacklist packages from automatic upgrade. Use this sparingly. If you pin a package because a newer version breaks your build, write down why, and revisit it. A pinned package is one that quietly stops getting fixes.
What it does not cover
It handles OS packages. It does not update the libraries inside your projects, your language runtimes installed outside apt, or container images. Those need their own process, and a dependency scan on your repositories helps you see them. Safeguard's free scan at gold.safeguard.sh/scan is one way to do that.
A sensible starting point for a laptop
Keep security updates automatic and leave reboots manual at first. Pick a regular moment, such as the start of the week, to restart and confirm the new kernel is running. If you keep long running jobs open, note that an automatic reboot would end them, which is the usual reason people leave that option off. Check the official documentation on the machine itself before changing any value, because the defaults can differ between releases.
Quick check
Does unattended-upgrades reboot my machine by default?
No. Unattended-Upgrade::Automatic-Reboot defaults to false.
Where do I find out what it did?
Ubuntu's documentation says detailed logs for each run are in /var/log/unattended-upgrades/.
Sources
Last reviewed: 19 October 2026.
