Updates that arrive on their own

Starting point

The server this site runs on installs updates by itself. A tool called unattended-upgrades runs every day in the morning (UTC). It may install the security branch, but not the normal update branch.

What I checked

Several updates of the container runtime have been installed automatically. For the two most recent ones, the server’s journal shows that only containerd was restarted and dockerd kept running. For the third, I only looked at the logs of long-running database containers, and they show no stop. I have not checked the two oldest. An update that I installed by hand is not counted here.

A kernel update from 14 October was also installed automatically. It only took effect after the restart in the night before 27 October.

Where the risk lies

The live-restore setting is off here. If the Docker service dockerd were restarted, all containers would presumably stop, and the pages would be unreachable for seconds to a few minutes. That is derived, not measured.

For the two updates whose journal I looked at, dockerd was not restarted. A new version would only take effect the next time dockerd is restarted, for example when the server restarts. That is derived as well.

What is still open

I see three options. First, do nothing. Second, switch live-restore on: that needs a one-time restart of Docker, with a short outage in a window I choose myself. Third, put three packages of the container runtime on a blocklist (blacklist): security updates for those packages would then only come by hand, in a window. Nothing has been decided yet.

As of 1 November 2026

In closing

Automatic updates take work off my hands, but I no longer decide exactly when something happens. That is why this post says what I checked and what I did not.