Hey, Ubuntu/Debian contributor here. Actually, 99% is misrepresenting it. Any [well-packaged] service upgraded through unattended-upgrades (nginx included) gets

Hey, Ubuntu/Debian contributor here. Actually, 99% is misrepresenting it. Any [well-packaged] service upgraded through unattended-upgrades (nginx included) gets restarted through package hooks. What unattended-upgrades won't help with are: 1. Updates to the kernel 2. Updates to system libraries which services depend on For 1, if you run Ubuntu you now have canonical-livepatch: http://blog.dustinkirkland.com/2016/10/canonical-livepatch.html http://blog.dustinkirkland.com/2016/10/canonical-livepatch.h... 2 remains a problem, and yes, if you're thinking openssl, that's a problem. But you can track what goes into /var/run/reboot-required.pkgs to see it's really not 99% of fixes we're streaming to you. See http://askubuntu.com/questions/775504/does-unattended-upgrades-restart-services-automatically/ http://askubuntu.com/questions/775504/does-unattended-upgrad... for a more complete discussion.