3 ms·

How to upgrade Debian unattended if it's not a rolling release

01HNNWZ0MV43FF 11mo ago
Maybe they run Debian Testing. Testing and Unstable (sid) are rolling, and the stable release cut from the testing branch (through some process)
idoubtit 11mo ago
Not the Grand Poster, but we use the Debian package "unattended-upgrades" to install security updates automatically on our servers, and send an email if a reboot is required to complete the process (kernel upgrade). Unattended upgrades could be configured to install more than the security release. Even with the stable release, one can add the official APT source for the Debian backports.
- SoftTalker 11mo ago
  Back to OpenBSD... realize that it has no "unattended upgrades" capability. Until syspatch(8) appeared in 6.x you had to download patches and rebuild kernel and userland to get security fixes. Today, you could run syspatch(8) in a cron job but that only covers the base system. You'd need to handle any installed packages separately. And only the current and immediately previous release are supported at all. There are two releases a year, so you have to upgrade every ~6 months to stay in the support window. Fortunately, with the introduction of the syspatch(8) and sysupgrade(8) utilities this is much simpler than it used to be. And, release numbers are just sequential with one point number, i.e. 7.0 was just the next release after 6.9, nothing more is implied by the "major" number ticking up.
- itopaloglu83 11mo ago
  Just curious, how do you manage service restarts, just restart as the update finishes? I think I’m a bit scarred when a docker upgrade took my entire stack down because of an api mismatch with portainer, so I’m trying to be present during upgrades. Edit: I’m talking about Debian of course. I’m not familiar with OpenBSD.
  - pabs3 11mo ago
    Use needrestart, you can mostly automate those restarts with it.
epakai 11mo ago
Debian still has security fixes, and point releases. unattended-upgrades is the package that automates their install. I think you can also do unattended release upgrades by using the 'stable' release alias in sources. That will probably result in some stuff breaking since there will be package and configuration churn.
pabs3 11mo ago
I use unattended-upgrades with Debian's rolling release (aka testing). Mostly works fine apart from bugs in unattended-upgrades, or when my boot partition runs out of disk.
pabs3 11mo ago
In case you are talking about automated upgrades between releases, there are some ideas for that here: https://wiki.debian.org/AutomatedUpgrade https://wiki.debian.org/AutomatedUpgrade It is feasible to do if you prepare ahead of time, and you can even do automated offline upgrades with apt-offline and some scripting.

Maybe they run Debian Testing. Testing and Unstable (sid) are rolling, and the stable release cut from the testing branch (through some process)

idoubtit 11mo ago

Not the Grand Poster, but we use the Debian package "unattended-upgrades" to install security updates automatically on our servers, and send an email if a reboot is required to complete the process (kernel upgrade). Unattended upgrades could be configured to install more than the security release. Even with the stable release, one can add the official APT source for the Debian backports.

SoftTalker 11mo ago
Back to OpenBSD... realize that it has no "unattended upgrades" capability. Until syspatch(8) appeared in 6.x you had to download patches and rebuild kernel and userland to get security fixes. Today, you could run syspatch(8) in a cron job but that only covers the base system. You'd need to handle any installed packages separately. And only the current and immediately previous release are supported at all. There are two releases a year, so you have to upgrade every ~6 months to stay in the support window. Fortunately, with the introduction of the syspatch(8) and sysupgrade(8) utilities this is much simpler than it used to be. And, release numbers are just sequential with one point number, i.e. 7.0 was just the next release after 6.9, nothing more is implied by the "major" number ticking up.
itopaloglu83 11mo ago
Just curious, how do you manage service restarts, just restart as the update finishes? I think I’m a bit scarred when a docker upgrade took my entire stack down because of an api mismatch with portainer, so I’m trying to be present during upgrades. Edit: I’m talking about Debian of course. I’m not familiar with OpenBSD.
- pabs3 11mo ago
  Use needrestart, you can mostly automate those restarts with it.

epakai 11mo ago

Debian still has security fixes, and point releases. unattended-upgrades is the package that automates their install. I think you can also do unattended release upgrades by using the 'stable' release alias in sources. That will probably result in some stuff breaking since there will be package and configuration churn.

pabs3 11mo ago

I use unattended-upgrades with Debian's rolling release (aka testing). Mostly works fine apart from bugs in unattended-upgrades, or when my boot partition runs out of disk.

pabs3 11mo ago

In case you are talking about automated upgrades between releases, there are some ideas for that here: https://wiki.debian.org/AutomatedUpgrade https://wiki.debian.org/AutomatedUpgrade It is feasible to do if you prepare ahead of time, and you can even do automated offline upgrades with apt-offline and some scripting.