Keeping your agent's Ubuntu server patched, without breaking anything
Ubuntu already auto-installs security updates. The real decisions are reboots and what not to auto-upgrade. How unattended-upgrades works, the reboot-required mechanics, and the agent-box policy.
Good news first: an Ubuntu server already patches itself. The unattended-upgrades package is installed by default and applies security updates automatically from day one. What’s not automatic are the two judgment calls: reboots (off by default: you decide when kernel updates actually take effect) and everything beyond the security pocket. For a box whose job is running an AI agent around the clock, the sane policy is: let security updates flow, schedule reboots deliberately, and never auto-upgrade the agent runtime itself.
What Ubuntu already does for you
Per Ubuntu’s own docs: “Ubuntu will apply security updates automatically, without user interaction,” enabled right after installation, including ESM updates where available. The machinery is two small files: /etc/apt/apt.conf.d/20auto-upgrades (whether and how often: default daily) and 50unattended-upgrades (behavior). The default scope is deliberately conservative: the security pocket plus the release pocket, not the general -updates stream, so what lands automatically is fixes, not feature churn. Worth knowing while we’re here: Ubuntu phases regular updates gradually across the fleet (“kept back” packages are normal), but “security updates are never phased.”
The reboot question, mechanically
Some updates (the kernel, glibc) only take effect after a reboot. When one lands, its install hook writes /var/run/reboot-required (with the package names in a sibling file), and that’s all: by default nothing reboots. The shipped config carries the option, commented out, in capital letters: automatically reboot WITHOUT CONFIRMATION if the flag file exists, plus the civilized variant, Automatic-Reboot-Time "02:00". Your three options, in rising order of hands-off:
- Manual: check
cat /var/run/reboot-requiredon a calendar reminder and reboot when it suits you. - Scheduled auto-reboot: enable Automatic-Reboot with a night-time hour. Fine for an agent box if everything on it comes back by itself, which a properly installed gateway does (OpenClaw’s service resurrects on boot; the same property you occasionally curse is the one that makes 2am reboots safe).
- Livepatch: Canonical’s rebootless kernel patching for critical/high vulnerabilities, free via Ubuntu Pro for up to five personal machines. It shrinks the exploit window; you still reboot eventually.
What not to automate
The OS layer wants to be current; the agent layer wants to be pinned. An always-on agent is a long-running stateful system, and surprise runtime upgrades are how it breaks while you’re asleep. Updating OpenClaw deliberately (read the release, back up state, verify after) is its own discipline, separate from OS patching. The same logic applies to Docker images (pin tags, don’t ride latest) and Node versions. One more automation footnote: if you script any of this, remember Ubuntu’s socket-activated SSH: restart, not reload, or your hardening script dies on fresh boxes.
A policy that fits on an index card
Security patches: automatic (already true). Reboots: scheduled weekly-ish at a quiet hour, or manual on a reminder. Either is fine, “never” is not. Agent runtime and containers: pinned, upgraded deliberately, with a backup you’ve actually restored before big jumps. Everything else: apt update && apt upgrade when you’re at the keyboard anyway (plain upgrade never removes packages; save full-upgrade for when you’ve read why it wants to). That’s the whole job: a few minutes a month, or the standing half of what a managed OpenClaw host does for its keep.