Or asked the other way around: How long do you keep your servers running without installing any software updates?

update means something like

sudo dnf update

or something …

apt-get upgrade
apt-get update
  • mjr@infosec.pubEnglish
    42·
    1 year ago

    Those apt commands are in a less-good order. It’s usually better to update apt, then upgrade the system.

    I upgrade as soon as reasonably possible after the notification appears, if the system isn’t on auto-upgrade.

    • njordomir@lemmy.worldEnglish
      1·
      1 year ago

      I do sudo apt update && sudo apt upgrade

      Is there any reason to not combine the commands since the output always prompts prior to changes anyway?

      • cyberwolfie@lemmy.mlEnglish
        4·
        1 year ago

        I think their point was to make sure they are done in order, i.e. update before upgrade, not the other way around as in OPs example.

  • dust_accelerator@discuss.tchncs.deEnglish
    301·
    1 year ago

    Every night at ~ 12-1am

    unattended updates / transactional-update are awesome.

    Stuff has been running for years, and it’s still up to date.

    • DasFaultier@sh.itjust.worksEnglish
      1·
      1 year ago

      This is the way! At least install security upgrades nightly using unattended-upgrades and reboot from time to time to get the latest Kernel version.

    • JustEnoughDucks@feddit.nlEnglish
      1·
      1 year ago

      I wish I could use unattended-upgrade.

      It literally restarts my server even when I disable the option, leaving it hung if the USB boot key isn’t in there.

      I had to stop using it, so now I just manually upgrade because that doesn’t auto-restart without my permission…

  • Dran@lemmy.worldEnglish
    17·
    1 year ago

    Unattended-upgrade does security-only patching once every 4 hours (in rough sync with my local mirror)

    Full upgrades are done weekly, accompanied by a reboot

    I find that the split between security patching and feature/bug patching maintains a healthy balance knowing when something is likely to break but never being behind on the latest cve.

    • cenzorrll@piefed.caEnglish
      1·
      1 year ago

      For me, unattended-upgrade does it’s thing. Updating other packages happens whenever I think about it. Very few things are not containerized and there’s very little added beyond the base Debian install, so when I do update its maybe a dozen packages.

      I would previously reboot during thunderstorms if we lost power, but now that I’ve got a UPS I probably ought to come up with a different plan.

  • Sneezycat@sopuli.xyzEnglish
    12·
    1 year ago

    Well, one of the reasons I’m using debian on my server is so I can kinda forget about it…

    I’ll update maybe once a month, or every couple months. I don’t always restart though, so my kernel is probably a bit behind :'D

    • PlanterTree@discuss.tchncs.deOPEnglish
      4·
      1 year ago

      lol. Same issue for me. I run it for months, and surprisingly (for me) nothing breaks at all.

      But fucking ssh shows warnings regarding some “post quantum crypto” stuff; recommending software update, that was not there before lol.

    • atzanteol@sh.itjust.worksEnglish
      3·
      1 year ago

      That’s… Not how it works… Debian is “stable” not “secure”. You use Debian so that is easier to run updates frequently since they’ll be unlikely to break things.

      • Sneezycat@sopuli.xyzEnglish
        1·
        1 year ago

        If I wanted to run updates frequently I would run arch lmao. Even if I did apt update every day, debian stable doesn’t get that many updates.

        I could just run auto-update but meh.

  • slazer2au@lemmy.worldEnglish
    8·
    1 year ago

    Once a week. I have a bash script that does an apt update upgrade and pulls new docker images.

  • confusedpuppy@lemmy.dbzer0.comEnglish
    3·
    1 year ago

    On Alpine Linux I update my two Pi servers at 2 in the morning daily. It’s simpler compared to Debian which needs unattended-updates. Just add apk update && apk upgrade to a cron job and you’re good to go.

    I only have three docker services which is simple enough to update manually.

    I like to keep things as simple as possible for my already chaotic brain.

    • non_burglar@lemmy.worldEnglish
      4·
      1 year ago

      Be careful with unattended upgrades, even on alpine. A recent breaking change in python3 broke my alpine 23 ansible instance. Thankfully I have backups, but if you’re going to automate the upgrade, you should automate tests as well.

      • confusedpuppy@lemmy.dbzer0.comEnglish
        1·
        1 year ago

        My web facing server has just enough packages installed to (kinda securely) host a Caddy and Kiwix docker container to work with my domain name and make a comfortable work environment through SSH. My Pi for my HomeAssistant docker container has less because it’s locked down to just my local network.

        I also wrote my own install scripts so reinstalling everything and getting it back to a running state would take about 15 minutes for each device.

        And I also wrote my own backup/restore scripts that evolved over 3/4 of a year. I use them often so I have confidence in those scripts.

        I personally don’t really care too much. I have multiple ways of dealing with issues for something that’s a hobby to me. Which is why I stick to simplicity.

        I’m sure this is a thing for people to worry about when dealing with more complex setups. I just wanna vibe out in my tiny corner of the internet.

      • confusedpuppy@lemmy.dbzer0.comEnglish
        2·
        1 year ago

        apk seems to have some tricks in there that aren’t as well known.

        I managed to catch in the IRC channel that apk add doc will automatically download any related man pages for packages with any future downloads through apk. That made life a bit more convenient instead of downloading all those packages separately.

  • lemming741@lemmy.worldEnglish
    3·
    1 year ago

    Probably every 2 months. When I have a day off work with nothing to do. I have a few VMs that are more fragile than I want to admit and if something breaks I want to have time to tinker instead of just restoring a backup.

  • L3ft_F13ld!@lemmy.dbzer0.comEnglish
    3·
    1 year ago

    I SSH in and run an update manually, once a week.

    I’m not knowledgable and comfortable enough to let updates happen automatically and feel like I could trust it to keep running. Not yet, anyway.

    Edit: But at some point I might do what another commenter said and make sure security updates run automatically and check other updates weekly.

  • deleted@lemmy.worldEnglish
    3·
    1 year ago

    I do it every 3 to 5 days. I usually do it when I have time to fix things if it goes south.

  • lambalicious@lemmy.sdf.orgEnglish
    3·
    1 year ago

    Only mostly when I want to. Which tends to be on Mondays and Saturdays.

    I’m running Sid on servers, so automatic updates are actually a risk. Used to be Debian Stable, but maaan the docker and podman improvements… make me drool.

  • Shimitar@downonthestreet.euEnglish
    41·
    1 year ago

    Gentooer here. Emerge sync &; world daily at night.

    Weekly a manual check for stuff that doesn’t autoupdate for reasons.

    Monthly / biweekly podman compose pull for containers. Manual, because i don’t trust that kind of autoupdate.

    Edit: opnSense updates are manual only when I remember because if it breaks, I must be at home to fix it or i lose remote access and that’s bad.

  • jimmy90@lemmy.worldEnglish
    2·
    1 year ago

    my nixos containers and the podman containers inside them update nightly around 03:00