Or asked the other way around: How long do you keep your servers running without installing any software updates?

update means something like

sudo dnf update

or something …

apt-get upgrade
apt-get update
  • mjr@infosec.pubEnglish
    55·
    8 days ago

    Those apt commands are in a less-good order. It’s usually better to update apt, then upgrade the system.

    I upgrade as soon as reasonably possible after the notification appears, if the system isn’t on auto-upgrade.

    • njordomir@lemmy.worldEnglish
      3·
      8 days ago

      I do sudo apt update && sudo apt upgrade

      Is there any reason to not combine the commands since the output always prompts prior to changes anyway?

      • cyberwolfie@lemmy.mlEnglish
        4·
        8 days ago

        I think their point was to make sure they are done in order, i.e. update before upgrade, not the other way around as in OPs example.

  • dust_accelerator@discuss.tchncs.deEnglish
    411·
    8 days ago

    Every night at ~ 12-1am

    unattended updates / transactional-update are awesome.

    Stuff has been running for years, and it’s still up to date.

    • DasFaultier@sh.itjust.worksEnglish
      5·
      8 days ago

      This is the way! At least install security upgrades nightly using unattended-upgrades and reboot from time to time to get the latest Kernel version.

    • gopher@programming.devEnglish
      2·
      8 days ago

      Once per week for me. Works really great on openSUSE MicroOS. Had to roll back maybe a couple of times the last few years.

      That said, I run basically everything in containers so the OS installed things are lean.

    • JustEnoughDucks@feddit.nlEnglish
      1·
      8 days ago

      I wish I could use unattended-upgrade.

      It literally restarts my server even when I disable the option, leaving it hung if the USB boot key isn’t in there.

      I had to stop using it, so now I just manually upgrade because that doesn’t auto-restart without my permission…

      • vegetaaaaaaa@lemmy.worldEnglish
        1·
        7 days ago

        unattended-upgrades doesn’t do that unless you explicitly specify Unattended-Upgrade::Automatic-Reboot "true"; in the config. Check /usr/share/doc/unattended-upgrades/README.md.gz

        The main configuration file is /etc/apt/apt.conf.d/50unattended-upgrades, maybe you put your config in the wrong place?

        here is mine

  • Dran@lemmy.worldEnglish
    23·
    8 days ago

    Unattended-upgrade does security-only patching once every 4 hours (in rough sync with my local mirror)

    Full upgrades are done weekly, accompanied by a reboot

    I find that the split between security patching and feature/bug patching maintains a healthy balance knowing when something is likely to break but never being behind on the latest cve.

    • cenzorrll@piefed.caEnglish
      3·
      8 days ago

      For me, unattended-upgrade does it’s thing. Updating other packages happens whenever I think about it. Very few things are not containerized and there’s very little added beyond the base Debian install, so when I do update its maybe a dozen packages.

      I would previously reboot during thunderstorms if we lost power, but now that I’ve got a UPS I probably ought to come up with a different plan.

  • Sneezycat@sopuli.xyzEnglish
    17·
    8 days ago

    Well, one of the reasons I’m using debian on my server is so I can kinda forget about it…

    I’ll update maybe once a month, or every couple months. I don’t always restart though, so my kernel is probably a bit behind :'D

    • atzanteol@sh.itjust.worksEnglish
      51·
      8 days ago

      That’s… Not how it works… Debian is “stable” not “secure”. You use Debian so that is easier to run updates frequently since they’ll be unlikely to break things.

      • Sneezycat@sopuli.xyzEnglish
        21·
        8 days ago

        If I wanted to run updates frequently I would run arch lmao. Even if I did apt update every day, debian stable doesn’t get that many updates.

        I could just run auto-update but meh.

        • atzanteol@sh.itjust.worksEnglish
          2·
          8 days ago

          If I wanted to run updates frequently I would run arch lmao. Even if I did apt update every day, debian stable doesn’t get that many updates.

          You’re not updating for features you’re updating for bug and security fixes. That’s why Debian stable doesn’t have many updates. But the ones they do are typically important.

          • Sneezycat@sopuli.xyzEnglish
            1·
            8 days ago

            No, my home server. My desktop and laptop both have arch, because I do interact with them more often.

    • PlanterTree@discuss.tchncs.deOPEnglish
      4·
      8 days ago

      lol. Same issue for me. I run it for months, and surprisingly (for me) nothing breaks at all.

      But fucking ssh shows warnings regarding some “post quantum crypto” stuff; recommending software update, that was not there before lol.

  • slazer2au@lemmy.worldEnglish
    8·
    8 days ago

    Once a week. I have a bash script that does an apt update upgrade and pulls new docker images.

  • Sir_Kevin@lemmy.dbzer0.comEnglish
    4·
    8 days ago

    On Windows, almost never since it was a disruptive shitshow. Now that I’ve got everything running Linux it’s weekly. Often sooner if I happen to be remoting in and manually update.

  • deleted@lemmy.worldEnglish
    4·
    8 days ago

    I do it every 3 to 5 days. I usually do it when I have time to fix things if it goes south.

  • hexagonwin@lemmy.sdf.orgEnglish
    4·
    8 days ago

    maybe like once in 3 months. i usually update when i need to setup something new on the server that needs to install new packages.

  • confusedpuppy@lemmy.dbzer0.comEnglish
    3·
    8 days ago

    On Alpine Linux I update my two Pi servers at 2 in the morning daily. It’s simpler compared to Debian which needs unattended-updates. Just add apk update && apk upgrade to a cron job and you’re good to go.

    I only have three docker services which is simple enough to update manually.

    I like to keep things as simple as possible for my already chaotic brain.

    • non_burglar@lemmy.worldEnglish
      4·
      8 days ago

      Be careful with unattended upgrades, even on alpine. A recent breaking change in python3 broke my alpine 23 ansible instance. Thankfully I have backups, but if you’re going to automate the upgrade, you should automate tests as well.

      • confusedpuppy@lemmy.dbzer0.comEnglish
        2·
        8 days ago

        My web facing server has just enough packages installed to (kinda securely) host a Caddy and Kiwix docker container to work with my domain name and make a comfortable work environment through SSH. My Pi for my HomeAssistant docker container has less because it’s locked down to just my local network.

        I also wrote my own install scripts so reinstalling everything and getting it back to a running state would take about 15 minutes for each device.

        And I also wrote my own backup/restore scripts that evolved over 3/4 of a year. I use them often so I have confidence in those scripts.

        I personally don’t really care too much. I have multiple ways of dealing with issues for something that’s a hobby to me. Which is why I stick to simplicity.

        I’m sure this is a thing for people to worry about when dealing with more complex setups. I just wanna vibe out in my tiny corner of the internet.

      • confusedpuppy@lemmy.dbzer0.comEnglish
        2·
        7 days ago

        apk seems to have some tricks in there that aren’t as well known.

        I managed to catch in the IRC channel that apk add doc will automatically download any related man pages for packages with any future downloads through apk. That made life a bit more convenient instead of downloading all those packages separately.

  • Eager Eagle@lemmy.worldEnglish
    3·
    8 days ago

    everyday to once a month, depending how often I use the server

    IME usually waiting longer to apply larger updates causes more issues than smaller and more frequent ones

  • L3ft_F13ld!@lemmy.dbzer0.comEnglish
    3·
    8 days ago

    I SSH in and run an update manually, once a week.

    I’m not knowledgable and comfortable enough to let updates happen automatically and feel like I could trust it to keep running. Not yet, anyway.

    Edit: But at some point I might do what another commenter said and make sure security updates run automatically and check other updates weekly.