Automated vulnerability patching at scale in Debian
summary
Automated patching uses unattended-upgrades scheduled by a systemd timer (or cron) to run apt update/upgrade daily, with repo-based blacklist/whitelist filtering and email/log outputs; a daemon called needrestart detects deleted/old binaries and restarts services automatically while noting cases that require a full reboot (dbus, kernel). Designed to scale to tens of thousands of machines, it integrates with monitoring, works for many packages, but does not eliminate reboot-only kernel updates or guarantee safe stateful-app restarts without additional orchestration.
AI-written summary · about
chapters (6)
- 0:00Introduction
- 1:29Why vulnerability patching matters
- 3:54Unattended-upgrades in Debian
- 8:07Service restarts after updates
- 10:59Future scope and live patching
- 12:04Q&A
related talks
30mSoftware Patching Needn't Be a Can of Worms
21mKeepers of the Machines: Examining How System Administrators Manage Software Updates
01h 02mRebootless updates
56mComparison of Linux Software Update Technologies
17mSustaining Yesterday’s Linux: Delivering Security for Today’s Workloads
18mKernel Live Patching: Mitigating CVEs With Zero Downtime
26mEngineering for the Long Haul: Operating Open Source at Scale
53mAn engineer's guide to Linux Kernel upgrades