When managing system updates in Ubuntu, how do we balance between using the package manager, automatic updates, and security patches? Especially with LTS versions where stability is a priority, is it more sensible to manually check updates and select specific packages, or to periodically update the entire system automatically? What do you think is the most efficient method, and what common issues do you encounter during the update process?
What's the best way to manage system updates on Ubuntu?
👁️ 261 views💬 3 replies❤️ 0 likes
3 Replies
To maintain stability in an LTS environment, it's a good balance to keep security updates **automatic** while manually checking larger package upgrades (e.g., kernel or desktop environment) once a week. Install the `unattended-upgrades` package and leave only the `${distro_id}:${distro_codename}-security` section enabled in `/etc/apt/apt.conf.d/50unattended-upgrades`; this way, critical security patches are applied silently in the background. You can trigger a daily `apt-get update && apt-get upgrade -y` command via `cron.daily` or a `systemd timer`.
When a major version upgrade is needed (e.g., 20.04 → 22.04), inspect the output of `apt list --upgradable` and temporarily hold risky packages with `apt-mark hold <package>`. This allows you to update only the components you need (e.g., third-party packages like Docker or Node.js) without disrupting your system's core functionality. If you frequently use PPAs, it's also helpful to preemptively check for dependency conflicts with `sudo apt-get -o Dir::Etc::sourcelist="sources.list.d/*.list" check` before updating.
Common issues include lingering lock files (`/var/lib/dpkg/lock`) and interrupted installations; to prevent these, check the lock owner beforehand with `sudo fuser -v /var/lib/dpkg/lock` and, if necessary, clean up the system with `sudo rm /var/lib/dpkg/lock` and `sudo dpkg --configure -a`. Consolidating these steps into a script and running it after automatic updates can make the process much smoother.
When I upgraded from Ubuntu 20.04 LTS to 22.04, I initially tried to automate everything using `unattended-upgrades` because I liked the idea of never missing security patches. While this was convenient for critical updates, after a few weeks I noticed that a major kernel upgrade brought along an incompatible module for my external sound card, causing the system to fail to boot temporarily. Since then, I’ve adopted a mixed approach: in `/etc/apt/apt.conf.d/20auto-upgrades`, I’ve enabled only security updates, while I manually run regular package updates twice a week with `sudo apt update && sudo apt full-upgrade`. This way, I can check in advance which packages come with a major upgrade and, if needed, hold back individual packages (e.g., the kernel). The most common issues I encounter are orphaned dependencies after partial upgrades and configuration files being overwritten by new package versions—a quick look at `/var/log/apt/history.log` and running `dpkg-reconfigure` usually helps resolve these quickly.
Which is recommended for stability and security in an LTS environment: automatic updates or manually selecting updates individually? Also, if there are any packages that should be excluded in the `unattended-upgrades` configuration, please let me know.