How to Automate Linux Server Updates with Unattended-Upgrades

Forgetting to patch a server is one of the easiest ways to leave it vulnerable to known exploits. Learning how to automate Linux server updates ensures critical security patches get applied consistently, even if you’re busy, traveling, or simply forget to log in and run updates manually for a few weeks.

Why Automate Updates?

Security vulnerabilities are disclosed and patched constantly, and attackers frequently target systems running outdated software with known, publicly documented exploits. A homelab or personal server left unpatched for months is a much easier target than one receiving regular security updates the moment they’re released.

Installing Unattended-Upgrades

On Debian and Ubuntu-based systems, the unattended-upgrades package handles this automatically:

sudo apt update
sudo apt install unattended-upgrades -y

Enabling Automatic Security Updates

Run the configuration wizard to enable automatic updates:

sudo dpkg-reconfigure --priority=low unattended-upgrades

Select Yes when prompted to enable automatic updates.

Customizing What Gets Updated

Open the configuration file to fine-tune behavior:

sudo nano /etc/apt/apt.conf.d/50unattended-upgrades

Inside, you’ll find a list of update origins. By default, only official security updates are enabled — this is the safest setting, since it avoids automatically applying feature updates that could introduce unexpected changes or break compatibility with existing configurations.

Configuring Automatic Reboots (Optional)

Some security updates, particularly kernel patches, require a reboot to take effect. You can enable automatic reboots at a scheduled time in the same configuration file:

Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "03:00";

This reboots the server at 3 AM only if an update actually requires it, minimizing disruption for services running during active hours.

Setting Update Frequency

The frequency of update checks is controlled in a separate file:

sudo nano /etc/apt/apt.conf.d/20auto-upgrades

Typical settings look like:

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";

This checks for and applies updates daily.

Getting Notified of Updates

To stay informed about what’s being updated automatically, configure email notifications in the same 50unattended-upgrades file:

Unattended-Upgrade::Mail "your-email@example.com";
Unattended-Upgrade::MailReport "on-change";

This sends a summary email only when updates are actually applied, rather than flooding your inbox daily.

A Balanced Approach for Homelabs

Fully automatic updates work well for security patches, but consider leaving feature/version upgrades manual — reviewing and applying those yourself gives you control over timing and lets you check changelogs for anything that might affect your specific setup, like Docker, Proxmox, or custom configurations.

Final Thoughts

Setting up a system to automate Linux server updates removes one of the most common causes of preventable security incidents: simply forgetting to patch known vulnerabilities. With unattended-upgrades handling security patches automatically and email notifications keeping you informed, your homelab stays protected with minimal ongoing effort.