Patch management sounds solved until a vulnerability lands and you remember your box has not rebooted in four months. The boring trio — automatic security updates, livepatch, and a reboot cadence — covers it without any drama.
Automatic security fixes
apt install -y unattended-upgrades
# /etc/apt/apt.conf.d/20auto-upgrades:
APT::Periodic::Update-Package-List "1";
APT::Periodic::Unattended-Upgrade "1";Limit it to security updates so you are not getting random package surprises, and set it to download and install automatically. Review the list occasionally so you notice what counts as “security” on your release.
livepatch for the kernel
sudo snap install canonical-livepatch
canonical-livepatch enable XXXKEYHERE
canonical-livepatch status --verboseCanonical livepatch applies kernel security fixes without a reboot. It is not a substitute for an eventual reboot — some fixes still need one — but it removes the urgent middle-of-the-night gap.
The reboot you will not skip
Plan a monthly reboot and check needs-restarting after kernel updates. A patch you never apply because you never reboot is a hole you chose.