OS updates

The OS Updates section of a server (/servers/:id/os-updates) keeps the box’s operating system patched. It lists pending apt package updates, flags security fixes, lets you apply them (all, security-only, or one at a time) with live output, sets an unattended-upgrade policy, and shows a history of past update runs. It’s available on all plans.

Apply updates, step by step

1. Click Check for updates to refresh the package index (apt-get update) so the pending list is current. The summary shows pending updates, security fixes, the download size, and when the box was last checked.
2. Review the Pending updates list. Each row shows the package name, its current → candidate version, and a red Security pill for security-pocket updates.
3. Choose how much to apply:
   • Update on a single row — upgrade just that package.
   • Update security only — upgrade only the packages flagged as security fixes.
   • Update all — a full dist-upgrade; you’ll confirm first, since it can touch core libraries and may need a reboot.
4. Output streams live into a log panel as apt runs, ending with the exit code. The list refreshes itself when the run finishes.

Caution

apt has no rollback. A full Update all can pull in kernel and libc changes — for a critical server, take a backup first.

What else you can do

• Reboot when required — after a kernel or core-library update, a Reboot required banner appears. Click Reboot now (with a confirm) to restart the box; the agent reconnects automatically once it’s back.
• Automatic updates — pick a policy with the segmented control: Off, Security only, or All. This is powered by unattended-upgrades and saves the moment you change it.
• Reboot time & auto-reboot — when a policy is on, set the hour unattended reboots may happen and toggle Auto-reboot when required so a kernel/libc update can finish on its own at that time.
• Live kernel patching — under Live kernel patching, paste your own Ubuntu Pro token to enable Canonical Livepatch, applying high/critical kernel CVE fixes to the running kernel without a reboot. The token is free for up to 5 machines and is never echoed back.
• Recent update runs — the History list shows past transactions (manual and unattended), each expandable to the exact command, duration, and per-package version changes.

How it works

Every action dispatches an updates.* (or system.reboot) job to the server’s agent, which runs it natively — no shell-out to a mz process:

Action	Job	Agent runs
Pending list + counts	updates.list	updates --json (served from the agent’s cache)
Check for updates	updates.refresh	apt-get update, streamed
Update one package	updates.apply	apt-get install --only-upgrade <pkg>
Update security only	updates.apply	derives -security packages, upgrades those
Update all	updates.apply	apt-get dist-upgrade -y, streamed
Auto-update policy	updates.auto	rewrites 20auto-upgrades + an MZPanel drop-in
History	updates.history	parses /var/log/apt/history.log (+ rotated .gz)
Live patching	livepatch.*	the Ubuntu Pro pro CLI
Reboot	system.reboot	schedules a detached reboot

The pending list is read from the agent’s pushed inventory cache rather than a live scan — the apt scan is slow (~4s), so it rides the 5-minute batch and refreshes after any apply/refresh/policy change. State lives on the box: the auto-update policy is a config fragment at /etc/apt/apt.conf.d/52unattended-upgrades-mz, and history comes from apt’s own logs.

CLI & automation

Every action here maps to an mz updates command on the box — the same engine the dashboard drives. SSH in and run them directly, or let an on-box AI (ClaudeCode) run them:

mz updates --json                          # pending packages + counts + reboot flag
mz updates refresh                         # apt-get update, streams output
mz updates apply --security                # upgrade only security-pocket packages
mz updates apply --all                     # full dist-upgrade, streams output
mz updates auto security --reboot-time 04:00 --auto-reboot on
mz updates history                         # recent apt transactions (JSON)

Apply a specific set with mz updates apply --only nginx,openssl. Pass --json for machine-readable reads. See The mz CLI and the command catalog.

Gotchas & troubleshooting

• Offline shows a preview, not the real box. When the agent is offline the page renders a deterministic sample list behind a Preview — agent offline banner; the pending packages, history, and download size shown are placeholders. Bring the agent online for real data and to apply anything.
• Download size can read 0. The live apt scan doesn’t carry a per-package byte size, so individual rows omit it and the “to download” total may be small or zero even with updates pending — it’s not an error.
• “Update all” has no undo. It’s a full dist-upgrade — confirm the modal warning and back up critical servers first.
• Reboot goes down immediately. Reboot now schedules a detached reboot and the box drops offline; the Reboot required banner clears on the next update read after the agent reconnects.
• Live patching needs Ubuntu Pro. If ubuntu-pro-client isn’t installed the card shows it as unavailable; enabling requires your own Pro token (ubuntu.com/pro). Not every kernel update is livepatchable — some still need a reboot.
• History security counts can under-report old runs. Security tagging cross-checks the current apt security lists, so a run whose security version has since been superseded may under-count; recent runs are accurate.

Related

• Cron jobs — scheduled tasks on the server.
• Backups — snapshot before a major upgrade.
• The mz CLI — driving the box from the command line.