How to Update Ubuntu Server (apt update, apt upgrade and When to Reboot)
A server that isn't updated is a server waiting to be broken into. Fortunately updating Ubuntu is two commands, takes a minute, and almost never needs a reboot. Here's what the commands mean, what to do when a reboot is needed, and how to fix things when an update goes wrong.
Quick reference
| Task | Command |
|---|---|
| Refresh the list of available updates | sudo apt update |
| Install them | sudo apt upgrade -y |
| Do both in one go | sudo apt update && sudo apt upgrade -y |
| Remove leftovers | sudo apt autoremove -y |
| Check whether a reboot is needed | cat /var/run/reboot-required |
| Reboot | sudo reboot |
1. apt update
sudo apt update
This doesn't install anything. It downloads the latest list of what's available from Ubuntu's servers. At the end it says something like "12 packages can be upgraded".
2. apt upgrade
sudo apt upgrade -y
This installs them. The -y answers "yes" to the confirmation so you're not sitting there waiting. Leave it off if you want to read the list first.
Most people chain the two:
sudo apt update && sudo apt upgrade -y
3. Does it need a reboot?
Most updates take effect immediately. Kernel updates don't — the kernel is the core of the system and only changes on restart. Ubuntu tells you at login (" System restart required "), or you can check:
cat /var/run/reboot-required
If the file exists, reboot when convenient:
sudo reboot
Your SSH session drops; reconnect after a minute.
4. Tidy up
sudo apt autoremove -y
This removes old kernels and libraries nothing uses any more. Do it every few updates to stop /boot filling up.
What about full-upgrade?
sudo apt full-upgrade is the same as upgrade but is allowed to remove packages if that's needed to install a new one. You'll rarely need it; Ubuntu will tell you ("The following packages have been kept back") when you do.
How often?
Weekly is fine for a home server. Better still, let the server install security updates by itself — that's tutorial 36 in this series.
Troubleshooting
"Could not get lock /var/lib/dpkg/lock." Another update is already running, often the automatic one just after boot. Wait a couple of minutes and try again.
"Unable to locate package." You haven't run apt update yet, or the package name is misspelt. Try apt search name.
An update was interrupted (power cut, closed the terminal). Run sudo dpkg --configure -a and then sudo apt install -f to finish what it started.
"You have held broken packages." Run sudo apt --fix-broken install.
Wrapping up
update fetches the list, upgrade installs it, autoremove cleans up, and reboot only when the server says so. Make it a Monday-morning habit until you've set up automatic updates, and your server will stay patched with very little effort.
