While you may already be using unattended-upgrades package to keep your Ubuntu machine up to date, you will find yourself frequently doing reboots to fully patch your system.
Unattended-upgrades will upgrade most packages on your system but when you log in you will frequently see:
*** System restart required ***
Starting with Ubuntu 16.04 a new feature has been offered called Canonical Livepatch Service. This service will allow you to auto-upgrade security updates without requiring a reboot.
"The Livepatch Service intends to address high and critical severity Linux kernel security vulnerabilities, as identified by Ubuntu Security Notices and the CVE tracker. Since there are limitations to the kernel livepatch technology, some Linux kernel code paths cannot be safely patched while running. There may be occasions when the traditional kernel upgrade and reboot might still be necessary."
- Canonical Livepatch F.A.Q.
Canonical Livepatch will patch most security updates while the kernel is running and will not require a reboot. You will still get the "reboot required" messages for some packages but the requirement to reboot will be a lot less frequent and not as critical.
Livepatch is a paid service offered by Canonical but you can enable it for up to three machines for free.
You will first need to create a Canonical account here.
I recommend selecting Ubuntu User unless you have a paid service contract.
You will receive a token that you can use for your installation.
Then you need to install the livepatch module.
sudo snap install canonical-livepatch
Finally, enable livepatch using the token you received in the first step.
sudo canonical-livepatch enable [YOUR NEW TOKEN]
If you want to verify everything is good, use the following command:
canonical-livepatch status --verbose
