Reboot After Updates? needrestart, reboot-required and Ubuntu Livepatch Explained

Installing a security update does not always make a running server safe. A service that loaded the old version of a library keeps using it in memory until it restarts, and a new kernel only takes effect after a reboot. This guide explains the three tools Debian and Ubuntu administrators rely on to close that gap, needrestart, the /var/run/reboot-required flag and Ubuntu Livepatch, and how to fit them into a maintenance routine.

What needs a restart, and why

• Libraries such as OpenSSL, glibc or libxml2: every process that loaded the old file keeps running the old code. Restarting those services is enough; the whole machine does not need a reboot.
• Daemons such as nginx, sshd or PostgreSQL: the package usually restarts its own service, but not always every related process.
• The kernel and CPU microcode: only a reboot loads them, unless a live patch covers the specific fix.
• Containers: updating the host does not update libraries inside container images. They need rebuilt images and restarted containers.

needrestart: which services still run old code

needrestart checks which daemons need to be restarted after library upgrades, and can also check for an obsolete kernel (needrestart(1)). After installation it runs from an apt hook every time packages are installed or upgraded.

sudo apt install needrestart

# list only, restart nothing
sudo needrestart -r l

# machine-readable summary for scripts and monitoring
sudo needrestart -b

The -r option sets the restart mode: l lists only, i asks interactively, a restarts automatically. The manual warns that if needrestart is set to interactive but runs non-interactively, for example from unattended-upgrades, it falls back to list-only. Batch mode (-b) never restarts anything. According to the upstream batch-mode documentation it prints the running kernel (NEEDRESTART-KCUR), the expected kernel (NEEDRESTART-KEXP) and a kernel status (NEEDRESTART-KSTA), where 1 means no pending upgrade, 2 an ABI-compatible upgrade pending and 3 a version upgrade pending. Each service that needs a restart appears on a NEEDRESTART-SVC line.

Ubuntu 24.04 restarts services automatically

The Ubuntu Server documentation notes that, starting with Ubuntu 24.04 LTS, needrestart restarts affected services automatically by default, except for a built-in list of cases such as the display manager. On production systems that can mean a critical service restarts at an unexpected time. Ubuntu recommends a file in /etc/needrestart/conf.d/ instead of editing the main configuration:

# /etc/needrestart/conf.d/local.conf
# list only and restart by hand in a maintenance window:
$nrconf{restart} = 'l';

# or keep automatic restarts but never touch one service:
$nrconf{override_rc} = {
    qr(^postgresql.*\.service$) => 0,
};

On Debian, check the $nrconf{restart} setting in /etc/needrestart/needrestart.conf on your own system rather than assuming a default. needrestart runs as root, so keep it updated too: in November 2024 Debian fixed local privilege-escalation flaws in it in DSA-5815-1, including CVE-2024-48990, rated 7.8 (High) by its CNA.

/var/run/reboot-required: the reboot flag

When an update needs a full reboot, a flag file appears at /var/run/reboot-required, with the responsible packages listed in /var/run/reboot-required.pkgs. On Debian, the unattended-upgrades package installs a kernel post-install hook that creates both files when a kernel package is installed. On Ubuntu, other packages also set the flag. unattended-upgrades only reboots on its own if Unattended-Upgrade::Automatic-Reboot is true and this file exists.

# is a reboot pending, and why?
ls /var/run/reboot-required 2>/dev/null && cat /var/run/reboot-required.pkgs

# running kernel vs installed kernels
uname -r
dpkg -l 'linux-image-*' | grep '^ii'

If uname -r shows an older version than the newest installed kernel, the server is still running the old kernel, whatever the flag says.

Ubuntu Livepatch: kernel fixes without an immediate reboot

Canonical Livepatch applies fixes for high and critical Linux kernel vulnerabilities to the running kernel. It is part of Ubuntu Pro and, according to Canonical, free for up to five machines for personal use or evaluation.

sudo pro attach YOUR_TOKEN
sudo pro enable livepatch
canonical-livepatch status

What it does not do matters just as much:

• It does not patch userspace libraries such as OpenSSL or glibc; those still need package updates and service restarts.
• It covers high and critical kernel issues. Lower-priority fixes only arrive by rebooting into a new kernel, as the kernel upgrade recommendation page explains.
• Patches are created for a kernel for up to 9 to 13 months from its release, depending on the kernel (supported kernels). You must still upgrade and reboot within that window.
• Canonical states plainly that Livepatch is not a replacement for rebooting. It moves the reboot into a planned window.

Livepatch is an Ubuntu service. On Debian, plan kernel reboots as part of normal maintenance.

Building a maintenance routine

1. Let security updates install automatically, or install them on a fixed schedule.
2. After each run, check needrestart -b and the reboot flag, or feed them into monitoring.
3. Restart flagged services the same day; most library fixes need nothing more.
4. Reboot for kernel updates in a weekly or monthly window. With unattended-upgrades, Unattended-Upgrade::Automatic-Reboot-Time "02:00"; sets the time. The value uses the server's own time zone, so check timedatectl: many cloud images run on UTC, where 02:00 is 05:00 in Riyadh.
5. Rebuild and redeploy container images on their own schedule.

What you should do

• Install needrestart on every Debian and Ubuntu server and decide deliberately between list-only and automatic restarts.
• Check /var/run/reboot-required and compare uname -r with the installed kernels after updates.
• On Ubuntu 24.04, exclude services that must not restart unannounced with $nrconf{override_rc} in /etc/needrestart/conf.d/.
• If you use Livepatch, still schedule kernel reboots before the coverage window for your kernel ends.
• On a self-managed VPS, including Skyline Cloud's Riyadh VPS, updates and reboots inside the server are yours to schedule, so put the window in your calendar.

Sources

• manpages.debian.org/trixie/needrestart/needrestart.1.en.html
• github.com/liske/needrestart/blob/master/README.batch.md
• documentation.ubuntu.com/server/how-to/software/automatic-updates
• github.com/mvo5/unattended-upgrades/blob/master/kernel/postinst.d/unattended-upgrades
• github.com/mvo5/unattended-upgrades/blob/master/README.md
• ubuntu.com/security/livepatch
• ubuntu.com/security/livepatch/docs/client/reference/platform/supported-kernels
• ubuntu.com/security/livepatch/docs/client/explanation/architecture/how-kernel-upgrade-r...
• ubuntu.com/security/livepatch/docs/client/how-to-guides/operations/check-client-status
• security-tracker.debian.org/tracker/DSA-5815-1
• cve.org/CVERecord?id=CVE-2024-48990
• cloud.alskyline.com/vps-saudi-arabia