I'm am using servers (debian 7) and I'm currently running cron-apt to e-mail me when there are new upgrades available.

Is the following command safe to run when new upgrades are shown?

sudo apt-get dist-upgrade

Are there any checks I should do before upgrading?

I'm a little concerned that simply upgrading everything every time I get an email might cause failures.

  • 2
    The first advice should be: do backup and check if you can restore from it – Romeo Ninov May 6 '15 at 8:29
  • 2
    IMHO, it really depends on the role of the server and the cost of possible downtime. I'm running a computational server here, which I can afford to be down for some time as long as not too many colleagues want to use it. For a web server this is completely different. In my case I run regular updates (because I can), while in the case of a web server I would only run security updates and perhaps regular package upgrades whenever I need their new features. – Benjamin B. May 6 '15 at 9:06
  • 3
    Seconding @BenjaminB. on this. I also mainly run security updates on application/database servers, only applying all the rest periodically. You can subscribe to security RSS channels for your distribution, for Debian that's going to be https://www.debian.org/security/dsa. That way you're likely to notice when some important security hole (and fix) pops up. – Erathiel May 6 '15 at 16:34

sudo apt-get dist-upgrade is very safe to run as it won't do anything to the system, instead stopping to ask for your confirmation ;) You would have to add a -y switch, which is intended for unattended upgrades and makes apt assume that you always answer 'yes' to questions: sudo apt-get -y dist-upgrade. The man page states that

If an undesirable situation, such as changing a held package, trying to install a unauthenticated package or removing an essential package occurs then apt-get will abort

but running dist-upgrade unattanded is always risky so you may want to avoid that.

You can always check what apt would do by adding a -s switch, like so: sudo apt-get -s dist-upgrade. This switches apt into simulation mode, in which no changes are made and you can safely review all the changes apt would make to the system.

There is also a more conservative mode of running apt, namely apt-get upgrade. The man page for apt-get is very clear on what it does:

Packages currently installed with new versions available are retrieved and upgraded; under no circumstances are currently installed packages removed, or packages not already installed retrieved and installed. New versions of currently installed packages that cannot be upgraded without changing the install status of another package will be left at their current version.

In my original answer I somehow assumed you're going to run dist-upgrade via cron, which, after reading more carefully, does not seem to be the case. However I'm leaving the relevant paragraph as a general comment:

It not advisable to run sudo apt-get -y dist-upgrade via cron, especially if your apt sources happen to point to a testing branch (which generally should not happen on servers, especially in production) as you may end up with an unusable system. You're relatively safe if you're using Debian's stable branch but I'd still recommend to attend upgrades.

Anyway, if you're doing a dist-upgrade that is going to perform serious changes you should always have a backup. Just in case.


There's a package for that ;-).

As well as cron-apt, which can be configured to perform certain upgrades automatically, another useful package is unattended-upgrades which is designed to safely apply security updates automatically.

Beyond that, as Erathiel says it's not safe to run dist-upgrade automatically, but it's safe enough to run it manually every time there's something to upgrade, as long as you don't blindly answer "Yes".


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.