I use various Linux Distros, mostly Debian-based, usually all default (I change nothing in the kernel/shell or internal-utilities (utilities that come with the distro). I usually install Apache, MySQL and PHP on these systems and doesn't change there anything either.

I never did a kernel upgrade to any system as I don't recall ever having such a need or getting some local mail requiring that.

I know that configuration-management (CM) tools, like Ansible, use to orchestrate, deploy and maybe also automate basically everything above the OS layer (which includes the kernel, of course) but of curiosity - can one "dive down" with Ansible to the kernel and automate kernel upgrades with it as well?

Please also share if you think it's a best practice in a basically all-default system (a system where the distro itself - its kernel, shell(s) and internal utilities aren't changed at all).

  • To be perfectly clear, Ansible and most other CM tools don't just automate things "above the OS layer". You can install packages with Ansible, and perform package-manager driven upgrades, as well as manually install software; these include OS necessary packages like the kernel. You can even go so far as to automate a process like compiling a custom kernel from source, if you wanted to put the effort into writing the playbook.
    – 0xSheepdog
    May 2, 2019 at 15:08

2 Answers 2


With most modern Linux distros, the kernel is distributed as a package, just like any other piece of software/library. Therefore, with Ansible as the example, you can have a task such as:

- name: Ensure that latest kernel is installed
    name: linux-image-amd64
    state: latest
    update_cache: yes
  notify: reboot_server # You would need a corresponding handler that reboots the system

and this will ensure that each time the play is run, the latest kernel package will be installed.

The kernel is however different to most other software packages in that:

  • Multiple versions can be installed simultaneously, so you need to manage the removal of older versions. You don't necessarily want to do this automatically because:
  • To enable a newly installed kernel, you need to reboot the system, so that needs to be managed, both from a business process POV and also technically. This is not an entirely risk free operation, so dependent on the nature of the system architecture, is often not seen as being an appropriate task to simply automate.

There are methods to activate a newly installed kernel without a reboot, but they are still not really a mainstream approach.

As to whether you should do kernel updates, in general yes. Given the litany of high profile security failures as a result of out of date software (and the high profile failures likely being just the tip of the iceberg), all software should be kept up to date. The recent Meltdown and Spectre vulnerabilities underline that the kernel is not special, and needs to be kept up to date like any other package.

Maintaining an effective patching policy needs serious thought given the trade off between the failures that can occur during the process, versus the failures that can occur if it is not done. Automation can certainly help, but each environment is different so you have to examine your own requirements to assess to what extent it is appropriate in your own case.

Either way, if when you say:

(a system where the distro itself - its kernel, shell(s) and internal utilities aren't changed at all)

you mean that once installed, you never revisit and patch/update/upgrade those elements, you are significantly increasing the risk of your system being compromised.

  • Hi, I didn't understand the last part of the answer. Please edit it. I should tell you (and will edit the question to clarify) that I usually use my Debian-LAMP environments all-default; I change (customize) basically nothing in the kernel/shell/internal-utilities or in LAMP.
    – user149572
    Dec 19, 2018 at 11:40
  • I have edited and hopefully that clears up any confusion. Dec 19, 2018 at 11:53

Yes, given the OS Kernel is software and not firmware (like a BIOS or Boot Loader), it can be changed from the shell, as well as a CM that would change it through implementing the shell in its particular way (like Ansible's YAML dialect).

You must log in to answer this question.