But in 2026, the main reason for regular updates is security. What update frequency that translates into for your environment is obviously up to you.
If you expose services to the internet, you need to update daily.
Otherwise, your update frequency probably will quickly align with the desired convenience of this task.
Full disclosure: I update the daily driver more than once a week, I try to update main server(s) about once a week, and I try to update “appliances” monthly.
Know your threat model and adjust the update frequency accordingly.
The fun bit is with all the supply chain attacks tools are starting to add the ability to not update until a release is X hours old. The fun of “omg I need to patch now!” and “omg I pulled in a compromised package that was only around for 4 hours before being pulled”
So right now it’s more like patch asap, but don’t apply packages that have been published for less than X hours. I think a lot of the tools default to 3 days, but the average lifespan of a compromised release is like 7 hours?
Oh, and for your question when I used Ubuntu I normally set apt autoupdate to either every day or every 3 days and to auto reboot in the middle of the night.
For containers I never found a good way to automate updates outside of kubernetes. I’m sure someone else here has a good suggestion container management/update platforms.
