Patching a Docker Host¶

Machine translation of the French original.

Applying updates to packages without shutting down the containers.

Principle¶

Security patches are applied by default, without prior validation. What is checked is the after: which services depended on the updated package, and have they restarted successfully?

The seven Linux hosts in the fleet are patched automatically at night (as noted on 2026-10-06: vm-claude, vm-docker, vm-addons, vm-agents, vm-compute-01, vm-compute-02, vps-fr-ovh; the hypervisor stack itself remains manually patched); restarts, when necessary, occur between 00:05 and 03:00. A removed package generates a notification that includes the action of replacement, not just the removal.

Manual Procedure¶

HOST="ssh -p <port-ssh> <user>@vm-docker"

# 1. ce qui est en attente
$HOST "sudo apt-get update -qq && apt list --upgradable 2>/dev/null | tail -n +2"

# 2. appliquer
$HOST "sudo DEBIAN_FRONTEND=noninteractive apt-get -y upgrade"

# 3. un redémarrage est-il nécessaire ?
$HOST "test -f /var/run/reboot-required && cat /var/run/reboot-required.pkgs || echo 'aucun redemarrage requis'"

# 4. quels services tournent encore sur des bibliothèques supprimées ?
$HOST "sudo needrestart -b"

apt upgrade can be a disguised dockerd restart

On a host where the docker-ce package is updated, the update restarts the daemon — and therefore, according to the restart policy, everything running on top of it. On vm-compute-01, which has a GPU and around sixty containers, this is never insignificant.

Check before: apt list --upgradable | grep -E 'docker|containerd'.

Post-Patch Verification¶

# aucun conteneur ne doit être resté au tapis
$HOST "docker ps -a --filter 'status=exited' --format '{{.Names}}\t{{.Status}}'"

# et la politique de redémarrage doit être celle du fichier Compose
$HOST "docker inspect \$(docker ps -q) \
        --format '{{.Name}} {{.HostConfig.RestartPolicy.Name}}' | grep -v 'on-failure'"

A major version update disables third-party repositories

A do-release-upgrade disables the files .list from third-party repositories by renaming them to .save. This was observed: the Docker and Tailscale repositories remained disabled for three months, without any warning — the machine claimed to be up-to-date, and it was, for the remaining active repositories.

After any major version update:

$HOST "ls /etc/apt/sources.list.d/*.save 2>/dev/null"

What restarts other things than itself¶

Before patching, it's important to determine which services depend on the affected service. For example: Restarting the VPN container for the download group disconnects the network for all containers that share its network stack – they don't automatically restart, and docker ps shows them as running.

Dernière vérification de cette page : 2026-09-08