remram

Minimizing risk is LITERALLY what I asked for. You clearly don't understand what I asked for.

I think I would want a bigger delay, an faulty upgrade might only break something within hours.

Ubuntu only does security updates, no?

No, why do you think that?

run your own package mirror

I think you might be on to something here. I could probably do this with a package mirror, updating it daily and rotating the staging, production, etc URLs to serve content as old as I want. This would require a bit of scripting but seems very configurable.

Thanks for the idea! Can't believe I didn't think of that. It seems so obvious now, I wonder if someone already made it.

I found the page about "phased upgrades" (somehow missed it searching for "staggered", "incremental", "delayed", etc). Thanks for the pointer!

Unfortunately it doesn't seem configurable on my end, and it rolls out in about 54 hours so it can take out most of my machines before I have time to react (my first machine might update ~20h into the phased rollout, the rest will break within 24h). Bummer!

~~(oops - replied in the wrong place)~~

So you can test the updates before fixing production.

My question is how to do that with APT.

Maybe I'm not being clear.

I want to stagger updates, giving time to make sure they work before they hit the whole fleet.

If a new SSH version comes out on Tuesday, I want it installed to 1/3 of the machines on Tuesday, another third on Wednesday, and the rest in Friday. Or similar.

Having machines update on a schedule means I have much less frequent updates and doesn't even guarantee that they hit the staging environment first (what if they're released just before the prod update time?)

I invite you to re-read the second paragraph of my post.

You're just throwing things I already listed back at me. I mentioned a staging environment, I mentioned a schedule was a (bad) option.

Is there anything about staggered upgrades and staging environments in there? Because obviously I had read it before posting...

No, I'm asking how to have unattended-upgrades do that.

Why?