Automate Kernel Live Patching: Zero‑Downtime Reboots

Running a production website or application on a Linux VPS requires minimizing unplanned downtime. Even a brief reboot to apply a security fix can terminate user sessions, interrupt API calls, and impact service reliability. Both Canonical Livepatch and CloudLinux KernelCare offer live‑patching—the ability to apply critical kernel updates without rebooting the operating system. In this article, we walk through the complete setup for each solution, compare their workflows, and show how you can automate the process to keep your servers patched continuously.

Why Live Patching Matters for Cloud Servers

• Zero‑downtime security updates – Critical vulnerabilities are often fixed in the kernel. Live patches allow you to apply these fixes instantly without service interruption.
• Operational efficiency – Reboot windows can cause traffic spikes on load balancers and CPU load. Eliminating reboots reduces the operational overhead associated with maintenance windows.
• Compliance – Many industry standards and regulatory frameworks require prompt remediation of known vulnerabilities. Live patching helps meet these requirements faster.
• User experience – Users expect consistent service availability, especially during peak traffic periods. Live patching ensures that security updates do not result in visible downtime.

Canonical Livepatch on Ubuntu 22.04 LTS

Canonical Livepatch is available for Ubuntu LTS releases. It requires an Ubuntu One account and a free token for up to three machines, which is suitable for many small‑to‑medium VPS setups. Below are the steps to install, configure, and automate the service on Ubuntu 22.04 LTS.

1. Register and obtain a Livepatch token

1. Visit https://auth.livepatch.canonical.com/ and sign in with your Ubuntu One credentials.
2. Create a new token and copy the generated string. You will need this token in the next step.

2. Install the Livepatch client

# Update package index
sudo apt update

# Install the snap that provides the livepatch client
sudo snap install canonical-livepatch

# Enable the service with your token
sudo canonical-livepatch enable <YOUR_TOKEN>

What each command does:

• apt update refreshes the local package list to ensure you have the latest package information.
• snap install canonical-livepatch pulls the official Livepatch snap from the Snap Store.
• canonical-livepatch enable registers the client with Canonical’s backend using your token and starts the daemon.

3. Verify the installation

sudo canonical-livepatch status

The output should show Livepatch is enabled and list any applied patches. If the service reports connected, the installation is successful and ready to use.

4. Automate health checks with a cron job

While the Livepatch daemon runs continuously, it is good practice to log its status daily for auditing purposes. Create a simple cron entry as follows:

# Edit root's crontab
sudo crontab -e

# Add the line below (runs at 02:00 UTC every day)
0 2 * * * /usr/bin/canonical-livepatch status >> /var/log/livepatch.log 2>&1

This creates a historical record of patch application status, helping you spot any failures early.

KernelCare on AlmaLinux 9 (or Rocky/RHEL 9)

KernelCare works across most major distributions, including AlmaLinux, Rocky Linux, and RHEL. It provides a proprietary live‑patching agent that automatically downloads and applies patches. The following instructions target AlmaLinux 9; the same commands generally work on Rocky 9 and RHEL 9.

1. Register for a KernelCare trial or purchase a license

• Visit kernelcare.com, create an account, and obtain your license key.
• For a free 30‑day trial, you will receive a key that works on up to three servers.

2. Install the KernelCare client

# Install required utilities
sudo dnf install -y curl

# Download and run the installer script
curl -s https://www.kernelcare.com/installer.sh | sudo bash -s -- -k <YOUR_LICENSE_KEY>

Explanation:

• dnf install curl ensures the curl command is available for downloading the installer.
• The installer.sh script fetches the latest KernelCare package, verifies its signature, and installs the kcarectl daemon.
• The -k flag passes your license key to the installer, activating the service.

3. Confirm the daemon is running

sudo systemctl status kcarectl

You should see active (running). KernelCare checks for new patches periodically by default.

4. Optional: Enable detailed logging

# Create a log rotation file to keep /var/log/kcare.log tidy
sudo tee /etc/logrotate.d/kcare > /dev/null <

- name: Install Canonical Livepatch
  hosts: ubuntu_servers
  become: true
  vars:
    livepatch_token: "{{ lookup('env','LIVEPATCH_TOKEN') }}"
  tasks:
    - name: Install snapd (if not present)
      apt:
        name: snapd
        state: present
        update_cache: yes

    - name: Install Livepatch snap
      snap:
        name: canonical-livepatch
        state: present

    - name: Enable Livepatch with token
      command: canonical-livepatch enable {{ livepatch_token }}
      args:
        creates: /var/snap/canonical-livepatch/common/token

#cloud-config
runcmd:
  - dnf install -y curl
  - curl -s https://www.kernelcare.com/installer.sh | bash -s -- -k ${KERNELCARE_KEY}

#!/bin/bash
if command -v canonical-livepatch > /dev/null; then
    STATUS=$(canonical-livepatch status | grep -i 'livepatch' | awk '{print $NF}')
    echo "canonical_livepatch_status{state=\"$STATUS\"} 1"
elif command -v kcarectl > /dev/null; then
    STATUS=$(kcarectl status | grep -i 'kernelcare' | awk '{print $NF}')
    echo "kernelcare_status{state=\"$STATUS\"} 1"
else
    echo "livepatch_unknown 1"
fi