> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Unattended Upgrades

> Aviatrix unattended upgrades automatically apply operating system security updates to Aviatrix Controllers and Gateways. This capability helps you maintain a strong security posture by ensuring that critical OS‑level vulnerabilities are patched without requiring manual intervention.

Aviatrix unattended upgrades automatically apply operating system security
updates to Aviatrix Controllers and Gateways. This capability helps you maintain
a strong security posture by ensuring that critical OS‑level vulnerabilities are
patched without requiring manual intervention.

Unattended upgrades are designed to reduce exposure to known vulnerabilities
while minimizing operational overhead.

## What Unattended Upgrades Do

### What Is Included

Unattended upgrades apply only to the underlying operating system packages. This
includes, but is not limited to:

* Security updates for the Linux distribution
* Core OS components (for example, OpenSSL and shell utilities)

These updates are delivered using the standard Linux `unattended-upgrades`
mechanism and focus on security‑related patches.

### What Is Not Included

Unattended upgrades do **NOT** update Aviatrix software components, including
but not limited to:

* Controller application services
* Gateway dataplane or control‑plane software
* Aviatrix features, functionality, or configuration

<Note>
  Aviatrix software upgrades must still be performed manually through the
  Controller UI or CoPilot UI, following standard upgrade procedures. See
  <a href={"/docs/enterprise/" + "10.1" + "/guides/maintenance/controller-gateway-upgrade-latest-image"}>Controller Gateway Upgrade Latest Image</a>
  .
</Note>

## Supported Versions

Unattended upgrades are available starting with the following versions. Earlier
versions do not include this capability.

| Component  | Minimum Version | Status    |
| ---------- | --------------- | --------- |
| Controller | 8.0             | Supported |
| Gateway    | 8.1             | Supported |
| CoPilot    | 4.36            | Supported |

## How Unattended Upgrade Are Applied After Initial Deployment

When a Controller or Gateway is first deployed, unattended upgrades do not take
effect immediately. The upgrade process relies on two independent background
processes, each running on its own 24‑hour schedule:

1. **Package Index Refresh**: The periodic `apt` package index refresh downloads
   the latest list of available security updates from Debian repositories.
2. **Security Upgrade Process**: The unattended security upgrade process
   installs any eligible patches identified during the most recent index
   refresh.

<Warning>
  Because these two timers are not synchronized, they may run out of phase. After a Controller or Gateway is first launched, it can take **up to 48 hours** for all eligible operating system security updates to be fully applied.

  This behavior is expected and does not indicate a failure or misconfiguration.
  During this period, the system will progressively update itself as each
  scheduled process runs.
</Warning>

## Network Requirements

For unattended upgrades to function, the Controller and Gateways must have
outbound (egress) connectivity on TCP port 443 to the following Debian official
package repositories:

* `deb.debian.org`
* `security.debian.org`

<Warning>
  If outbound access is restricted (for example, by firewall rules or proxy
  configuration), unattended upgrades may not be able to retrieve security
  updates. Ensure your network policies allow egress traffic to the repositories
  listed above.
</Warning>

## Reboot Behavior

Unattended upgrades do **NOT** automatically reboot Controllers or Gateways.

If an operating system security update includes a new kernel or otherwise
requires a reboot, you are responsible for scheduling and performing the reboot
in accordance with your maintenance and change‑management practices.

<Tip>
  We recommend incorporating reboot checks into your regular maintenance windows
  to ensure kernel‑level patches take full effect.
</Tip>

## Visibility and Status

There is currently no UI indicator or status view showing when Unattended
Upgrades are running or what updates have been applied.

If you require confirmation of applied updates or need assistance, contact
[Aviatrix Support](https://support.aviatrix.com).