Linux patch reboot coordination with apps

Overview

Kernel patches often need reboot; Docker hosts and in-memory DB clusters complicate sequencing.

Process

1. Needs-restarting/checkrestart output in ticket.
2. Drain orchestrators—Kubernetes cordon/drain, swarm node update.
3. Failover app roles per runbook; verify persistent volumes reattach cleanly.

Kernel livepatch

Where subscribed (SUSE/Ubuntu Pro), extends window for non-critical CVEs—not indefinite excuse.

Communication

Maintenance template includes rollback (old kernel still in GRUB?) and who validates smoke tests.

Common miss

Containerd or Docker socket permissions reset post-reboot if systemd race—document systemd After= ordering fix.

Evidence

Patch compliance export for insurance renewal questionnaires.