Keep Rocky Linux patched automatically with dnf-automatic security installs

Problem: manual patching leaves a window

Rocky Linux servers that rely on ad-hoc dnf update runs drift out of date. The practical engineering decision is to let dnf-automatic apply security errata automatically on a schedule, while keeping non-security changes manual. Security-only updates reduce change risk compared to applying all available updates.

dnf-automatic is shipped in the dnf-automatic package. It reads /etc/dnf/automatic.conf and is driven by systemd timers: dnf-automatic-install.timer, dnf-automatic.timer and dnf-automatic-download.timer. A reboot is not triggered by dnf-automatic, so kernel and glibc updates still require a separate restart policy.

Prerequisites

Run as root or with sudo. Rocky Linux 8 and 9 both support this workflow, but default timer behavior and DNF internals differ slightly between releases, so validate per release.

• dnf-automatic installed: dnf install dnf-automatic
• Repositories enabled and metadata reachable for your system
• A maintenance window known for the host, especially if services are sensitive to library changes
• Backups or snapshots available. DNF history can undo many transactions, but it is not a guaranteed downgrade path.

Configure automatic.conf for security-only installs

Edit /etc/dnf/automatic.conf. The key decision is upgrade_type and apply_updates.

[commands]
upgrade_type = security
apply_updates = yes
download_updates = yes

[emitters]
emit_via = motd

upgrade_type = security restricts automatic installs to packages flagged as security errata. apply_updates = yes makes the timer install, not just download. emit_via options are stdio, email or motd. Email requires a working local MTA. motd shows a banner on login without extra infrastructure.

Security-only classification depends on Rocky Linux errata metadata. Verify that your repos publish security metadata before relying on upgrade_type = security.

Schedule with systemd timer

The install path uses dnf-automatic-install.timer. Enable it:

systemctl enable --now dnf-automatic-install.timer

The default timer runs daily. To move it to a maintenance window, create a drop-in:

systemctl edit dnf-automatic-install.timer

Add an empty OnCalendar= line to clear the default, then set a new schedule, for example:

[Timer]
OnCalendar=Sun 03:00
Persistent=true

Reload and check:

systemctl daemon-reload
systemctl list-timers dnf-automatic-install.timer

Do not enable multiple dnf-automatic timers simultaneously unless intentional. Download and install timers overlap in function.

Verify the pipeline

Test safely first with apply_updates = no and download_updates = yes, confirming packages are staged without being installed.

• Confirm timer state: systemctl list-timers dnf-automatic-install.timer should show the unit active with a next run time.
• After a run, inspect journalctl -u dnf-automatic-install.service and /var/log/dnf.log for transaction completion.
• Check pending security errata manually: dnf updateinfo list security. This confirms metadata presence and matches expectations.
• After kernel updates, compare uname -r against the newest installed kernel rpm -q kernel to determine whether a reboot is still pending.

Recovery and limitations

Automatic updates can restart dependent services implicitly via library updates. Critical services may need needrestart-style checks or planned restarts.

Rollback is limited. DNF history can revert many transactions:

dnf history list
dnf history undo <id>

Downgrades of some packages are not guaranteed, and configuration files may have been modified. Snapshots or tested backups remain the real recovery mechanism.

Timer overrides must clear the original OnCalendar, otherwise both schedules apply. Current verification is required for exact defaults on your Rocky release, as timer units and dnf-automatic behavior can change between 8 and 9.