Debian security updates without surprises: a minimal unattended-upgrades policy
Automate Debian security patches with unattended-upgrades restricted to the -security archive, preview changes with a dry-run, and keep reboots manual to avoid surprise downtime.