ops(m10): plan rs2000 Ubuntu updates and reboot window #608

New issue

Closed

opened 2026-05-29 18:45:51 +02:00 by codex · 1 comment

codex commented

2026-05-29 18:45:51 +02:00

Collaborator

Context

After SSH login to rs2000, Ubuntu reports pending host maintenance:

Ubuntu 24.04.4 LTS
33 updates can be applied immediately
1 additional security update can be applied with ESM Apps
System restart required
1 zombie process
memory usage reported around 91%

This should be tracked as M10 Improvements, not mixed into the current M04/M06/M08 closeout work.

Scope

Plan and execute a controlled rs2000 OS update/reboot maintenance window.

Acceptance criteria

Read-only preflight records package count/classes without dumping unrelated private host data.
Confirm whether ESM Apps should remain disabled or be enabled separately.
Confirm current platform health before update: critical containers healthy, Forgejo reachable, Infisical reachable, backup status known.
Record rollback/recovery posture before reboot: latest backup evidence, SSH access, console/provider access if needed.
Apply updates only in an operator-approved maintenance window.
Reboot only with explicit operator approval.
Post-reboot smoke verifies platform critical services and zero unexpected unhealthy containers.
Capture sanitized before/after evidence in a report or PR comment.

Out of scope

No unattended upgrade from this issue creation.
No package removal or distro upgrade.
No Docker image/module upgrades; those belong to M09-style module upgrade packets.
No ESM enablement unless split or explicitly approved.

Safety

This is runtime-impacting because the host says restart required. Treat execution as operator-gated even if the plan/preflight is agent-readable.

## Context After SSH login to `rs2000`, Ubuntu reports pending host maintenance: ```text Ubuntu 24.04.4 LTS 33 updates can be applied immediately 1 additional security update can be applied with ESM Apps System restart required 1 zombie process memory usage reported around 91% ``` This should be tracked as M10 Improvements, not mixed into the current M04/M06/M08 closeout work. ## Scope Plan and execute a controlled `rs2000` OS update/reboot maintenance window. ## Acceptance criteria - Read-only preflight records package count/classes without dumping unrelated private host data. - Confirm whether ESM Apps should remain disabled or be enabled separately. - Confirm current platform health before update: critical containers healthy, Forgejo reachable, Infisical reachable, backup status known. - Record rollback/recovery posture before reboot: latest backup evidence, SSH access, console/provider access if needed. - Apply updates only in an operator-approved maintenance window. - Reboot only with explicit operator approval. - Post-reboot smoke verifies platform critical services and zero unexpected unhealthy containers. - Capture sanitized before/after evidence in a report or PR comment. ## Out of scope - No unattended upgrade from this issue creation. - No package removal or distro upgrade. - No Docker image/module upgrades; those belong to M09-style module upgrade packets. - No ESM enablement unless split or explicitly approved. ## Safety This is runtime-impacting because the host says restart required. Treat execution as operator-gated even if the plan/preflight is agent-readable.

codex added this to the 10 - Improvements milestone

2026-05-29 18:45:51 +02:00

codex added the

kind/ops

label

2026-05-29 18:45:51 +02:00