Should VMs be manually updated via their package manager?

[CodeMan99]

Currently I have a VM using the podman template. First off, thank you!

It is not clear to me if I should be manually running dnf update inside the VM or not?

I ask namely because I haven't seen any mention of this in any documentation. Also, when I ran dnf update the update list included installing the kernel-core package. Having the most experience with WSL, this is a little jarring as the kernel there is updated by the wsl.exe command.

---

Snippet of running dnf update:

Installing:
 kernel-core                                                                   aarch64          6.14.4-200.fc41
Installing dependencies:
 hiredis                                                                       aarch64          1.2.0-3.fc41
 kernel-modules-core                                                           aarch64          6.14.4-200.fc41
 python3-libdnf5                                                               aarch64          5.2.12.0-2.fc41

Transaction Summary:
 Installing:         4 packages
 Upgrading:        181 packages
 Replacing:        181 package

[afbjorklund]

It is not clear to me if I should be manually running dnf update inside the VM or not?

A: Yes you should, they should be updated like any other virtual machine.

Either manually with something like dnf update or automatically by a service...
The commands vary between the distributions, so that is part of the reason why.

There is also a flag to update the instance automatically, before taking it online.

• Allow to update the packages at boot #2129 (comment)

# Upgrade the instance on boot
# Reboot after upgrade if required
# 🟢 Builtin default: false
upgradePackages: null

https://docs.fedoraproject.org/en-US/quick-docs/autoupdates/

Having the most experience with WSL, this is a little jarring as the kernel there is updated by the wsl.exe command.

WSL is using system containers, not virtual machines, so that is why they all share a kernel (with the actual Linux VM...)

However, Lima containers (nerdctl/docker/podman) are typically not updated "inside" but "outside"*.
Instead of treating it like a system container, it is treated like an application container - and recreated.

See also: https://it20.info/2012/12/vcloud-openstack-pets-and-cattle/ for another analogy, you can choose "mode"

---

* But if you were to run dnf upgrade inside of your podman container, then it would also exclude the kernel.

Normally you would start from another snapshot of your base image, with the packages already updated in it.

PS. Normally "update" refers to refreshing the package list, while "upgrade" actually installs them.

But yum decided to make update opt-out, so it always runs "update" (unlike apt, which does not)

[CodeMan99]

Thank you.

[afbjorklund]

I started with some "toolbox" experiments, in order to try out WSL-style "distribution" containers.

You might find it interesting (or not):

• Support for toolbox containers #3107

It builds a custom container for you, which you can then use more like a pet (to carry your tools).