Why my servers run unattended-upgrades
Security updates on their own, everything else by hand.
Small servers get forgotten. Automatic security updates mean forgotten servers stay patched.
Unattended-Upgrade::Allowed-Origins {
"${distro_id}:${distro_codename}-security";
};
Unattended-Upgrade::Automatic-Reboot "false";