debian-kernel-reboot-checklisted

# Debian kernel/reboot check across a mixed fleet `unattended-upgrades` silently installs newer kernel packages in the background but **never reboots the host**. This means the running kernel (`uname -r`) can lag the newest *installed* kernel indefinitely with zero visible symptoms — `apt update`/`apt list --upgradable` will report nothing pending, because the new kernel package is already installed, just not booted into. Don't conflate "nothing to `apt upgrade`" with "no kernel action needed." ## Checking a single host Three checks, cheapest/most authoritative first: ```bash # 1. The single most reliable signal — presence means a reboot is needed, absence means clean cat /var/run/reboot-required 2>/dev/null || echo "no reboot pending" # 2. Compare currently running kernel against what's actually installed uname -r dpkg -l 'linux-image-*' | grep ^ii | tail -5 # look for a newer version than uname -r reports # 3. Confirm apt has nothing further queued unattended (should report nothing found) sudo unattended-upgrade --dry-run -d 2>&1 | tail -5 ``` On a Proxmox host itself, the kernel package family is `proxmox-kernel-*` / the `proxmox-kernel-7.0` (or current major) meta-package, not `linux-image-*`: ```bash uname -r dpkg -l 'proxmox-kernel-*' | grep ^ii ``` If `/var/run/reboot-required` is absent, the host is already running its newest installed kernel — no action needed regardless of what other packages are upgradable. ## Fleet topology: don't check LXCs individual