--- title: Managing Livepatch on-prem description: A high-level introduction of Livepatch on-prem for Ubuntu. How to enable uninterrupted service while being in control of the livepatched systems. url: https://canonical.com/blog/managing-the-livepatch-service-on-prem?format=md --- 1. [Blog](https://canonical.com/blog) 2. Article --- [Nikos Mavrogiannopoulos](https://canonical.com/blog/author/nmavrogiannopoulos "More about Nikos Mavrogiannopoulos") 13 September 2021 # Managing Livepatch on-prem [livepatch](https://canonical.com/blog/tag/livepatch) [livepatch-on-prem](https://canonical.com/blog/tag/livepatch-on-prem) [Security](https://canonical.com/blog/tag/security) --- Share the article [Ubuntu Livepatch](https://ubuntu.com/security/livepatch) is the service and the software that enables organizations to quickly patch vulnerabilities on the Linux kernel. It enables uninterrupted service while reducing fire drills during high and critical severity kernel vulnerabilities. With Ubuntu Livepatch on-prem we enhance our service to enable enterprises manage on private or public cloud their livepatched systems. In this post, we will introduce Ubuntu Livepatch on-prem and look into how it can be deployed for your organization, as well as answer some of the most commonly asked questions. ## On-prem kernel livepatching Complex enterprise environments often follow policies that require a gradual roll-out of updates to reduce risk, or have high-security isolated environments that need to be updated. Livepatch on-prem allows an organization to define a roll-out policy and remain in full control of which machines will get updated and when. The Livepatch on-prem server is a middle-man service that regularly syncs with the Ubuntu Livepatch service to gather the latest kernel livepatches. It then deploys the patches gradually in as many stages as required, following the organizational policy. ## How to deploy Livepatch on-prem The service is easily deployable with juju on any environment from the public cloud of your choice to a private cloud using [the model-driven juju](https://juju.is/) framework. Once deployed it connects to the Ubuntu Livepatch service with an Ubuntu Advantage token, and can be configured to perform patch deployment according to a predefined set of policies. ## How to manage livepatches The deployment of the livepatches is performed in multiple tiers. The systems on the first tier receive the available patches unconditionally. The next tiers serve as promotion tiers where patches are promoted by the administrator. That approach allows for a risk-based deployment that keeps the most important systems as the last tier, as well as for cohort deployment where clusters of systems are patched gradually to keep the expected availability. The livepatch client systems are associated with a tier by assigning them the corresponding token for that tier, a token issued by the on-prem server. Let’s take an example. An administrator can configure an incoming tier –let’s call it Tier 1– where livepatches get applied as they come from the Ubuntu Livepatch service, and a promotion tier –Tier 2– that the administrator can promote patches to once the criteria she set for promotion are met. That simple scenario is depicted graphically below. | | | --- | | Deployment on Tier 1 | | Deployment on Tier 2 | That simple association of a livepatch client to a tier allows for complex policy definitions and scenarios to deploy. ## How many clients can an on-prem server handle? The server can handle thousands of clients in a single CPU core system, and it requires access to storage space of a few gigabytes, to store the patches. There are multiple supported storage backends, such as the local filesystem, OpenStack Object Storage (Swift), S3, minio or postgresql. You can find more detailed instructions on deploying and configuring livepatch [on-prem on our website](https://ubuntu.com/security/livepatch/docs). ## How can I access Livepatch on-prem? Livepatch on-prem is available with an Ubuntu Advantage subscription. [Get Ubuntu Advantage](https://ubuntu.com/advantage) ## Where can I find more information about livepatch on-prem? The complete documentation of Livepatch on-prem service is available on [Ubuntu Livepatch website](https://ubuntu.com/security/livepatch/docs/). # Conclusion [Livepatch on-prem](https://ubuntu.com/security/livepatch) enables your organization to follow its own roll-out policies while taking advantage of Livepatching across your portfolio. Livepatching not only improves your infrastructure’s security posture but greatly reduces downtime and unplanned maintenance windows due to high and critical severity kernel vulnerabilities. If you would like to know more about Livepatch on-prem and how it could be implemented for you, get in touch! [Get in touch](https://ubuntu.com/security/certifications#get-in-touch) [Get in touch Interested in running Ubuntu in your organization?](https://ubuntu.com/about/contact-us/form) ## Sign up for our newsletter Get the latest Canonical news and updates in your inbox. Work email: \*I agree to receive information about Canonical's products and services. By submitting this form, I confirm that I have read and agree to [Canonical's Privacy Policy](https://canonical.com/legal/dataprivacy). Sign up ## Share on --- ## Related posts [### Canonical joins the Open Secure AI Alliance](https://canonical.com/blog/open-secure-ai-alliance) Canonical is now part of the Open Secure AI Alliance, announced by NVIDIA with partners across cloud computing, cybersecurity, enterprise software, open source foundations, and... [Canonical](https://canonical.com/blog/author/canonical) 28 August 2026 [### Januscape vulnerability CVE-2026-53359 mitigations available](https://canonical.com/blog/januscape-linux-vulnerability-mitigations-available) Introduction A local privilege escalation (LPE) vulnerability affecting the Linux kernel was publicly disclosed on July 6, 2026. The vulnerability was assigned CVE ID... [seth-arnold](https://canonical.com/blog/author/seth-arnold) 11 July 2026 [### DirtyClone Linux kernel local privilege escalation vulnerability fixes available](https://canonical.com/blog/dirtyclone-linux-vulnerability-fixes-available) On June 25, 2026, JFrog published their research into CVE-2026-43503, referring to the vulnerability as DirtyClone. The vulnerability had previously been responsibly disclosed... [Luci Stanescu](https://canonical.com/blog/author/lucistanescu) 1 July 2026 [### pedit COW kernel local privilege escalation vulnerability mitigations](https://canonical.com/blog/pedit-cow-linux-vulnerability-fixes-available) Mitigations are available for the Linux vulnerability with CVE ID CVE-2026-46331. The CVE ID was assigned on June 16 2026 and highlighted as a local privilege escalation (LPE)... [Luci Stanescu](https://canonical.com/blog/author/lucistanescu) 1 July 2026