Overview
The Linux Software Update Policy keeps managed Linux devices up to date. The Swif agent runs the device's package manager on a schedule you set, and installs available updates. You can also add external package repositories, such as Google Chrome's, so devices get updates from them too.
Linux distributions don't share a single management API, unlike macOS and Windows. So Swif manages updates through each distribution's own package manager, such as apt, dnf, zypper, or pacman.
Important: The device's own update settings may show updates as off. Swif runs updates through the package manager directly, not through the distribution's update settings. So Software & Updates or a similar settings panel may show automatic updates as Off, even though Swif is installing updates. That's expected.
Supported platforms and requirements
Item | Details |
Platform | Linux |
Device ownership | Company-owned and BYOD |
Swif agent | Required |
Settings reference
Setting | What it does | Default |
Automatic Update | On: the Swif agent updates the package lists and installs available updates on the schedule below. For example, on Debian and Ubuntu it runs | On |
Cron Schedule | When automatic updates run, in cron format. A setting under Automatic Update, shown only while it's on. |
|
Repos | External package repositories to add to devices. See Add external repositories below. | Empty |
Cron Schedule
The schedule uses the standard five-field cron format:
minute hour day-of-month month day-of-week
Schedule | Cron Schedule value |
Every day at midnight (default) |
|
Every day at 2:00 AM |
|
Every 6 hours |
|
Weekdays at 12:30 PM |
|
Every Sunday at 3:00 AM |
|
Choose a time when devices are usually on and connected, but not in heavy use. Devices that are off at the scheduled time update at the next scheduled run.
Add external repositories
Use Repos to add a package repository that isn't part of the distribution, such as a vendor's repository for an app your team uses. Devices then get updates from it during scheduled runs.
Repository fields
Field | What to enter | Required |
Platform | The package manager the repository is for. See the table below. | Yes |
Repo URL | The repository's address. | Yes |
Distribution | The release channel, such as | No |
Components | The repository components, such as | No |
Repo ID | A unique name for the repository. Shown for Pacman, Arch, Flatpak, Zypper, and Nix. | Depends on the package manager |
Architecture | The system architecture, such as | No |
Key Sources | Where to get the repository's signing key: a key server (such as | If the repository is signed |
Recv Keys | The key ID to fetch from the key server in Key Sources. | No |
Platform options
Platform | Use for |
| Debian, Ubuntu, and other Debian-based distributions |
| Fedora, RHEL, Rocky Linux, CentOS, and other RPM-based distributions |
| openSUSE and SUSE Linux Enterprise |
| Arch Linux and Arch-based distributions |
| Flatpak remotes |
| Nix and NixOS |
Snap doesn't support adding repositories, so it isn't listed.
Where Swif adds repositories
On Debian and Ubuntu, Swif adds its own .list files in /etc/apt/sources.list.d/, instead of changing the main sources.list. This keeps Swif-managed repositories separate and easy to track. Swif adds files there when:
you add repositories in this policy
an app you deploy through Swif comes from its own repository, such as Google Chrome
Swif needs its own service repository for automatic updates
Manage these repositories through the policy, not by editing the files. Manual changes can conflict with Swif.
Before you start
Choose an update schedule that suits your users' working hours.
Collect the details of any external repositories: the URL, release channel and components (for APT), and signing key.
Test on a small group. Distributions differ, so check that the updates and repositories work on each distribution you manage.
Create the policy
In Swif, go to Device Management > Policies, then select Create new policy > Configure a Policy.
Select Linux Software Update Policy.
Enter a clear name, such as
Linux Updates – Nightly.Keep Automatic Update on, and set the Cron Schedule that appears under it.
Under Repos, add any external repositories.
Save the policy.
Assign it to a device group of Linux devices.
Example configurations
Example 1: Nightly updates
Setting | Value |
Automatic Update | On |
Cron Schedule |
|
Repos | Empty |
Devices install updates from their distribution's default repositories every night at 2:00 AM.
Example 2: Add the Google Chrome repository on Ubuntu
Field | Value |
Platform |
|
Repo URL |
|
Distribution |
|
Components |
|
Architecture |
|
Key Sources |
|
Devices get Chrome updates from Google's repository during each scheduled run.
Example 3: Updates on weekday afternoons
Setting | Value |
Automatic Update | On |
Cron Schedule |
|
For devices that are usually off at night, updates run at 12:30 PM on weekdays.
Verify the policy
In Swif, open the device and confirm that the policy shows as applied.
After the scheduled time, check the package manager's log on the device. For example:
Debian and Ubuntu:
/var/log/apt/history.logFedora and RHEL:
/var/log/dnf.log
If you added repositories on Debian or Ubuntu, check that their
.listfiles are in/etc/apt/sources.list.d/.
Troubleshooting
The system settings show automatic updates as off
This is expected. Swif runs updates through the package manager directly, not through the distribution's update settings.
Updates didn't run at the scheduled time
Check that Automatic Update is on, and that the Cron Schedule is valid.
Check that the device was on and connected at the scheduled time.
Check the package manager's log for errors.
An update failed
Check the package manager's log, such as /var/log/apt/history.log or /var/log/dnf.log, and the device's logs in Swif. See Linux failed to fetch packages for updates.
Updates from an external repository fail with a key error
The repository's signing key wasn't fetched. Check Key Sources, and Recv Keys if the key comes from a key server.
I found extra .list files in sources.list.d
These are Swif-managed repositories. Manage them through this policy, and don't edit them by hand.