K
KinuxOTA

What is OTA? Over-the-air updates for Linux devices, explained

An OTA (over-the-air) update is a software update a device receives and installs through its network connection, without anyone going to the device. For a handful of machines on a desk, SSH is enough. For devices in shops, factories, vehicles or customers' homes, OTA is the only practical way to keep them secure and working.

What an OTA update system does

Whatever is being updated, an OTA system has the same jobs: reach devices that sit behind NAT and firewalls, deliver the update intact, install it without someone at a keyboard, cope with devices that are offline or lose power, and tell you afterwards which devices are up to date and which failed. The difference between OTA systems is mostly what they update.

The four kinds of OTA updates for Linux devices

Package updates

In KinuxOTA: Available

The operating system's own packages (apt on Ubuntu, Debian and Raspberry Pi OS) are upgraded in place: security fixes, libraries, the kernel.

Best for: Most Linux devices in the field, most of the time.

KinuxOTA: Run the Update packages script on many devices at once, or install, update and remove single packages per device from the Package Manager.

Files and scripts

In KinuxOTA: Available

Configuration files, .deb packages you built, firmware blobs or any other file is copied to the device and a script installs it.

Best for: Your own software and configuration, and anything apt does not cover.

KinuxOTA: Upload a folder of any files with a script, run it on up to 100 devices per run; every file's checksum is verified on the device before the script starts.

Application and container updates

In KinuxOTA: Partly, with scripts

One application (a systemd service, a Docker or Podman container) is replaced by a new version while the rest of the system stays as it is.

Best for: Devices whose value is one application, updated more often than the OS.

KinuxOTA: A script can pull a new container image or replace a service and restart it today. A dedicated application update with versions per device is planned.

Full-system (image) updates

In KinuxOTA: Planned

The whole root filesystem is replaced by a new image, usually with two slots (A/B): the device boots the new one and falls back to the old one if it does not come up healthy.

Best for: Products built as images (Yocto, custom Debian images) where a broken update must never brick a device.

KinuxOTA: A/B updates with automatic rollback, built on the open-source engines RAUC or SWUpdate, are on the roadmap. KinuxOTA does not do full-system updates today.

What KinuxOTA does for OTA today

KinuxOTA is a web dashboard and a small agent for Ubuntu, Debian and Raspberry Pi OS devices. Today it covers package updates and file-and-script updates:

  • Update apt packages on many devices at once and see each device's result (Update packages script).
  • Install, update or remove apt packages on one device from the Package Manager.
  • Send any files to many devices with a script: up to 100 devices per run, checksums verified on the device.
  • Watch every device's output live, cancel a run, and re-run only the devices that failed.
  • Reach devices that are offline: they run the update when they come back, within the waiting time you choose.
  • Update the KinuxOTA agent itself through its signed apt repository, also from the dashboard.
  • No inbound connections: devices connect out over TLS, so no SSH, open ports or VPN are needed.

Step by step: Ubuntu, Debian and Raspberry Pi OS.

What it does not do yet

  • Full-system A/B image updates with automatic rollback (planned, with RAUC or SWUpdate).
  • Device groups and phased rollouts (5% > 25% > 100%) with automatic pause on failures (planned).
  • Signed update artifacts: today files are verified by SHA-256 against what the server says, not by a signature (planned).
  • Scheduled updates and maintenance windows, and delta updates for metered links (planned).

Which kind do you need?

If your devices run a standard distribution and your software comes as packages or files, package and script updates are what you will use every week, and you can start today. If you build your own images and a failed update must never leave a device unbootable, you need full-system A/B updates as well; those come later in KinuxOTA, and many fleets use both: images for the base system, packages and scripts for everything in between.

Frequently asked questions

What does OTA stand for?

Over the air: a device receives and installs an update through its network connection instead of someone updating it by hand on site.

Is updating with apt a real OTA update?

Yes. A package update delivered remotely is an over-the-air update. It is the most common kind on Linux devices. What it cannot do is roll the whole system back if an update breaks it; that is what A/B image updates add.

Does KinuxOTA do full-system OTA updates?

Not yet. Today it updates packages, files, scripts and its own agent. Full-system A/B updates with automatic rollback are planned, built on RAUC or SWUpdate.

Why do OTA updates matter for devices sold in the EU?

The EU Cyber Resilience Act requires makers of connected products to fix security problems with updates for the product's support period. Being able to update devices remotely, and to show that they were updated, is how that works in practice.

Try it on your own devices

Free during the pilot program (up to 3 devices per account for now). How it works in detail: the documentation.