How to update 50* Debian devices at once
Update apt packages on many Debian 12 and 13 devices at once from one dashboard, without SSH or a VPN: install a small agent, run the Update packages script on every device, watch the output and re-run only the devices that failed.
Works on Debian 12 (bookworm) and 13 (trixie), on amd64, arm64 and armhf. Last checked 2026-10-31.
Why updating Debian devices one by one does not scale
Debian devices tend to run for years in places nobody visits. Updating them means an SSH session per device, through whatever network path still reaches it, and keeping a list of which ones are done.
With KinuxOTA, a small agent on each device (gateways, appliances, thin clients and small servers) connects out to one web dashboard. You start the update once, on every device, and see the result of each one: no SSH, no open ports, no VPN and no inventory file to keep up to date.
What you need
- Debian devices: Debian 12 (bookworm) and 13 (trixie), on amd64, arm64 and armhf.
- sudo on each device once, to install the agent, and an outgoing internet connection.
- A free KinuxOTA account.
Update all your Debian devices, step by step
1. Create a free account
Sign up at https://www.kinuxota.com/signup/ and confirm your email address.
2. Install the agent on every Debian device
In the dashboard, click Add device, give the device a name and copy the install command it shows. Run it on the device: it adds the signed KinuxOTA apt repository, installs the agent as a systemd service and enrolls the device with its own key. The device appears as Online within seconds. Repeat for each device.
curl -fsSL https://www.kinuxota.com/install.sh | sudo sh -s -- --key <KEY>3. Create the Update packages script
Open Scripts, click New script, choose Template and pick Update packages. The script runs apt-get update, apt-get upgrade (keeping configuration files you changed) and apt-get autoremove, then says whether the device needs a reboot.
4. Run it on all your Debian devices at once
Click Run, then Select all online (or tick the devices you want, up to 100 per run). Turn on Reboot if required if the devices may restart, and click Run on N devices. Devices that are offline wait and update when they come back.
5. Watch every device's output live
The run page shows each device's status, exit code and output as it arrives, so you see which devices are done, which are still upgrading and what apt printed on each.
6. Re-run only the devices that failed
A device whose update failed (no network, a held apt lock, a full disk) shows Failed with the reason in its output. Fix the cause and click Re-run failed: the update runs again on those devices only.
Before you update many Debian devices
Security updates come from their own repository
Debian ships security fixes from security.debian.org. Check that each device's apt sources include the -security suite for its release; the Update packages script installs what apt sees and cannot install updates from a source the device does not have.
Configuration files you changed are kept
When an update brings a new version of a configuration file you edited, the script keeps your version (dpkg's --force-confold), so no device stops at a question. The new default is saved next to it as .dpkg-dist.
A new Debian release is not an update
The script installs updates within the release the device runs. Moving from Debian 12 to 13 changes the apt sources and is a separate, planned step.
Frequently asked questions
Does Debian need unattended-upgrades for this?
No. A KinuxOTA run installs every pending update when you start it. If your devices have unattended-upgrades, keep it for automatic security updates in between.
Which Debian versions are supported?
Debian 12 (bookworm) and 13 (trixie) on amd64, arm64 and armhf.
Can I update 10, 100 or 1,000 Debian devices this way?
One run reaches up to 100 devices, and you can start as many runs as you need. During the pilot program an account can add up to 3 devices for now; the steps are the same for 3 devices or 300.
What happens to devices that are offline?
They do not fail the run. They show Waiting for device and run the update when they come online, within the waiting time you choose (1 hour, 1 day or 7 days); after that they show Expired.
Do I need SSH, open ports or a VPN?
No. The agent opens an outgoing TLS connection to KinuxOTA, so devices behind NAT and firewalls work without inbound ports, SSH or a VPN.
Can I run the update on a schedule?
Not yet: today you start each run yourself. Scheduled runs are not available.
Try it on your own devices
Free during the pilot. The full reference for scripts and runs is in the documentation.
* During the pilot program an account can add up to 3 devices for now. The steps are the same for 3 devices or 300.