Automated Linux server patching and Docker container updates. Use when the user asks to update, patch, or upgrade Linux servers, apply security updates, update Docker containers, check for system updates, or manage server maintenance across multiple hosts. Supports Ubuntu, Debian, RHEL, AlmaLinux, Rocky Linux, CentOS, Amazon Linux, and SUSE. Includes PatchMon integration for automatic host detection and intelligent Docker handling.
Automated Linux server patching and Docker container updates. Use when the user asks to update, patch, or upgrade Linux servers, apply security updates, update Docker containers, check for system updates, or manage server maintenance across multiple hosts. Supports Ubuntu, Debian, RHEL, AlmaLinux, Rocky Linux, CentOS, Amazon Linux, and SUSE. Includes PatchMon integration for automatic host detection and intelligent Docker handling.
Linux Patcher
Automate Linux server patching and Docker container updates across multiple hosts via SSH.
⚠️ Important Disclaimers
Distribution Support Status
Fully Tested:
✅ Ubuntu - Tested end-to-end with real infrastructure
Supported but Untested:
⚠️ Debian GNU/Linux - Commands based on official documentation
⚠️ Amazon Linux - Supports both AL2 (yum) and AL2023 (dnf)
⚠️ RHEL (Red Hat Enterprise Linux) - Supports RHEL 7 (yum) and 8+ (dnf)
⚠️ AlmaLinux - RHEL-compatible, uses dnf
⚠️ Rocky Linux - RHEL-compatible, uses dnf
⚠️ CentOS - Supports CentOS 7 (yum) and 8+ (dnf)
⚠️ SUSE/OpenSUSE - Uses zypper package manager
Testing Recommendation:
Always test untested distributions in a non-production environment first. The script will warn you when running on untested distributions.
Security Notice
This skill requires:
Passwordless sudo access - Configured with restricted permissions
SSH key authentication - No passwords stored or transmitted
PatchMon credentials - Stored securely in user's home directory
Read SETUP.md for complete security configuration guide.
Quick Start
Automated (Recommended)
Patch all hosts from PatchMon (automatic detection):
Passwordless sudo configured for patching commands (see SETUP.md)
Docker installed (optional, only for full updates)
Docker Compose installed (optional, only for full updates)
PatchMon agent installed and reporting (optional but recommended)
PatchMon Setup (Required for Automatic Mode)
PatchMon is required to automatically detect which hosts need patching.
Important: PatchMon does NOT need to be installed on the same server as OpenClaw. Install PatchMon on a separate server (can be any server on your network), and OpenClaw will query it via API.
Install PatchMon server on a separate server (see GitHub repo)
Install PatchMon agents on all hosts you want to patch
Configure OpenClaw to access PatchMon API:
cp scripts/patchmon-credentials.example.conf ~/.patchmon-credentials.conf
nano ~/.patchmon-credentials.conf # Set PatchMon server URLchmod 600 ~/.patchmon-credentials.conf
Detailed setup:
See references/patchmon-setup.md for complete installation guide.
Can I use this skill without PatchMon?
Yes! You can use manual mode to target specific hosts without PatchMon. However, automatic detection of hosts needing updates requires PatchMon.
On Target Hosts
Required:
SSH server running
Passwordless sudo for the SSH user (for apt and docker commands)
PatchMon agent installed and reporting (for automatic mode)
For full updates:
Docker and Docker Compose installed
Docker Compose files exist at specified paths
Configure Passwordless Sudo
On each target host, create /etc/sudoers.d/patches:
# For Ubuntu/Debian systems
username ALL=(ALL) NOPASSWD: /usr/bin/apt, /usr/bin/docker
# For RHEL/CentOS systems
username ALL=(ALL) NOPASSWD: /usr/bin/yum, /usr/bin/docker, /usr/bin/dnf
Replace username with your SSH user. Test with sudo -l to verify.
Update Modes
Host-Only Updates
Updates system packages only:
Run apt update && apt upgrade (or yum update on RHEL)
Remove unused packages (apt autoremove)
Does NOT touch Docker containers
When to use:
Hosts without Docker
Security patches only
Minimal downtime required
Full Updates
Complete update cycle:
Update system packages
Clean Docker cache (docker system prune)
Pull latest Docker images
Recreate containers with new images
Causes brief service interruption
When to use:
Docker-based infrastructure
Regular maintenance windows
Application updates available
Workflow
Automatic Workflow (patch-auto.sh)
Query PatchMon - Fetch hosts needing updates via API
For each host:
SSH into host
Check if Docker is installed
Auto-detect Docker Compose path (if not specified)
Apply host-only OR full update based on Docker detection
Report results - Summary of successful/failed updates
Host-Only Update Process
SSH into target host
Run sudo apt update
Run sudo apt -y upgrade
Run sudo apt -y autoremove
Report results
Full Update Process
SSH into target host
Run sudo apt update && upgrade && autoremove
Navigate to Docker Compose directory
Run sudo docker system prune -af (cleanup)
Pull all Docker images listed in compose file
Run sudo docker compose pull
Run sudo docker compose up -d (recreate containers)
Report results
Docker Detection Logic
When using automatic mode:
Docker installed + compose file found → Full update
Docker installed + no compose file → Host-only update
Docker not installed → Host-only update
--skip-docker flag set → Host-only update (ignores Docker)
Docker Path Auto-Detection
When Docker path is not specified, the script checks these locations:
/home/$USER/Docker/docker-compose.yml
/opt/docker/docker-compose.yml
/srv/docker/docker-compose.yml
$HOME/Docker/docker-compose.yml
Current directory
Override auto-detection:
scripts/patch-host-full.sh user@host /custom/path
Examples
Example 1: Automatic update via PatchMon (recommended)
# First time: configure credentialscp scripts/patchmon-credentials.example.conf ~/.patchmon-credentials.conf
nano ~/.patchmon-credentials.conf
# Run automatic updates
scripts/patch-auto.sh
Example 2: Automatic with dry-run
# Preview what would be updated
scripts/patch-auto.sh --dry-run
# Review output, then apply
scripts/patch-auto.sh
Example 3: Skip Docker updates
# Update packages only, even if Docker is detected
scripts/patch-auto.sh --skip-docker
