New on LowEndTalk? Please Register and read our Community Rules.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
Comments
Kernelcare supports Proxmox but only EOL versions, 7 and 8.
https://patches.kernelcare.com/?distro=pve-8
On RHEL-based systems, kpatch works seamlessly, and AI makes patches just as easily as it finds various bugs... There shouldn't be an issues with that on Proxmox either.
For Proxmox VE 9 there's honestly no supported livepatch option - the kernel is a custom Proxmox build, so KernelCare/Livepatch/Ksplice all refuse to touch it (KernelCare only lists the EOL PVE 7/8 as rdes said).
What most people end up doing: just schedule the reboot instead. If you have HA set up, live-migrate the VMs first and the host reboot is a non-event. On a single node, kexec at least skips the BIOS/POST wait so the reboot takes seconds instead of minutes. Not as nice as true livepatching, but it's the practical answer on PVE.
Yes, that’s what I’m doing, I just restart the node, but the frequency of KVM escape vulnerabilities is increasing significantly
I hope someone releases an alternative to Proxmox soon, even if it’s a paid one
Proxmox has some paid services though. If they don't offer their own livepatching service, that's a big overlooking from them.
I got a feeling enough people pay for proxmox it probably would become a thing.
There are other options other than proxmox like XCP-ng, and of course VMware.
Same routine here. One thing that took the edge off for me: a lot of the KVM escape fixes land in qemu/libvirt, which is userspace, so those patch with a normal apt upgrade and no reboot needed. Only the actual kernel ones force downtime. Doesn't fix the frequency problem, but the real exposure window is smaller than it feels.