Ubuntu 24.04 LTS

Why 24.04

Ubuntu 24.04 LTS shipped in April 2024 with Linux 6.8, OpenSSL 3, Python 3.12, systemd 255 and a refreshed toolchain. Canonical gives it five years of standard security maintenance, to mid 2029, and Ubuntu Pro extends that to 2034. For a server you deploy today, that is the longest runway of any apt-based image in our catalogue.

It is also the release most third-party documentation now targets. Docker's apt repository, the NodeSource and PostgreSQL PGDG repos, and most CI runner agents treat 24.04 as a first-class target. You spend less time translating instructions.

First ten minutes

Log in with the key you added in the portal, then patch and set the basics:

apt update && apt full-upgrade -y
timedatectl set-timezone Europe/London
hostnamectl set-hostname api-01
adduser deploy && usermod -aG sudo deploy
rsync --archive --chown=deploy:deploy ~/.ssh /home/deploy

Then turn off password logins. On 24.04 drop a file into sshd_config.d rather than editing the main config, so package upgrades never prompt you about a modified file:

cat >/etc/ssh/sshd_config.d/10-hardening.conf <<'EOF'
PasswordAuthentication no
PermitRootLogin prohibit-password
KbdInteractiveAuthentication no
EOF
systemctl reload ssh

Note the unit name. On 24.04 SSH is socket-activated by ssh.socket. If you change the listening port, edit the socket with systemctl edit ssh.socket as well, or the new port silently never binds.

Firewall with ufw

ufw is installed but inactive. Allow SSH before you enable it, or you will be reaching for the browser console:

ufw default deny incoming
ufw default allow outgoing
ufw allow OpenSSH
ufw allow 80,443/tcp
ufw enable
ufw status verbose

The portal firewall filters traffic before it reaches the VM. ufw filters inside it. Use both: the portal rules as a coarse outer fence, ufw for per-service rules that live in your configuration management.

Patching

unattended-upgrades is installed and applies security updates by default. Check it is active and decide how you want reboots handled:

systemctl status unattended-upgrades
grep -E 'Automatic-Reboot' /etc/apt/apt.conf.d/50unattended-upgrades
# opt in to a 04:30 reboot when a kernel update needs one
echo 'Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "04:30";' > /etc/apt/apt.conf.d/52reboot

Unattended reboots suit stateless app servers. Leave them off on a primary database and schedule kernel reboots yourself.

Gotchas specific to Noble

• pip refuses system installs. Python 3.12 honours PEP 668, so pip install outside a virtualenv errors out. Use python3 -m venv, pipx, or uv.
• Netplan owns networking. Configuration lives in /etc/netplan/. Run netplan try rather than apply when changing it remotely, because it rolls back if you lose the session.
• needrestart prompts. After upgrades, needrestart may ask which services to restart. In scripts, set NEEDRESTART_MODE=a to restart automatically.
• AppArmor profiles. Some services ship with enforcing profiles. If a daemon gets "permission denied" on a custom path, check journalctl -k | grep apparmor before you blame file permissions.

Kernel and storage

The 6.8 kernel brings mature io_uring support and a current NVMe driver stack. Databases and build tools that use io_uring see the benefit directly. Check which I/O scheduler is active on the root disk with cat /sys/block/vda/queue/scheduler. For virtual NVMe-backed disks, none or mq-deadline is the right answer, and Ubuntu picks a sensible default, so leave it alone unless a benchmark tells you otherwise.

Which plan

A single Go or Node service behind Caddy or nginx runs well on Spark. Add a local PostgreSQL or Redis and step up to Boost. For Docker hosts running a handful of compose stacks, Turbo gives you four vCPUs and room for image layers on the 80 GB volume. Build hosts and CI runners that compile in parallel belong on Warp or Hyper. See CI runners for the reasoning.

Lifecycle

Released April 2024. Standard security maintenance runs to mid 2029. Expanded Security Maintenance through Ubuntu Pro runs to 2034. Canonical publishes point releases (24.04.1, .2 and so on) roughly every six months; you get their contents through normal apt upgrades, so you never need to reinstall to "move" to a point release.