How to enable the Livepatch Client on Ubuntu CoreΒΆ

Canonical Livepatch supports live kernel patching on Ubuntu Core machines. Livepatch is supported on Core20+ for amd64 and Core26+ for arm64 architectures. Canonical Livepatch is typically enabled using the Pro Client on classic Ubuntu machines. The Pro Client is not available for installation on Ubuntu Core machines, so the Livepatch Client must be enabled directly. Follow these steps on the Ubuntu Core machine:

  1. Install canonical-livepatch:

    sudo snap install canonical-livepatch
    
  2. Install jq and curl:

    sudo snap install jq curl
    
  3. Obtain a contract resource token using the Ubuntu Pro token from the ubuntu.com/pro dashboard.

    export pro_token=<pro_token>
    
    body="{\"architecture\":\"$(uname -m)\", \"hostType\":\"physical\", \"machineId\":\"$(cat /etc/machine-id)\", \"os\":{\"distribution\":\"$(. /etc/os-release && echo $PRETTY_NAME)\", \"kernel\":\"$(uname -r)\", \"release\":\"$(. /etc/os-release && echo $VERSION_ID)\", \"series\":\"core$(. /etc/os-release && echo $VERSION_ID)\", \"type\":\"Linux\"}}" && curl -X POST -H "Authorization: Bearer $pro_token" -H "Content-Type: application/json" https://contracts.canonical.com/v1/context/machines/token -d "$body" | jq '.resourceTokens | map(select(.type=="livepatch"))'
    

    Replace <pro_token> with the Ubuntu Pro token obtained from the ubuntu.com/pro dashboard.

    The following output is expected:

    [
        {
            "token": "<resource_token>",
            "type": "livepatch"
        }
    ]
    
  4. Enable the Livepatch Client using the <resource_token> from the previous step:

    sudo canonical-livepatch enable <resource_token>
    

At this point, the Canonical Livepatch Client is enabled on the Ubuntu Core machine.