Is it usually safe to run "apt-get upgrade" (in terms of stability) on a production server?

Solution 1:

Generally, yes this is safe. For critical packages, though (Postgres, Nginx, etc.), I'd recommend pinning those packages to a specific version so that they do not get updated. When Postgres gets updated, for instance, it will restart the database server, which is something you want to be able to schedule around planned downtime.

That said, it's always best to test upgrades on a staging server before promoting them to production, so that's something to think about adding to your deployment process.

Solution 2:

Aptitude has easier to remember commands: aptitude safe-upgrade vs. aptitude full-upgrade. It is still a good idea to install apt-listchanges so that you will be given information about the changes in the updated packages and the option to cancel the upgrade.