It seems that security updates and other package updates are not automatically installed in Juju nodes. I assume that they are installed at installation of new Juju machines, or that the installation media is a daily updated version of Ubuntu.
How do I ensure that updates are installed in all machines?
And what about reboots to install kernel updates?