What do you do to prepare an Ubuntu droplet for production use

Hey David! 👋

A good first step is to start with this tutorial here:

https://www.digitalocean.com/community/tutorials/initial-server-setup-with-ubuntu

The tutorial covers a lot of the things that you might be after.

Coming from CentOS, I get why you’d want a clean and stable environment. Here are a few things that you could also do based on your requirements:

1. Since you’re not using LXD and Snap, you can safely remove them:

   sudo apt purge lxd lxd-client snapd
   sudo apt autoremove --purge
   

2. See what’s running and disable what you don’t need:

   sudo systemctl list-unit-files --state=enabled
   sudo systemctl disable <service-name>
   

3. Follow the steps from this tutorial here on how to secure your SSH service: https://www.digitalocean.com/community/tutorials/how-to-harden-openssh-on-ubuntu-20-04

Besides that, you could also do some non-security specific things like:

• Configure swap if you’re on a small Droplet.
• Set up the DigitalOcean monitoring agent.
• Enable backups.

Ubuntu is a bit more user-friendly but still very flexible. You can definitely trim it down to be as lean as CentOS.

Good luck with your project!

\– Bobby

Heya, @nusbaum

On top of what’s already mentioned you can also consider the following:

• Use ufw or iptables to manage firewall rules.
• Test new updates in a staging environment before applying them to production.
• Use LTS (Long-Term Support) versions of Ubuntu for better stability.
• Use tools like htop or iostat to monitor resource usage and identify unnecessary services.
• Consider setting up lightweight monitoring (e.g., Netdata or Prometheus).

In general Ubuntu’s flexibility allows you to strip away unnecessary components while retaining the robustness of its ecosystem.

Hope that this helps!

Heya,

I don’t think there is a set of common practices. The best way forward would be to remove software that you don’t need like snapd, lxd,

sudo apt purge lxd lxd-client snapd

You can also check a list of services like so

systemctl list-unit-files --state=enabled

and remove any that are not being used however leaving them as is I think is fine.