Vilice is a proof of concept. Run it on a box you can afford to lose.

vilice apply-updates

Apply machine OS package updates.

operate recorded before it runs

vilice apply-updates --help
vilice apply-updates — Apply machine OS package updates

Applies the operating system's pending package updates. This is the
_vilice user's one narrow root escalation, granted by a single line in
/etc/sudoers.d/vilice and nothing wider.

It patches the machine, not the apps. An app is whatever image its
spec pins, and is updated by deploying a new digest.

Usage:
  vilice apply-updates

Examples:
  Patch the OS. Recorded, like every other act.
    vilice apply-updates

Scope:  operate — reachable by an operate or grant key
Record: written before the command runs