Canonical has published a reference guide for building, maintaining, and securing the infrastructure that underpins so‑called AI factories, where GPU clusters remain in production across multiple generations of models and frameworks. The official article dated November 2, 2026 defines this concept as the infrastructure and processes used to develop, train, and serve models, so that their security requirements extend throughout the production lifecycle. The proposal combines extended‑lifecycle patching, compliance automation, reboot‑less kernel patching, a minimized container supply chain, Day‑2 orchestration, and accelerated GPU confidential computing.
AI factory framework and extended maintenance
The AI factory framework implies that the stability of the operating system and AI/ML dependencies must be guaranteed for years, not months. Ubuntu Pro provides up to 15 years of security patching for the OS and Ubuntu archive packages, covering the typical lifecycle of a training cluster. This coverage eliminates the pressure to migrate workloads solely because the base OS reaches end‑of‑support.
Long‑term maintenance is not limited to the kernel: it spans compute libraries, container runtimes, and AI toolchains that evolve on their own schedules. The Ubuntu Pro subscription includes FIPS 140‑3 certified cryptographic modules for regulated environments such as government, finance, and healthcare. Free personal use on up to five machines lets you validate the full stack before committing to enterprise contracts.
Consistency across nodes becomes critical as the fleet grows to hundreds of GPUs. Any configuration drift introduces attack surface and complicates auditing. Canonical’s approach treats infrastructure as a versioned product, not a set of ad‑hoc scripts, facilitating reproducibility and incident response.
Ubuntu Pro, Livepatch, and automated compliance
Livepatch enables applying critical kernel security fixes without rebooting, so long‑running model training jobs do not have to be interrupted. This capability is decisive in clusters where an hours‑long maintenance window implies idle GPU costs and the risk of missing convergence deadlines. Livepatch covers Canonical kernel patches; it does not replace reboots for glibc, systemd, firmware, or microcode updates.
The Ubuntu Security Guide (USG) automates the application and auditing of CIS and DISA‑STIG profiles, helping demonstrate that every environment meets the same standard. The audit command sudo usg audit cis_level1_server generates HTML and XML reports under /var/lib/usg/. USG is part of Ubuntu Pro and is documented as free for personal use on a small number of machines. According to the auditd guide, auditing can be integrated into compliance pipelines.
Hardening automation reduces human error and validation time in large fleets. However, USG modifies system configuration; some CIS controls can break legacy applications, so testing in staging before production is mandatory. Remediation with sudo usg fix cis_level1_server must be part of a controlled change pipeline.
Minimized container supply chain
Container Build Service addresses the challenge of maintaining AI/ML base images through custom builds and security maintenance for their dependencies, including software such as PyTorch, TensorFlow, and CUDA. Rockcraft provides declarative OCI‑compliant builds based on Ubuntu, while Chisel selects only the files an application needs, allowing unnecessary components to be omitted.
Attack‑surface minimization via Chisel requires declaring explicit dependencies, which can break kitchen‑sink images that assume the presence of diagnostic tools or full shells. The CI/CD pipeline must be adapted to generate SBOMs and sign images, integrating provenance verification into every promotion to production.
Maintaining AI/ML dependencies beyond the base OS closes a common gap: vulnerabilities in framework layers or CUDA drivers often remain unpatched because the base OS is up to date. Container Build Service extends patching to those layers, providing a continuous chain of trust from silicon to the served model.
Day‑2 orchestration and MLOps with Juju
Charmed Kubeflow provides ML pipelines on Kubernetes packaged as charms, software operators that contain code specific for deployment, configuration, supported upgrades, and integrations. Juju, Canonical’s open‑source orchestration engine, runs these operators, reducing integration scripts and manual upgrade procedures for Kubeflow, MLflow, Kubernetes, and Istio.
The charm model introduces a learning curve: teams must validate upstream version compatibility before each upgrade. Day‑2 automation reduces human error and validation time, but requires discipline in integration testing and proven rollback strategies in representative environments.
Declarative orchestration enables treating the MLOps platform as versioned infrastructure, applying the same GitOps and compliance principles as the base OS. This aligns the lifecycles of model, data, and infrastructure, facilitating audits and coordinated incident response.
Confidential computing with H100 GPU
Ubuntu supports confidential virtual machines using Intel TDX and AMD SEV‑SNP, with hardware‑enforced isolation designed to protect guest memory from the hypervisor. Supported configurations with NVIDIA H100 GPUs extend confidential computing to accelerated AI workloads. Remote attestation provides evidence about the runtime environment.
Deploying confidential VMs with H100 GPU requires compatible hardware: 4th/5th‑gen Intel CPUs or AMD EPYC 9004, H100 GPU, and enabled BIOS/firmware. Remote attestation needs verification infrastructure such as Azure Attestation, Google Confidential Space, or a custom stack. Without that verification chain, the isolation guarantee remains incomplete.
This capability opens the door to multi‑tenant workloads or regulated data (healthcare, finance) without trusting the cloud provider’s hypervisor. Encryption performance in FIPS 140‑3 modules may degrade compared with non‑FIPS implementations; teams should measure the impact on their training and inference pipelines before mandating its use.
Applicable recommendations, conditions, and limits
- Enable Ubuntu Pro and USG on all AI nodes: requires a subscription (free for ≤5 machines for personal use; enterprise production requires a contract).
- Run
sudo usg audit cis_level1_serveras baseline andsudo usg fix cis_level1_serverfor remediation: test in staging; some CIS controls may break legacy applications. - Enable Livepatch on long‑running training clusters: it only covers Canonical kernel patches; it does not replace reboots for glibc, systemd, firmware, or microcode.
- Use Container Build Service + Rockcraft + Chisel for AI base images: requires a Canonical account and an adapted CI/CD pipeline; Chisel requires explicit dependencies.
- Deploy confidential VMs (TDX/SEV‑SNP) with H100 GPU for sensitive workloads: compatible hardware required; remote attestation requires verification infrastructure.
- Adopt Charmed Kubeflow + Juju for MLOps: learning curve of the charm model; validate upstream compatibility before each upgrade.
- Enforce FIPS 140‑3 in regulated environments: only Canonical‑certified modules; may degrade performance in symmetric/asymmetric encryption vs. OpenSSL default.
Canonical’s guide serves as a primary technical reference for comprehensive AI infrastructure hardening, combining 15‑year patching, automated compliance, rebootless kernel, minimized containers, Day‑2 orchestration, and confidential computing with GPU.
Structured reference for readers and AI agents
{
"format": "rafael-fuentes-article/1.0",
"language": "en",
"title": "Canonical publishes hardening guide for AI with Ubuntu Pro, USG",
"summary": "Canonical releases a technical guide to harden and maintain AI infrastructure with Ubuntu Pro, USG, Livepatch, minimized containers, and confidential computing with H100 GPU.",
"author": "Rafael Fuentes",
"publicationDate": "2026-11-05T20:01:35.040+01:00",
"eventDate": "2026-11-02",
"url": "https://falifuentes.com/rafael-fuentes-2026-11-05-pm-en/",
"translation": {
"language": "es",
"url": "https://falifuentes.com/rafael-fuentes-2026-11-05-pm-es/"
},
"topics": [
"AI",
"Artificial Intelligence",
"Automation and Robotics",
"Compliance and Regulations",
"Cryptography",
"Cybersecurity",
"Cybersecurity News",
"English",
"Supply Chain"
],
"sources": [
"https://canonical.com/blog/how-to-build-maintain-and-secure-infrastructure-for-ai-factories",
"https://tech-insider.org/auditd-setup-ubuntu-augenrules-13-steps-50-min-2026"
]
}