This is the script that I am using to test this modifications on Xenial machine. If needed, I can also extend it to address other releases: -------------------- #!/bin/sh set -x series=xenial name=$series-dev function update-notifier-ua-not-installed () { # Expects this output # x packages can be updated. # x of these updates are security updates. echo "-----------------------------------------------------------" echo "xenial: ua not installed" lxc exec $name -- /usr/lib/update-notifier/apt-check --human-readable echo "-----------------------------------------------------------" } function update-notifier-ua-not-attached-esm () { # x updates can be installed immediately. # x of these updates are security updates. # # Enable UA Apps: ESM to receive x additional security updates. # See https://ubuntu.com/security/esm or run: sudo ua status echo "-----------------------------------------------------------" echo "xenial esm: ua not attached" lxc exec $name -- /usr/lib/update-notifier/apt-check --human-readable echo "-----------------------------------------------------------" } function update-notifier-ua-not-attached () { # Expects this output # UA Infra: Extended Security Maintenance (ESM) is not enabled. # # x updates can be installed immediately. # x of these updates are security updates. echo "-----------------------------------------------------------" echo "xenial non-esm: ua not attached" lxc exec $name -- /usr/lib/update-notifier/apt-check --human-readable echo "-----------------------------------------------------------" } function update-notifier-ua-attached-esm () { # Expects this output # x updates can be installed immediately. # x of these updates are fixed through UA Apps: ESM. # x of these updates are security updates. # To see these additional updates run: apt list --upgradable echo "-----------------------------------------------------------" echo "xenial esm: ua attached" lxc exec $name -- /usr/lib/update-notifier/apt-check --human-readable echo "-----------------------------------------------------------" } function update-notifier-ua-attached () { # Expects this output # x updates can be installed immediately. # x of these updates are fixed through UA Apps: ESM. # x of these updates are security updates. # To see these additional updates run: apt list --upgradable echo "-----------------------------------------------------------" echo "xenial non-esm: ua attached" lxc exec $name -- /usr/lib/update-notifier/apt-check --human-readable echo "-----------------------------------------------------------" } function turn-distro-into-esm-mode() { # guarantee that xenial distro is on ESM mode lxc exec $name -- sed -i 's/days_until_esm, _ = .*/days_until_esm = "-1"/' /usr/lib/update-notifier/apt-check } function turn-distro-into-non-esm-mode() { # guarantee that xenial distro is on ESM mode lxc exec $name -- sed -i 's/days_until_esm = .*/days_until_esm = "1"/' /usr/lib/update-notifier/apt-check } function setup-update-notifier() { lxc exec $name -- add-apt-repository ppa:lamoura/update-notifier-test-ppa -y lxc exec $name -- apt update lxc exec $name -- apt install update-notifier-common -y } function install-ua() { lxc exec $name -- add-apt-repository ppa:ua-client/daily -y lxc exec $name -- sudo apt-get update lxc exec $name -- sudo apt-get install ubuntu-advantage-tools -y lxc exec $name -- ua version } function ua-attach() { lxc exec $name -- sed -i 's/contracts.can/contracts.staging.can/' /etc/ubuntu-advantage/uaclient.conf lxc exec $name -- ua attach $UACLIENT_BEHAVE_CONTRACT_TOKEN_STAGING } function ua-detach() { lxc exec $name -- ua detach --assume-yes } lxc delete --force $name lxc launch ubuntu-daily:$series $name sleep 10 setup-update-notifier update-notifier-ua-not-installed install-ua turn-distro-into-esm-mode update-notifier-ua-not-attached-esm ua-attach update-notifier-ua-attached-esm turn-distro-into-non-esm-mode ua-detach update-notifier-ua-not-attached ua-attach update-notifier-ua-attached set +x --------------------- Here I am using a env variable named UACLIENT_BEHAVE_CONTRACT_TOKEN_STAGING which is a staging token used to enable service in uaclient. We are using a staging token here because esm-apps is still a beta service that can only be enabled in the staging env. If there is any problems getting such token for uaclient, just contact me and I can help with that