[deathanatos]

Oooh, I did not know about that cloud-init command. I've always done something like your second one.

That just leaves unattended-upgrades, which is harder than the undead to kill, and Azure's WAAgent…