Digital Ocean doesn't load the kernel from the current system image, but instead uses a prestored external kernel associated with the image. This means that upgrade to the kernel from within the droplet (e.g. distribution security updates) are ignored (See http://digitalocean.uservoice.com/forums/136585-digital-ocea...). There is a workaround using kexec (see https://www.alextomkins.com/2013/11/digitalocean-debian-kern...). Does any body know if a similar approach would work for CoreOS ,given their whole image update process, or whether the DigitalOcean/CoreOS team have already taken care of this some other way?