On this page · 13 sections
- What ends in May 2027, and what keeps running
- What changed in 2026
- Your four options
- Ubuntu Pro: what it covers and what it costs
- CI runners: GitHub Actions and Azure Pipelines
- Docker base images
- Cloud images and managed services
- Upgrade runbook: 22.04 to 24.04
- Worked example: what a one-year Pro bridge costs
- India and US notes
- Pre-deadline checklist
- How eCorpIT can help
- References
Summary. Ubuntu 22.04 LTS leaves standard security maintenance in May 2027, ending free CVE fixes for the more than 4,700 packages in the Main repository. Ubuntu Pro's Expanded Security Maintenance (ESM) runs to May 2032 and the Legacy add-on to May 2037. Canonical has not named the day, and its 22.04 release notes still say April 2027, so plan against 1 May 2027. CI breaks first: GitHub retires its ubuntu-22.04 and ubuntu-22.04-arm hosted runners on 17 April 2027, 161 days from 7 November 2026, with failing brownouts from 23 March. Docker's ubuntu:latest already points to 26.04, and AKS retires 22.04 node pools on 30 June 2027. Ubuntu Pro lists at $500 per physical server a year with unlimited VMs, $25 per workstation, free on up to five machines, and typically 3% to 4.5% of compute list price on public clouds. Verdict: fix CI labels and container base images first, upgrade servers to 24.04, and buy Pro only for machines that cannot move in time.
About this article. For platform, DevOps and infrastructure leads running Ubuntu 22.04 servers, CI pipelines or container images. On 7 November 2026 we checked every date, price and version against Canonical's lifecycle, pricing and documentation pages, GitHub's runner announcements, Docker's image library and Microsoft's Azure and AKS documentation. Prices are Canonical list prices in US dollars and can change. This is not legal or procurement advice, and no vendor paid for inclusion. Researched with AI assistance and reviewed by our editorial team.
For which release your servers should land on, see our comparison of Ubuntu 24.04, Ubuntu 26.04 and RHEL 10.
What ends in May 2027, and what keeps running
Standard security maintenance covers Main repository packages for five years; for 22.04 it closes in May 2027, and Canonical lists 24.04 LTS as the upgrade path. The Universe repository, home to most language libraries, databases and tools, never had standard coverage and gets fixes only through ESM-Apps in Ubuntu Pro.
Nothing switches off. Microsoft's Azure guidance says existing machines keep running, but Canonical stops security, feature and maintenance updates under standard support. Apt keeps working; what disappears is fixes for vulnerabilities disclosed after the cut-off.
The dates below come from Canonical's release-cycle and kernel-lifecycle pages, and the package counts from its Ubuntu Pro pricing page.
| Component on 22.04 | Free standard support ends | With Ubuntu Pro (ESM) | With Legacy add-on |
|---|---|---|---|
| Main packages (over 4,700) | May 2027 | May 2032 | May 2037 |
| Universe packages (over 36,000) | Never covered | May 2032 (ESM-Apps) | May 2037 |
| GA kernel 5.15 (22.04.0 and 22.04.1) | May 2027 | May 2032 | May 2037 |
| HWE kernel 6.8 (22.04.5) | May 2027 | May 2032 | May 2037 |
| Break-fix support | Not included | May 2032 (paid support tiers) | May 2037 |
| FIPS 140-3, CIS and DISA-STIG | Not included | Included (all achieved for 22.04) | Included |
hwe-support-status --verbose shows a host's kernel track.
The exact day
Canonical gives a month, not a day. The 22.04 release notes say April 2027, as did the Ubuntu Weekly Newsletter on 2 November 2026. The release-cycle page, the kernel table and Microsoft's Azure table say May 2027. Precedent points to the end of May: 20.04 ended on 31 May 2025, and the 24.04 release notes name 31 May 2029 for that release. Freeze changes around 1 May 2027 and neither reading catches you out. Microsoft also lists the end of 22.04 Pro coverage as April 2032, a month before Canonical's May 2032.
What changed in 2026
- Ubuntu 26.04 LTS is out, but not reachable in one hop. Canonical released 26.04 (Resolute Raccoon) on 23 April 2026, with standard support to May 2031; 22.04 users must first upgrade to 24.04. LTS-to-LTS upgrades open only after the first point release, and 26.04.1 shipped on 27 August 2026.
- GitHub set a retirement date for its 22.04 runners. On 16 June 2026 GitHub said
ubuntu-22.04andubuntu-22.04-armwould enter deprecation on 17 September 2026 and go fully unsupported on 17 April 2027. The 26.04 images reached general availability on 17 September, andubuntu-latestbegan moving to 26.04 on 19 October, with completion planned by 19 November 2026.
- Docker's latest tag moved. The official library now maps
ubuntu:latestto 26.04.
- 24.04 got a 7.0 kernel. The 24.04.5 point release on 10 September 2026 brought a 7.0 hardware enablement kernel, supported to May 2029.
- AKS set its own 22.04 date. Microsoft retires Ubuntu 22.04 node pools on 30 June 2027 (details below).
Your four options
Support dates are from Canonical's release-cycle page and prices from its Ubuntu Pro pricing page.
| Option | Support you end up with | Cost basis | Effort | Best for |
|---|---|---|---|---|
| In-place upgrade to 24.04 (do-release-upgrade) | Standard to May 2029; ESM to May 2034 | No licence cost | Medium: one LTS hop, application retest | Long-lived VMs and bare metal you cannot rebuild easily |
| Rebuild on 24.04 or 26.04 | Standard to May 2029 or May 2031 | No licence cost | Medium to high: new images, config management | Fleets built from Terraform, Packer, cloud-init or Ansible |
| Stay on 22.04 with Ubuntu Pro | ESM to May 2032 | $500 per server a year, $25 per workstation, or about 3% to 4.5% of cloud compute | Low: attach a token | Appliances, vendor-certified stacks, FIPS workloads |
| Do nothing | No new fixes after May 2027 | Nothing now, risk later | None | No production system |
Most estates mix the first three. Auditors and cyber-insurers ask about the fourth.
Ubuntu Pro: what it covers and what it costs
Ubuntu Pro bundles ESM for Main and Universe, Kernel Livepatch, Landscape, FIPS 140-3 certified packages and CIS hardening, with optional enterprise support. Microsoft describes ESM as patching critical, high and selected medium CVEs. Canonical's list prices on 7 November 2026 were as follows.
| Plan | Price a year | Notes |
|---|---|---|
| Personal | Free | Up to 5 machines |
| Community | Free | Up to 50 machines for active Ubuntu community members |
| Workstation | $25 per machine | Security only; $300 with 24/7 full support |
| Server with unlimited VMs | $500 per machine | Security only, no support |
| Server with 24/7 infra support | $1,775 per machine | Break-fix for Main |
| Server with 24/7 full support | $3,400 per machine | Break-fix for Main and Universe |
| Weekday support | 50% of the 24/7 price | Weekday cover only |
| Legacy add-on | 50% more than the Pro subscription | Extends coverage to 15 years |
| Public cloud | Typically 3% to 4.5% of compute list price | Metered hourly on the cloud bill |
On AWS, Canonical says Pro pricing scales with the instance's vCPUs, is metered by the second and can be discounted through Savings Plans. Existing LTS instances can move to Pro through AWS License Manager, and the 22.04 Pro image is maintained until 2032. FIPS packages exist for 22.04 on both AMD64 and Graviton, and the real-time kernel covers 22.04 and 24.04. Microsoft documents an in-place Pro upgrade on Azure for Ubuntu Server 16.04 and later.
Buy Pro where a machine cannot move by May: appliances certified only on 22.04, regulated systems mid-audit, or FIPS workloads (see the US note). It is no substitute for migration, because ESM delivers security fixes only, not newer hardware support or toolchains.
CI runners: GitHub Actions and Azure Pipelines
Most teams hit 22.04's retirement first in hosted CI. GitHub's 16 June 2026 notice covers both GitHub Actions and Azure DevOps. Jobs scheduled during four brownouts, each starting at 14:00 UTC on 23 March, 30 March, 6 April and 13 April 2027, will fail. From 17 April 2027, jobs that still use either 22.04 label end with an error. This follows GitHub's policy of supporting at most two GA images and one beta per OS, and deprecating the oldest label once a new one reaches GA.
The 20.04 precedent suggests the date will hold: deprecation began on 1 February 2025, weekly brownouts ran from 4 March, and the image went unsupported on 15 April 2025 after a two-week slip, about six weeks before Canonical's 31 May cut-off.
The 22.04 image is already shrinking. GitHub removed its pre-cached Docker images from 12 January 2026, citing disk space, and in early September 2026 rolled Podman back from 5.8.4 to the distribution's 3.4.4.
# Find every workflow still pinned to 22.04 or floating on ubuntu-latest
grep -rnE "runs-on:.*(ubuntu-22\.04|ubuntu-latest)" .github/workflows/
# Typical fix: pin the version you have tested, not the floating label
sed -i 's/ubuntu-22\.04/ubuntu-24.04/g' .github/workflows/*.yml
Three rules for the move:
- Do not jump to the floating label.
ubuntu-latestresolves to 26.04 once the migration finishes. That image ships GCC 15.2 and Python 3.14 on glibc 2.43. GitHub's announcement says Java 17 stays the default, but the image readme lists Java 25, so check what your builds pick up. Pinubuntu-24.04orubuntu-26.04explicitly.
- Watch glibc direction. A binary built on a newer runner may not start on an older target. If you still ship artefacts to 22.04 servers, build them in a
ubuntu:22.04container on a 24.04 runner until those servers retire, a problem raised in comments on GitHub's 20.04 notice.
- Self-hosted runners are separate. The deprecation covers hosted labels. A self-hosted 22.04 runner is your own server: it needs an upgrade or Pro by May 2027, plus a current runner agent, which our self-hosted runner version guide covers.
Docker base images
Docker's official ubuntu image is built and maintained by Canonical engineers. On 7 November 2026 its library file listed four streams: 22.04 and jammy (latest build dated 20 October 2026), 24.04 and noble, 26.04, resolute and latest, and 26.10, stonking and rolling. There is no focal entry. It was removed in the 1 June 2025 update, the day after 20.04 left standard support, and the last focal build was dated 4 April 2025. Docker Hub still serves focal, last pushed on 9 April 2025. If jammy follows, FROM ubuntu:22.04 will keep pulling an ageing base layer after May 2027.
What to do with container images:
- Pin by version, never latest.
ubuntu:latestmoved from 24.04 to 26.04 in 2026 and will move again.
- Rebase to ubuntu:24.04 and rebuild. Most images need only the base change and package-name fixes.
- If you must stay on jammy, Canonical documents attaching Ubuntu Pro inside a Dockerfile. Mount an attach config as a BuildKit secret, use a single-use, short-lived guest token from a Pro-attached build host, enable
esm-infraandesm-apps, then detach and purge the client within the sameRUNinstruction so no token lands in a layer.
FROM ubuntu:22.04
RUN --mount=type=secret,id=pro-attach-config \
apt-get update \
&& apt-get install --no-install-recommends -y ubuntu-pro-client ca-certificates \
&& pro attach --attach-config /run/secrets/pro-attach-config \
&& apt-get upgrade -y \
&& pro detach --assume-yes \
&& apt-get purge --auto-remove -y ubuntu-pro-client \
&& rm -rf /var/lib/apt/lists/*
Build with DOCKER_BUILDKIT=1 docker build . --secret id=pro-attach-config,src=pro-attach-config.yaml. Canonical's example also purges ca-certificates; keep it if your container needs it. Docker Engine itself still lists 22.04, 24.04, 26.04 and 26.10 as supported hosts.
Cloud images and managed services
AWS. Moving a 22.04 instance to 26.04 can force an instance change: 26.04 AMD64 cloud images are built for the AMD64v3 microarchitecture level, and Canonical lists the M1 to M4, C1, C3, C4, R3, R4, I2, G3, P2, P3 and P3dn families as no longer supported. The change starts with 26.04, so 24.04 has no such restriction: another reason to make 24.04 the first hop for older fleets.
Google Cloud. The same change means 26.04 images no longer run on N1 machines with Intel Ivy Bridge or Sandy Bridge CPUs.
Azure. Microsoft's guidance repeats the one-hop rule for LTS upgrades.
Managed Kubernetes. From 30 June 2027 AKS stops producing 22.04 node images and security patches and blocks new 22.04 node pools. On 30 April 2028 it removes the images, so scaling and repair operations fail. Node pools on the default Ubuntu OS SKU move to 24.04 with a Kubernetes upgrade; Microsoft's pages disagree on whether that happens at 1.35 or 1.36, so check the node image after each upgrade. Ubuntu 26.04 node pools are in preview from Kubernetes 1.36. Our Kubernetes 2027 upgrade calendar covers the cluster side.
Upgrade runbook: 22.04 to 24.04
Canonical supports upgrades only to the next sequential LTS, and only after that release's first point release. 24.04 has had five point releases, so the path is open.
Before the window
- Inventory: release, kernel track, Pro status and third-party sources.
- Snapshot or back up. Once do-release-upgrade finishes its download, the process cannot be cancelled.
- Fully update 22.04, including phased updates, and reboot if
/run/reboot-requiredexists.
- Check free disk space, since the upgrade can download several gigabytes.
lsb_release -ds; uname -r
hwe-support-status --verbose
pro status
grep -rhE "^deb |^URIs:" /etc/apt/sources.list /etc/apt/sources.list.d/ 2>/dev/null
sudo apt update
sudo apt dist-upgrade -o APT::Get::Always-Include-Phased-Updates=true
[ -f /run/reboot-required ] && sudo reboot
sudo do-release-upgrade
During the upgrade. Third-party repositories and PPAs are disabled and cause most upgrade problems, so re-enable them only once 24.04 builds exist. Review each configuration-file prompt with the D option, which shows the differences. The system is not upgraded until the final reboot.
What changes under your applications (22.04 to 24.04)
- Kernel 5.15 to 6.8; systemd to 255.4; Netplan to 1.0.
- glibc 2.35 to 2.39; Python 3.10 to 3.12; OpenJDK default 21; LLVM 18; Rust 1.75; Go 1.22.
- PHP 8.1 to 8.3; PostgreSQL 14 to 16; nginx 1.18 to 1.24.
Versions are from the two releases' notes. Each can break Python virtualenvs and wheels, PHP extensions, PostgreSQL data directories (which need pg_upgradecluster) or nginx modules. Test the application, not just the boot.
After 24.04. The 24.04 to 26.04 path is open now that 26.04.1 has shipped, but 26.04 brings bigger changes: sudo-rs as the default sudo, Rust coreutils, cgroup v1 removed, apt-key removed, MySQL 8.4 locking out accounts that use mysql_native_password by default, and the AMD64v3 cloud images above. Our 24.04 vs 26.04 vs RHEL 10 comparison covers that decision.
Worked example: what a one-year Pro bridge costs
Take an estate with 22.04 on six physical virtualisation hosts (about 90 VMs) and on 30 EC2 instances costing $9,000 a month at list price. Assume 70% of workloads upgrade by May 2027 and the rest need a year, at Canonical's list prices.
- On-premises, security only. Pro is priced per physical host with unlimited VMs, so a host with a few stragglers costs as much as a full one: 6 × $500 = $3,000 a year. Consolidating stragglers onto two hosts cuts that to 2 × $500 = $1,000.
- On-premises with 24/7 infra support. 6 × $1,775 = $10,650 a year, or 2 × $1,775 = $3,550 for two consolidated hosts.
- AWS. At Canonical's typical 3% to 4.5% of compute list price, Pro on $9,000 a month of EC2 adds $270 to $405 a month, or $3,240 to $4,860 a year. Converting only the 30% that cannot move cuts this to roughly $970 to $1,460 ($3,240 × 0.3 = $972; $4,860 × 0.3 = $1,458).
The licence is rarely the large number. The real cost of a bridge year is a second patch stream, a second CI target and another audit question in 2028.
India and US notes
India. For organisations whose financial year closes on 31 March, GitHub's brownouts on 23 and 30 March 2027 land inside the year-end change freeze, and the runner retirement on 17 April follows soon after it lifts. Move CI labels in January or February 2027, and schedule server upgrades for that window or just after the freeze. Running operating systems without security fixes is hard to square with the reasonable security safeguards the DPDP Rules require; our DPDP Rules compliance checklist covers the wider controls.
US public sector and FIPS. Canonical lists FIPS 140-3 as achieved for 22.04, pending for 24.04 and planned for 26.04. If a contract requires validated cryptographic modules, upgrading can take you out of compliance until the newer release is validated. Staying on 22.04 with Pro FIPS packages until then can be the correct call.
Pre-deadline checklist
- List every 22.04 host, VM, container image, CI label, node pool and golden image, with an owner and a date.
- Mark each: upgrade to 24.04, rebuild, or Pro bridge with an exit date.
- Move CI off the 22.04 labels before the first brownout on 23 March 2027, pin
ubuntu-24.04, and removeubuntu-latestfrom release pipelines.
- Rebase Dockerfiles to
ubuntu:24.04and banubuntu:latestin production images.
- Check cloud instance families before any 26.04 rebuild.
- Upgrade non-production first and compare service health.
- Attach Pro tokens to the remaining machines before 1 May 2027 and confirm
pro statusshowsesm-infraandesm-appsenabled.
- Move AKS node pools to 24.04 before 30 June 2027.
How eCorpIT can help
eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. Our cloud computing services team can inventory a 22.04 estate, move CI labels and Dockerfiles, and run staged upgrades to 24.04 with rollback points. Talk to us at /contact-us/.
Last updated: 7 November 2026.
