Back when we were on VxRails, the patches, which took 1-4 hours to apply for our cluster, would straggle in sometime after VMware released them. Having been burned once by Dell pulling a patch after I'd installed it, I learned to wait at least two weeks after it had been released before applying. Further, they encourage running an elaborate pre-flight check called VxVerify on all the nodes. Its findings occasionally required opening an SR, fixing the issue, and then patching.
So, no, I don't rush to apply patches, though the thought of guests breaking confinement is unsettling.
My Ubuntu servers all run a daily unattended update, but aren't necessarily in sync due to phasing and different OS versions.
My Windows servers get patched within a few days after the patch is available, though I stagger the DCs by days or weeks due to another learning experience.
So, no, I don't rush to apply patches, though the thought of guests breaking confinement is unsettling.
My Ubuntu servers all run a daily unattended update, but aren't necessarily in sync due to phasing and different OS versions.
My Windows servers get patched within a few days after the patch is available, though I stagger the DCs by days or weeks due to another learning experience.