What happens when a vulnerability is found in the version of the kernel my Fly machine runs?

1

Haven’t found my answer in the documentation or the forum…

Does Fly restart the machine automatically with a new kernel?

Do I get a notification to restart the machine?

Also in general - do Fly machines have their kernel versions pinned? In other words, if I restart a Fly machine, does it pick up the latest kernel made available by Fly automatically or do I have to destroy and recreate a machine to get that?

2

Hmm, just after posting I found this sentence in Healthcare apps on Fly · Fly Docs

Fly.io is responsible for the security both of our host kernels (of course) and of the guest kernels our apps run in; one less thing for you worry about.

But how does this work out operationally?