SQL Server, CU's and Server Reboots

Question

I'm relatively new to CU's and SQL server. We have a few SQL Servers with dev, qa and prod instances (SQL 2017) on them. This is probably not the best idea, but that's what we have right now. Currently, we routinely have the GDR updates applied by our network folks. I have been asked to start taking over the SQL updates and switch us over to the "CU train" to get and keep us more up to date for the more non-security type upgrades.

1. My plan is to install the CU's first in the dev and qa instances to test and monitor for any issues before updating production. Because we have prod instances living on the same box as dev and qa, would installing updates to dev and/or qa instances possibly have any effect on the production instance? I'm wondering if any common components to all instances would get modified and cause issues.
2. Should the server get rebooted after applying a CU? My preference would be to reboot the server after applying a CU. But that would mean I would be bouncing the production instance for dev/qa updates and wondering if the reboot is actually needed, or if I would be good with the SQL service being restarted?

Thanks for any feedback on this. I really would like to have our prod instances live in their own house. But, like I said, this is what I have been handed for the time being and just wanted to see what more experienced folks had to say.

Answer 1

My plan is to install the CU's first in the dev and qa instances to test and monitor for any issues before updating production. Because we have prod instances living on the same box as dev and qa, would installing updates to dev and/or qa instances possibly have any effect on the production instance? I'm wondering if any common components to all instances would get modified and cause issues.

You're correct, shared components are upgraded for all instances. This may or may not affect the other instances, depends on the issue.

Should the server get rebooted after applying a CU?

There is required and not required, whether you should or not is up to you. If you are required to reboot, the installer (whether gui or command line) will let you know. Even if it's not required, there might be some intermittent oddities that could occur, I've dealt with this a handful of time over 12 years, but it's possible.

Honestly, your largest problem is what you've already called out which is that all of the instances are on the same server. This can more than just patching ramifications. I'm not going to belabor the point as you've called it out yourself, but it'll definitely help you in the long run (not just for patching) to change this practice (not all things are possible, I get it).