diff --git a/config/schema.go b/config/schema.go
index 3eac5320..ccc5fde2 100644
--- a/config/schema.go
+++ b/config/schema.go
@@ -99,7 +99,8 @@ var schema = `{
 			"properties": {
 				"url": {"type": "string"},
 				"image": {"type": "string"},
-				"rollback": {"type": "string"}
+				"rollback": {"type": "string"},
+				"policy": {"type": "string"}
 			}
 		},
 
diff --git a/config/types.go b/config/types.go
index e5466788..07c485cc 100644
--- a/config/types.go
+++ b/config/types.go
@@ -145,6 +145,7 @@ type UpgradeConfig struct {
 	URL      string `yaml:"url,omitempty"`
 	Image    string `yaml:"image,omitempty"`
 	Rollback string `yaml:"rollback,omitempty"`
+	Policy   string `yaml:"policy,omitempty"`
 }
 
 type EngineOpts struct {
diff --git a/images/01-base/Dockerfile b/images/01-base/Dockerfile
index a8311b12..51cc2588 100644
--- a/images/01-base/Dockerfile
+++ b/images/01-base/Dockerfile
@@ -34,6 +34,7 @@ RUN rm /sbin/poweroff /sbin/reboot /sbin/halt && \
 COPY inputrc /etc/inputrc
 COPY growpart /usr/bin/growpart
 COPY start_ntp.sh /bin/start_ntp.sh
+COPY os-subscriber /usr/bin/os-subscriber
 COPY dhcpcd/dhcpcd.enter-hook /etc/dhcpcd.enter-hook
 COPY dhcpcd/10-mtu /lib/dhcpcd/dhcpcd-hooks/
 COPY dhcpcd/dhcpcd.debug /usr/share/logrotate/logrotate.d/
diff --git a/images/01-base/os-subscriber b/images/01-base/os-subscriber
new file mode 100755
index 00000000..ef9fe8c5
--- /dev/null
+++ b/images/01-base/os-subscriber
@@ -0,0 +1,58 @@
+#!/bin/bash
+set -e -x
+
+gateway_address="http://ros.rancher.io/gateway"
+
+_sigProcess() {
+    echo "SIGINT/SIGTERM signal..."
+    kill -9 $$
+}
+
+trap _sigProcess SIGINT SIGKILL SIGTERM
+
+__read_policy() {
+    policy=`ros c get rancher.upgrade.policy`
+    if [ -z $policy ]; then
+        echo "can not read upgrade.policy"
+        exit 1
+    fi
+    return $(($policy))
+}
+
+__report_activity() {
+    arch=`uname -m`
+    uuid=`cat /sys/class/dmi/id/product_uuid`
+    release=`ros -v | awk '{print $2}'`
+    response=`wget --server-response ${gateway_address}/report --header 'Accept: application/json' --header 'Content-type: application/json' --header "arch: $arch" --header "uuid: $uuid" --header "release: $release" 2>&1 | awk '/^  HTTP/{print $2}'`
+    if [ $response -ge 200 -a $response -le 300 ]; then
+        echo "report activity success"
+    else
+        echo "report activity failed"
+    fi
+}
+
+__upgrade_operate() {
+    recommend_version=`wget ${gateway_address}/version -q -O -`
+    case $policy in
+        download)
+            echo "upgrade.policy is 'download'"
+            __report_activity
+            system-docker pull $recommend_version
+        ;;
+        auto)
+            echo "upgrade.policy is 'auto'"
+            __report_activity
+            ros os upgrade -i $recommend_version -f
+        ;;
+        none)
+            echo "upgrade.policy is 'none'"
+        ;;
+        *)
+            echo "upgrade.policy is 'illegal'"
+        ;;
+    esac
+}
+
+__read_policy
+
+__upgrade_operate
\ No newline at end of file
diff --git a/os-config.tpl.yml b/os-config.tpl.yml
index c29a47ac..5c6e6999 100644
--- a/os-config.tpl.yml
+++ b/os-config.tpl.yml
@@ -368,6 +368,25 @@ rancher:
       volumes:
       - /sys:/host/sys
       - /var/lib/system-docker:/var/lib/system-docker:shared
+    subscriber:
+      image: {{.OS_REPO}}/os-base:{{.VERSION}}{{.SUFFIX}}
+      command: os-subscriber
+      environment:
+      - IN_DOCKER=true
+      labels:
+        io.rancher.os.scope: system
+        io.rancher.os.after: console
+        cron.schedule: "0 0 3 * * ?"
+      privileged: true
+      pid: host
+      ipc: host
+      net: host
+      uts: host
+      volumes_from:
+      - command-volumes
+      - system-volumes
+      volumes:
+      - /sys:/host/sys
   system_docker:
     exec: true
     storage_driver: overlay2
@@ -386,6 +405,7 @@ rancher:
   upgrade:
     url: {{.OS_RELEASES_YML}}/releases{{.SUFFIX}}.yml
     image: {{.OS_REPO}}/os
+    policy: download
   docker:
     {{if eq "amd64" .ARCH -}}
     engine: docker-18.03.1-ce