Running apt and dpkg non-interactively on Debian and Ubuntu without hanging on prompts

Goal

Install, upgrade or remove packages on Debian 12/13 or Ubuntu 22.04/24.04 from a script or agent session with no interactive prompt left unanswered.

Prerequisites

Root or sudo access; know which packages, if any, ask debconf questions (mail servers, database servers and a few others commonly do).

Steps

1. Export the frontend before any apt/dpkg invocation: export DEBIAN_FRONTEND=noninteractive. The debconf manual page states this variable can be set to change the frontend "for a minute" without reconfiguring debconf permanently; noninteractive never prompts and uses recorded or default answers.
2. Use apt-get, not the plain apt command, in scripts. The apt(8) manual page says scripts "should prefer using" apt-get/apt-cache because apt's own CLI output and behaviour may change between versions.
3. Pass -y (--yes/--assume-yes) to auto-confirm the install/removal prompt: apt-get -y install <pkg>.
4. For packages that would otherwise ask to keep or overwrite a modified configuration file, add -o Dpkg::Options::=--force-confold -o Dpkg::Options::=--force-confdef to the apt-get command. --force-confdef uses the package maintainer's default when there is one, falling back to --force-confold (keep the local file) or --force-confnew depending on which is also given.
5. If a package needs preseeded answers (e.g. a mail relay hostname), write them before installing: echo "postfix postfix/mailname string example.org" | debconf-set-selections. The command "can be used to pre-seed the debconf database with answers" and marks each question as seen so debconf will not ask it.
6. If apt-get reports the dpkg lock is held (/var/lib/dpkg/lock-frontend), do not delete the lock file — dpkg's advisory locking is tied to the process holding it and is released automatically when that process ends, so removing the file only risks a corrupted database while the real holder is still running. Instead identify the holder with fuser, which "identif[ies] processes using files or sockets": fuser -v /var/lib/dpkg/lock-frontend /var/lib/dpkg/lock. Let it finish, or terminate it deliberately, then run dpkg --configure --pending to let dpkg merge any pending journal updates.
7. On Ubuntu, needrestart can open its own interactive "which services should be restarted?" dialog at the end of an apt run. Set NEEDRESTART_MODE=a (restart automatically) or NEEDRESTART_MODE=l (list only) in the environment of the apt call, or set $nrconf{restart} in /etc/needrestart/conf.d/, so the dialog cannot block an unattended session.

Expected result

apt-get -y install ... exits 0 with no terminal prompt, and debconf-show <pkg> shows the preseeded values already marked seen.

Limits and test basis

--force-confold/--force-confdef change how conffile conflicts are resolved and can silently keep an outdated config; review conffile diffs after unattended upgrades of packages you hand-edited. No reboot is required for package installs unless the package itself schedules one (see kernel and unattended-upgrades articles in this set).