Per Make apt-get (or aptitude) run with -y but not prompt for replacement of configuration files?

I did the following:

ec2run ami-3c994355 --region us-east-1 -n 1 -t m1.large -z us-east-1d

On the machine:

sudo apt-get update
sudo apt-get -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" dist-upgrade

I still get a prompt asking me which config file I want to use. These are the lines that come before the prompt:

Setting up grub-pc (1.99-21ubuntu3.1) ...


                         ┌───────────────────────────────────────────────────────┤ Configuring grub-pc ├───────────────────────────────────────────────────────┐                              
                         │ A new version of configuration file /etc/default/grub is available, but the version installed currently has been locally modified.  │                              
                         │                                                                                                                                     │                              
                         │ What do you want to do about modified configuration file grub?                                                                      │                              
                         │                                                                                                                                     │                              
                         │                                     install the package maintainer's version                                                        │                              
  • Unsatisfactory workaround: echo grub-pc hold | sudo dpkg --set-selections before first apt-get command
    – fratrik
    Commented Jun 5, 2012 at 19:02
  • I get this same issue and have tried many different permutations/spellings of Dpkg::Options::=, none of which have worked. I also tried adding the lines to the /etc/apt/apt.conf.d/local file as indicated, and they did not work either. This seems to be a regression in Precise. Commented Jun 6, 2012 at 1:39
  • +1 - thanks for asking - it was surprisingly easy to find this thread to this annoying problem
    – cwd
    Commented Jun 8, 2012 at 17:07
  • @fratrik Thank you ... your comment must be an independent answer so that it can be upvoted ... because out of all the answers here only you suggestion helped me Commented Jun 14, 2021 at 13:08

5 Answers 5


The /etc/default/grub file is generated at package install time, which is necessary because it integrates with debconf. This means that it can not treated as a dpkg conf file, and so dpkg's configuration file handling doesn't know about it.

Instead, it uses ucf, a more sophisticated Debian tool for handling configuration. This, unfortunately, doesn't understand dpkg options, so setting Dpkg::Options::="--force-confdef" won't help. It does have its own way of doing no-prompt upgrades, though, through the UCF_FORCE_CONFFNEW and UCF_FORCE_CONFFOLD environment variables.

ucf uses debconf for prompting, so setting the debconf interface to noninteractive will also silence the message. If you really want non-interactive updates you'll need to do this anyway - arbitrary packages may ask debconf questions (although they generally won't during upgrades).

You can set the debconf interface as a one-off by adding DEBIAN_FRONTEND=noninteractive to your environment, or can set it permanently by running dpkg-reconfigure debconf and selecting the noninteractive frontend. If you're using the noninteractive frontend you'll get the default answer for any questions a package might ask.

For ucf, the default answer is “keep the existing file”.

So, the full command to do a really, 100% guaranteed¹ no-prompting update would be.

sudo DEBIAN_FRONTEND=noninteractive apt-get -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" dist-upgrade

¹: It's technically possible for packages to use another method of prompting than debconf, but this is against Debian policy. If you run across such a package, file a bug.

  • 9
    Note that if you are testing this on a shell the sudo command seems to remove the DEBIAN_FRONTEND variable, ie you need sudo DEBIAN_FRONTEND=noninteractive apt-get -y dist-upgrade whereas DEBIAN_FRONTEND=noninteractive sudo apt-get -y dist-upgrade will fail Commented Jun 6, 2012 at 22:46
  • Also note that this is considered a bug and they are releasing new AMI images that should not have this issue: bugs.launchpad.net/ubuntu/+bug/1009294 Commented Jun 13, 2012 at 7:01
  • And the new AMIs are now released. Commented Jun 27, 2012 at 0:39
  • @ScottRitchie - your comment works too for helping to automate the install of the ganglia-webfrontend package. It has a prompt to ask for a reboot of apache to process the new conf file but this breaks when trying to automate the install of ganglia - added your comment to the front and fixed the problem Commented May 31, 2015 at 22:43
  • @ScottRitchie looks like the bug came back, as of yesterday our non-interactive ubuntu 16.04 installations were crashing due to this. Just a minor headache though, the answer helped, so hopefully it stays that way :)
    – Mahn
    Commented Jan 10, 2017 at 17:23

going off of RAOF's answer and after spending countless hours searching on the web to be able to perform a completely hands-off update & dist-upgrade on Ubuntu 12.04, i came up with this thanks to the fact this post (https://bugs.launchpad.net/ubuntu/+source/grub/+bug/239674/comments/1) points out that grub adheres to UCF and not Dpkg Options when you want to use the package maintainers grub menu.lst instead of any possible local menu.lst edits.

i left the Dpkg force-confnew options in for other packages that aren't grub.


ucf --purge /boot/grub/menu.lst

export DEBIAN_FRONTEND=noninteractive
apt-get update
apt-get -o Dpkg::Options::="--force-confnew" --force-yes -fuy dist-upgrade
  • 1
    This was the only thing that worked for me. Thanks!
    – wes
    Commented Oct 17, 2014 at 21:46
  • 2
    So let's say you're also using unattended-upgrades and have edited some grub config: how do you set UCF_FORCE_CONFFNEW in that context? Or would you need to blacklist grub from being updated?
    – thom_nic
    Commented Oct 20, 2017 at 14:59

The previous solutions wouldn't work with 16.04. This works from this answer on stack overflow:

sudo DEBIAN_FRONTEND=noninteractive apt-get -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold"  install grub-pc

After much testing, the only thing that worked was:

dpkg-reconfigure debconf -f noninteractive -p critical
UCF_FORCE_CONFFOLD=YES apt -o Dpkg::Options::="--force-confdef" -o DPkg::Options::="--force-confold" -y dist-upgrade

For what I was doing it (Ubuntu 16.04 in Vagrant with provisioning), the DEBIAN_FRONTEND=noninteractive was not enough. Thanks others in this thread, I needed to add UCF_FORCE_CONFFOLD=YES for grub-pc


I've been wrangling with the same issue on Ubuntu 18.04 the past few days. On launching a new EC2 instance (specifically ami-00035f41c82244dab), I run an automated provisioning script (via User Data config supplied at the time of initialisation), one of the first steps of which is to run apt update/upgrade.

The script gets blocked while the user is prompted about modified GRUB files - first /etc/default/grub, and then /boot/grub/menu.lst. Since this is running in an unattended mode when supplied as User Data, the process stalls and never recovers.

From lots of Googling, it seems this has been a long-running GRUB issue in one form or another, with fixes being applied and then latter regressing again, as far as I can tell.

Ultimately, the only workaround I have been able to apply successfully is the following ugly hack in my provisioning script. Hopefully it might get somebody else out of a bind though!


apt update

### Workaround: Pre-update /etc/default/grub and remove /boot/grub/menu.lst to avoid 'file changed' prompts from blocking completion of unattended update process
patch /etc/default/grub <<'EOF'
< GRUB_CMDLINE_LINUX_DEFAULT="console=tty1 console=ttyS0"
> GRUB_CMDLINE_LINUX_DEFAULT="console=tty1 console=ttyS0 nvme.io_timeout=4294967295"
> #GRUB_TERMINAL=console
rm /boot/grub/menu.lst

apt upgrade -y

### Workaround part 2: re-generate /boot/grub/menu.lst
/usr/sbin/update-grub-legacy-ec2 -y

I can only assume the problem I encountered is quite specific to the Ubuntu 18.04 AMI version currently available, and any updated version that incorporates newer GRUB packages may not be subject to the same issue. In particular, the nature of the changes to /etc/default/grub are not likely to be applicable to newer versions of the AMI. Just putting this out there anyway.

  • Try running the following one-liner: sudo DEBIAN_FRONTEND=noninteractive apt-get -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" -qq --force-yes upgrade
    – DarkNeuron
    Commented Jun 20, 2019 at 12:09
  • Also, here's the most recent bug (regression) mentioned above: bugs.launchpad.net/cloud-images/+bug/1747464
    – DarkNeuron
    Commented Jun 20, 2019 at 12:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .