APT unattended upgrade with no user interaction

Question

I am setting up a cron job to update my Debian server box, and there is a potential problem. If I try upgrading from the terminal using apt -y upgrade, even though there is the -y option, when APT configures them, some packages display a ncurses prompt (or a Y/I/N/O/D/Z prompt) for random options that I always leave on default. How can these be avoided, if the command is not being run by me sitting in front of the computer, but by cron, with no way of user interaction?

Answer 1

I agree with Stephen Kitt's advice to use unattended-upgrades in the usual case of a running desktop/laptop/server.
Here's how I've dealt with this in scripts that were building a custom Amazon machine image (AMI) without waiting on unattended upgrades. This was on Ubuntu 16.x and 20.x using the lower-level apt-get command, but I think it will work on Debian also.

E.g. a "dist-upgrade" command where a grub update may trigger a prompt to accept a new conf file or keep the old one:

DEBIAN_FRONTEND=noninteractive \
  apt-get -y \
    -o DPkg::Options::="--force-confold" \
    -o DPkg::Options::="--force-confdef" \
    dist-upgrade

I split the command across several lines to make it easier to read.
The environment variable setting DEBIAN_FRONTEND=noninteractive is one ingredient that avoids prompts for a Y/I/N/O/D/Z answer. The other ingredient is to give dpkg a clear indication of the option you want.
The --force-confold and --force-confdef are options to dpkg. --force-confdef chooses the default action if the package defines one. If a default is not defined, then --force-confold chooses the old version, or --force-confnew chooses the new version.
In my use case I wanted the old version.

More discussion and details in this previous question