How to Completely Disable ‘Apt-daily’ (Background Updates) Services in Ubuntu Server

By default, Ubuntu Server installs and activates a pair of systemd timers—apt-daily.timer and apt-daily-upgrade.timer—that routinely wake up in the background to download package lists, perform automated maintenance, and occasionally trigger unattended upgrades. While this automated maintenance is convenient for a hands-off home server, it introduces severe unpredictability in a production environment. If an automated apt-get update process locks the dpkg database precisely when your CI/CD pipeline attempts to deploy a new release, your deployment will fail with a “Could not get lock /var/lib/dpkg/lock” error. In strict enterprise environments, all package management must be scheduled and executed manually during designated maintenance windows.

This guide explains how to completely disable the apt-daily background services in Ubuntu Server, ensuring that apt never runs autonomously.

Stop and Disable the Apt Timers via Systemctl

The automated updates are not driven by a traditional cron job, but rather by systemd timers. You must stop the timers and disable the underlying services to permanently halt the behaviour.

1. Log into your Ubuntu Server as root or via a user with sudo privileges.
2. First, stop the active timers to prevent them from triggering while you are working:

   sudo systemctl stop apt-daily.timer
   sudo systemctl stop apt-daily-upgrade.timer

3. Next, disable the timers so they do not restart upon the next system boot:

   sudo systemctl disable apt-daily.timer
   sudo systemctl disable apt-daily-upgrade.timer

4. Finally, for total certainty, you should mask the underlying systemd services that the timers would normally trigger. Masking points the service files to /dev/null, making it completely impossible for any automated script or rogue process to wake them up:

   sudo systemctl mask apt-daily.service
   sudo systemctl mask apt-daily-upgrade.service

Verify the Configuration

To confirm that the automation has been successfully neutralized, reload the systemd daemon to clear any cached states:

sudo systemctl daemon-reload

Then, verify the status of the services:

sudo systemctl status apt-daily.service

The output must explicitly state Loaded: masked. Your Ubuntu Server is now strictly manual-update only. The dpkg database will remain unlocked and entirely under your direct administrative control.