Home / Alt manpages / dpkg-preconfigure(8)

  • dpkg-preconfigure(8)
  • Admin command
  • linux

Preconfigure Debian Packages with dpkg-preconfigure

dpkg-preconfigure lets a package ask its debconf questions before installation even starts. That way the answers are sitting ready the moment the real install runs. The examples use dpkg-preconfigure from debconf 1.5.86ubuntu1, installed as /usr/sbin/dpkg-preconfigure on this machine. Allow about fifteen minutes, plus however long it takes to get hold of the package you actually mean to install.

  • You need: a readable local .deb file for the direct workflow.
  • It will not: install anything. Preconfiguration can ask questions and write debconf answers, but the install step is separate.
  • Privileges: an ordinary user for inspection and preparation. Reach for elevated privileges only when your debconf database or package workflow actually requires them.

1. Check the installed command

Start with the command path, package version and built-in help. All read-only:

$ command -v dpkg-preconfigure
/usr/sbin/dpkg-preconfigure
$ dpkg-query -W -f='${Package} ${Version}\n' debconf
debconf 1.5.86ubuntu1
$ dpkg-preconfigure --help
Usage: dpkg-preconfigure [options] [debs]
       --apt                    Apt mode.
  -f,  --frontend               Specify debconf frontend to use.
  -p,  --priority               Specify minimum priority question to show.
       --terse                  Enable terse mode.

On this installed release, --help also exits non-zero, so treat the printed usage as information rather than an exit-status health check. The available switches are --apt, --frontend, --priority and --terse, alongside --help itself.

Checkpoint

Confirm the package version and command path are the ones you actually mean to run before this goes anywhere near an installation script.

2. Preconfigure one local package

Give the command one or more package filenames. Replace the placeholder with a file you deliberately downloaded or built:

$ PACKAGE='/path/to/package.deb'
$ test -r "$PACKAGE" && echo 'package is readable'
package is readable
$ dpkg-preconfigure "$PACKAGE"

For each package that uses debconf, its configuration script gets a chance to inspect the system and ask questions. The command may open the selected debconf frontend, or fall back to defaults when a question's priority sits below your threshold. A clean return to the shell means preconfiguration finished; it does not mean the package is installed.

Warning

Do not run this against a package from an untrusted source. Its configuration script executes as part of the operation and can inspect the system within the permissions of that process. Check the file's origin and metadata through your normal repository and signature controls before you answer a single question.

3. Choose which questions to show

The priority setting is a minimum: questions below it are skipped and their defaults used instead. For a deliberately interactive run, set it explicitly:

$ dpkg-preconfigure --priority=low "$PACKAGE"

What actually gets asked depends on the package and the debconf database. A low threshold exposes more questions; a higher one leaves more answers at their defaults. Selecting a priority is not a guarantee that every possible question will appear.

Need a different interface? Pass its debconf frontend name:

$ dpkg-preconfigure --frontend=readline --priority=low "$PACKAGE"

Pick a frontend that actually suits the environment. A graphical frontend is a poor fit for an SSH session, and a terminal frontend can leave an unattended job blocked waiting for input that never comes. In automation, the frontend and priority belong in the reviewed job configuration, not left to whatever the session happens to provide.

4. Verify the run without installing anything

Keep preconfiguration separate from installation while you are testing. This feeds apt mode an empty package list, a safe way to check the input channel is accepted at all:

$ printf '' | dpkg-preconfigure --apt --priority=low
$ printf 'exit status: %s\n' "$?"
exit status: 0

On this host, the command also prints a debconf warning about an inaccessible passwords database when it runs without permission to read it. That warning has nothing to do with package installation. Investigate the database permissions and the account running your real workflow rather than silencing it blindly.

For a real package, verify the step immediately after it finishes:

$ dpkg-preconfigure --priority=low "$PACKAGE"
$ status=$?
$ printf 'dpkg-preconfigure status: %s\n' "$status"
dpkg-preconfigure status: 0

The status confirms the command completed, nothing more. It does not prove every answer suits the later installation. Review the questions and package documentation first, especially for anything that touches networking, authentication, storage or services.

5. Wire it into apt, only once the manual run works

In apt mode, dpkg-preconfigure reads package filenames from standard input rather than the command line. The manpage documents an apt hook in /etc/apt/apt.conf:

// Pre-configure all packages before
// they are installed.
DPkg::Pre-Install-Pkgs {
        "dpkg-preconfigure --apt --priority=low";
};

Warning

This is a system-wide apt configuration change. Save the existing file and line up a rollback before you touch it. Because it writes under /etc/apt, it normally needs elevated privileges:

$ sudo cp --preserve=all /etc/apt/apt.conf /etc/apt/apt.conf.before-dpkg-preconfigure
$ sudoedit /etc/apt/apt.conf

If /etc/apt/apt.conf does not exist, do not create a new global hook just to match this example. Check how your host actually organises apt configuration first, then put the setting where that deployment expects it. Keep the hook command short and double-check its quoting before saving.

Recovery

To undo the example, restore the backup once you have confirmed no other administrator has touched the file since:

$ sudo cp --preserve=all /etc/apt/apt.conf.before-dpkg-preconfigure /etc/apt/apt.conf

Only run an apt operation with this hook live inside a maintenance window if the chosen frontend can prompt. A hook waiting on input can make an unattended upgrade look stuck for hours.

Common traps

  • No questions appear. The package may not use debconf, answers may already exist, or the priority threshold may be too high. Lower it deliberately and check the package's documentation.
  • The command cannot open the package. Check the exact path and read permission with ls -l and test -r before reaching for sudo.
  • An unattended job waits. Check the frontend. A prompt is expected behaviour for an interactive frontend, not proof that apt is broken.
  • A warning mentions the debconf database. Work out which account is running the command and whether it can read or write that database. Avoid loosening database permissions broadly just to make a warning go away.
  • You expected an install. This command only runs configuration scripts ahead of installation. A separate install command is still required.

Done means

  • Version and path confirmed. The installed debconf version and dpkg-preconfigure path are the ones you meant to use.
  • The .deb is trustworthy. The intended file is readable and came from a source you checked.
  • Frontend and priority match the environment. Not left to whatever the session defaults to.
  • A real run returned status 0, and you actually read its questions and warnings.
  • Any apt hook was treated as privileged and system-wide, with a tested rollback in hand.
  • You know preconfiguration only prepares answers; it never installs the package itself.