Thanks, Russ, Ansgar, and Marco for the explanations. So in summary:
* For systems running systemd - systemctl mask works well to disable individual daemons until explicitly re-enabled, regardless of which mechanism the package uses (systemd service or init script) to start the daemon. - systemctl mask requires you to know, prior to installing a package, the names of all services the package installs. - it has not been mentioned whether systemd provides any facility to block starting _all_ services for a period of time (esp when working in a chroot), including services that have not been installed at the time the hypothetical "block all services" command is invoked. * For systems running either systemd or sysvinit (maybe also runit?) - policy-rc.d can block individual systemd services and init scripts. - policy-rc.d can block all services and init scripts. - policy-rc.d is not well documented. - policy-rc.d requires manually writing a shell script (a trivial one-liner for the "block all" case). It is also worth noting that systemctl mask works on any systemd distribution, not just Debian GNU/Linux, but not other Debian ports with non-Linux kernels. And, policy-rc.d presumably works on any Debian distribution, not just Debian GNU/Linux, but not on non-Debian distributions. It looks to me like policy-rc.d is the best fit for performing package installations in a chroot (the OP's original question, IIUC), while systemctl mask is the right choice for manually dealing with maintenance of individual, already installed packages. ...Marvin