I came to the conclusion that to manually control unattended upgrades it currently the "easiest" (sarcasm tag on) way to only let the timer update your package list and manually run unattended-upgrades via cron at your desired time.
To do so: # apt-get install unattended-upgrades update-notifier-common # rm /etc/apt/apt.conf.d/20auto-upgrades /etc/apt/apt.conf.d/10periodic # rm /var/log/unattended-upgrades/* # vi /etc/apt/apt.conf.d/20auto-upgrades APT::Periodic::Update-Package-Lists "1"; APT::Periodic::Unattended-Upgrade "0"; # vi /etc/apt/apt.conf.d/local Dpkg::Options { "--force-confdef"; "--force-confold"; } # vi /etc/apt/apt.conf.d/50unattended-upgrades (Thanks to ansible-role at https://github.com/jnv/ansible-role- unattended-upgrades) Ubuntu: ####### // Unattended-Upgrade::Origins-Pattern controls which packages are // upgraded. Unattended-Upgrade::Origins-Pattern { "origin=Ubuntu,archive=${distro_codename}-security"; //"o=Ubuntu,a=${distro_codename}"; //"o=Ubuntu,a=${distro_codename}-updates"; //"o=Ubuntu,a=${distro_codename}-proposed-updates"; }; // List of packages to not update (regexp are supported) Unattended-Upgrade::Package-Blacklist { }; // Do automatic removal of new unused dependencies after the upgrade // (equivalent to apt-get autoremove) Unattended-Upgrade::Remove-Unused-Dependencies "true"; // Automatically reboot *WITHOUT CONFIRMATION* if a // the file /var/run/reboot-required is found after the upgrade //Unattended-Upgrade::Automatic-Reboot "true"; // Use apt bandwidth limit feature, this example limits the download // speed to 70kb/sec //Acquire::http::Dl-Limit "70"; Acquire::http::Dl-Limit "350"; Debian: ####### // Unattended-Upgrade::Origins-Pattern controls which packages are // upgraded. Unattended-Upgrade::Origins-Pattern { "origin=Debian,codename=${distro_codename},label=Debian-Security"; //"o=Debian,codename=${distro_codename},label=Debian"; //"o=Debian,codename=${distro_codename},a=proposed-updates"; }; // List of packages to not update (regexp are supported) Unattended-Upgrade::Package-Blacklist { }; // Do automatic removal of new unused dependencies after the upgrade // (equivalent to apt-get autoremove) Unattended-Upgrade::Remove-Unused-Dependencies "true"; // Automatically reboot *WITHOUT CONFIRMATION* if a // the file /var/run/reboot-required is found after the upgrade //Unattended-Upgrade::Automatic-Reboot "true"; // Use apt bandwidth limit feature, this example limits the download // speed to 70kb/sec //Acquire::http::Dl-Limit "70"; Acquire::http::Dl-Limit "350"; # vi /opt/unattended-upgrade-manual.sh #!/bin/bash sleep $((RANDOM \% 1800)) apt-get update unattended-upgrade -d apt-get -y clean # chmod +x /opt/unattended-upgrade-manual.sh # vi /etc/cron.d/unattended-upgrade SHELL=/bin/bash PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin 30 03 * * * root /opt/unattended-upgrade-manual.sh Fuck the systemd-timers, fuck cron.daily - I'm in charge... :P Improvements are welcome. Best regards Florian -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apt in Ubuntu. https://bugs.launchpad.net/bugs/1615482 Title: apt-daily timer runs at random hours of the day Status in apt package in Ubuntu: Triaged Bug description: apt, from 1.2.10 onwards (ie any version in Xenial, onwards) uses a systemd timer instead of a cron.daily job. This is a good thing, decoupling apt daily runs from the rest of cron, and ensuring other cron.daily jobs are not blocked by up to half an hour by the default settings of unattended-upgrades. However the policy chosen is to have the apt daily script run at a random hour of the day in a wrong headed attempt to reduce server load. This has the side effect of running unattended-upgrades at random hours of the day — such as business hours — rather than being confined to between 6:25am and 6:55am, using the defaults. A better policy would be to have the script activate at 6:00am plus an interval of 20 minutes at one second intervals reducing the impact of timezone population spikes, while still allowing unattended-upgrades to run within a predictable interval, before 7am. At the very least, some sort of note in the NEWS file detailing the new behaviour would be welcome. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1615482/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp