dpkg force-confold: Retain Debian Configs Silently

This article explains how the force-confold directive in Debian's package manager, dpkg, manages configuration file conflicts during package upgrades. When package updates introduce new default configurations that clash with locally modified files, this flag forces the system to preserve the existing, historical configuration without prompting the administrator. By automating this decision, system administrators can execute completely silent, non-interactive upgrades across single machines or large Debian fleets.

The Problem: Configuration Prompts During Upgrades

Debian packages declare critical configuration files as conffiles. When a package is upgraded, dpkg compares the checksum of the currently installed configuration file with both the original version installed by the older package and the new version provided by the incoming package.

If dpkg detects that you have modified the configuration file locally and the package maintainer has also updated the default file, a conflict arises. By default, dpkg pauses the installation process and displays an interactive prompt asking whether you want to:

  • Install the package maintainer's version.
  • Keep the currently installed local version.
  • Examine the differences via a diff.
  • Spawn a subshell to resolve the conflict manually.

In automated environments, CI/CD pipelines, or configuration management runs (such as Ansible, Puppet, or Salt), this interactive prompt hangs the upgrade process indefinitely.

How force-confold Works

The --force-confold flag instructs dpkg to automatically choose the "old" configuration. The name stands for confile old.

When this option is active:

  1. Suppression of the Prompt: Instead of pausing to ask the user how to handle a modified file, dpkg bypasses the user query entirely.
  2. Preservation of Local Changes: The currently installed file—including all historical modifications, comments, and custom values—remains untouched in its original location.
  3. Backup of the New Configuration: To ensure that new features, upstream parameters, or syntax changes are not permanently lost, dpkg writes the package maintainer's new version to the same directory with the extension .dpkg-dist.

Achieving True Silent Upgrades

While --force-confold instructs dpkg to keep the old configuration when a conflict exists, it is rarely used in isolation for complete automation.

If a configuration file has not been modified locally, you generally want the new maintainer version to be installed automatically. To handle both scenarios without prompts, Debian administrators combine --force-confold with --force-confdef:

  • --force-confdef (Conffile Default): Tells dpkg to automatically choose the default action when possible (e.g., install the new file if the local one was never edited).
  • --force-confold (Conffile Old): Serves as the fallback when --force-confdef cannot decide (i.e., when a real conflict exists because the local file was modified).

Combined with setting the non-interactive frontend, this ensures zero terminal interruptions:

DEBIAN_FRONTEND=noninteractive apt-get upgrade -y \
  -o Dpkg::Options::="--force-confdef" \
  -o Dpkg::Options::="--force-confold"

Direct dpkg Usage

If you are installing Debian packages directly via dpkg instead of apt, pass the option directly as a flag:

dpkg -i --force-confdef --force-confold package-name.deb

You can also make this behavior persistent system-wide by adding the directive to /etc/dpkg/dpkg.cfg or a dedicated file under /etc/dpkg/dpkg.cfg.d/:

force-confdef
force-confold

Post-Upgrade Considerations

Because force-confold silently skips the installation of updated configurations, the system might miss newly introduced security settings, deprecated directives, or syntax changes required by newer software versions. Administrators should routinely audit the filesystem for .dpkg-dist files to inspect upstream changes and manually merge them into the active configuration files when appropriate.