Disable apt-daily at the beginning of the build

This should increase reliability of the image build job - we tend to
have non-deterministic failures due to apt not being able to obtain the
lock. By disabling these services that can run apt in the background at
the beginning instead of only in 01-initial-setup, we should run into
issues less often.

marketplace_docs/templates/Fabric/fabfile.py

@@ -125,11 +125,34 @@ def configure_swap():
     run("swapon /swapfile")
     run("echo '/swapfile none swap sw 0 0' >> /etc/fstab")
 
+def disable_conflicting_services():
+    # The default Ubuntu behavior of the apt-daily.timer systemd job
+    # results in `apt update` running immediately on boot if it's been
+    # more than a day since the image was generated.  This can end up
+    # conflicting with the other `apt` invocations run by the Zulip
+    # interactive installer.  So we disabled it here and then re-enable it
+    # once interactive_script.sh completes successfully.
+    #
+    # For more details see https://chat.zulip.org/#narrow/stream/3-backend/topic/apt-daily
+    run("systemctl disable apt-daily.timer apt-daily-upgrade.timer")
+
+    print("Disabled apt-daily timers. Waiting for ongoing tasks to finish...")
+    run("""
+    timeout 300 bash -c '
+    while systemctl is-active --quiet apt-daily.service apt-daily-upgrade.service; do
+        echo "Waiting for apt-daily or apt-daily-upgrade tasks to finish..."
+        sleep 5
+    done
+    '
+    """)
+    print("Finished waiting for apt-related tasks (or timed out).")
+
 @task
 def build_image():
     """
     Configure the build droplet, clean up and shut down for snapshotting
     """
+    disable_conflicting_services()
     install_pkgs()
     install_files()
     run_scripts()

marketplace_docs/templates/Fabric/scripts/01-initial-setup

@@ -34,16 +34,6 @@ rm -f /etc/update-motd.d/00-header
 rm -f /etc/update-motd.d/10-help-text
 rm -f /etc/update-motd.d/51-cloudguest
 
-# The default Ubuntu behavior of the apt-daily.timer systemd job
-# results in `apt update` running immediately on boot if it's been
-# more than a day since the image was generated.  This can end up
-# conflicting with the other `apt` invocations run by the Zulip
-# interactive installer.  So we disabled it here and then re-enable it
-# once interactive_script.sh completes successfully.
-#
-# For more details see https://chat.zulip.org/#narrow/stream/3-backend/topic/apt-daily
-systemctl disable apt-daily.timer apt-daily-upgrade.timer
-
 # Configure firewall. Else, img_check.sh will warn that ufw is not configured.
 ufw allow ssh
 ufw allow http