# RUNLEVEL=1 apt-get install nginx

Sadly this doesn't work in newer versions of Debian/Ubuntu, the official way is to use the policy helper script /usr/sbin/policy-rc.d and return a 101 exit code. This is a a bit more inconvenient - having to temporarily create this file only to remove it after installing the package.

Fortunately there is an alternative - policyrcd-script-zg2. Install the package:

$ sudo apt-get install policyrcd-script-zg2

Create a new script which returns a 101 exit code, I've created it as /usr/local/sbin/policy-donotstart:

#!/bin/sh
exit 101

Then make it executable:

$ sudo chmod 755 /usr/local/sbin/policy-donotstart

When installing packages where you don't want the service to immediately start, use the POLICYRCD environment variable:

# POLICYRCD=/usr/local/sbin/policy-donotstart apt-get install nginx

The service will install, but you'll a message similar to:

invoke-rc.d: policy-rc.d denied execution of start.

For Ansible, you can add environment variables to any task:

- name: Install nsd
  apt: pkg=nsd install_recommends=no
  environment:
    POLICYRCD: /usr/local/sbin/policy-donotstart

Now you can safely install a package, configure it, and then start it once you've got all the correct files in place - all with a convenient environment variable.

One of the problems which you may face at some point is that you're stuck with whatever kernel they provide, you can't use your own bootloader. They've attempted to solve this by providing kernels from every Linux distribution they support - but sadly this isn't the solution which I'd expect a KVM provider to use.

To work around this, we can use kexec to change the kernel on boot. Install kexec:

$ sudo apt-get install kexec-tools

Move /sbin/init to /sbin/init.distrib:

$ dpkg-divert --add --local --rename /sbin/init creates=/sbin/init.distrib

And create a script to replace /sbin/init

#!/bin/bash

if grep -qv " kexeced$" /proc/cmdline; then
    /sbin/kexec --load /vmlinuz \
        --reuse-cmdline \
        --initrd=/initrd.img \
        --append="init=/sbin/init.distrib kexeced" \
    && /bin/mount -o ro,remount / \
    && /sbin/kexec --exec
fi

exec /sbin/init.distrib "$@"

Make it executable:

$ sudo chmod 755 /sbin/init

And then you can reboot. Next time your server restarts, the script will run before any other init scripts and will change the running kernel with kexec. You can change the kernel parameters in this file if you need custom options, or just leave it as is - and you'll be able to stick with your standard Debian kernel.

Credit to Joe Johnston for the original script.

Update

A couple of years later, DigitalOcean eventually created new images which use the virtual machines bootloader - which means this hack is no longer needed for newer Linux distributions.