Monitor DPKG lock file to determine which command acquired it and list its parent tree to determine why/how it was executed.

dpkg-lock-monitor.sh

#!/usr/bin/env bash
set -o xtrace
set -o errexit
set -o pipefail

while true; do
	pid=$(set +o pipefail; sudo fuser /var/lib/dpkg/lock-frontend 2>&1 | grep -o "[0-9]*" | head -n 1)
	if [[ ! -z $pid ]]; then
		sudo pstree -sa $pid
	fi
	sleep 1
done

Output looks like this. Showing that it is the daily unattended upgrade cron job that is locking dpkg.

+++ set +o pipefail
+++ sudo fuser /var/lib/dpkg/lock-frontend
+++ grep -o '[0-9]*'
+++ head -1
++ pid=4176
++ [[ ! -z 4176 ]]
++ sudo pstree -sa 4176
systemd
  `-apt.systemd.dai /usr/lib/apt/apt.systemd.daily install
      `-apt.systemd.dai /usr/lib/apt/apt.systemd.daily lock_is_held install
          `-unattended-upgr /usr/bin/unattended-upgrade
              |-unattended-upgr /usr/bin/unattended-upgrade
              |   `-dpkg --status-fd 12 --configure --pending
              |       `-linux-image-5.4 /var/lib/dpkg/info/linux-image-5.4.0-1064-gcp.postinst triggered ...
              |           `-sh /usr/lib/linux/triggers/5.4.0-1064-gcp
              |               `-run-parts --report --exit-on-error --arg=5.4.0-1064-gcp --arg=/boot/vmlinuz-5.4.0-1064-gcp ...
              |                   `-grub-mkconfig /usr/sbin/grub-mkconfig -o /boot/grub/grub.cfg
              `-2*[{unattended-upgr}]
++ sleep 1