Package management with apt, dnf, and yum

Two families, two toolchains

Debian and Ubuntu use .deb packages with apt or apt-get; the Red Hat family uses RPM with dnf and, on older systems or compatibility layers, yum. Use the distribution's manager so it resolves dependencies from configured repositories. Package changes need root, so these commands normally start with sudo.

A repository is a server that publishes packages plus signed metadata. On Ubuntu the list lives in /etc/apt/sources.list and /etc/apt/sources.list.d/; on dnf systems it lives in /etc/yum.repos.d/.

flowchart LR
  R["Repositories<br/>signed mirrors"] -- "apt update" --> I["Local index<br/>metadata only"]
  I -- "apt install nginx" --> P["nginx + deps<br/>.deb packages"]
  P --> DB["dpkg database<br/>what is installed"]
  I -- "apt upgrade" --> UP["Newer versions<br/>of installed pkgs"]
  %% step R: Packages come from signed repositories configured on the system.
  %% step I: apt update (or dnf makecache) only refreshes the list of what is available.
  %% step P: install downloads the package and its dependencies and installs them.
  %% step DB: The low-level database (dpkg or rpm) records every installed file.
  %% step UP: upgrade installs newer versions of what you already have; test it before production.

The package lifecycle

apt update only downloads fresh package metadata. apt upgrade upgrades installed packages, while apt install nginx installs a specific package. Likewise, dnf info, dnf install, and dnf remove address different lifecycle steps.

Task	apt (Debian/Ubuntu)	dnf (Red Hat family)
Refresh metadata	`apt update`	`dnf makecache`
Search	`apt search nginx`	`dnf search nginx`
Install	`apt install nginx`	`dnf install nginx`
Upgrade all	`apt upgrade`	`dnf upgrade`
Remove	`apt remove nginx`	`dnf remove nginx`
Clean unused deps	`apt autoremove`	`dnf autoremove`

apt remove keeps configuration files, while apt purge deletes them as well. dnf checks metadata age itself, so a separate refresh step is optional there.

Low-level tools and checks

apt and dnf sit on top of dpkg and rpm, which install single package files without fetching dependencies.

Check	Example
Installed DEB package	`dpkg -l nginx`
Installed RPM package	`rpm -q nginx`
apt package list	`apt list --installed`
Which package owns a file	`dpkg -S /usr/sbin/nginx` or `rpm -qf /usr/sbin/nginx`

Versions in production

Upgrading everything at once can change a service's behaviour. apt-mark hold nginx stops a package from being upgraded until you release it, and the unattended-upgrades package can apply security fixes automatically on Ubuntu.

wget and curl merely download files; they do not resolve dependencies or register packages in the package database. Evaluate a third-party repository's key, origin, and update policy before using it.