Linux
Beginner 13 min read Linux

Package Management

A package manager installs, updates, verifies and removes software from signed repositories while resolving dependencies for you. Learn how apt, dnf, pacman and zypper work under the hood, the difference between update and upgrade, and how to patch production safely.

package manageraptdnfpacmanzypperrepositorydependenciesapt updateapt upgradepatchingrpmdpkg
Prerequisites: Introduction to Linux
Introduction

What is this?

A package manager is a tool that installs, updates, configures and removes software by fetching precompiled packages from repositories and tracking every file it places on the system. It also resolves dependencies — installing the libraries a package needs — so you never manually chase 'libfoo.so.2 not found' errors. apt, dnf, pacman and zypper are the most common managers, and they all share the same core ideas.

Motivation

Why do you need it?

  • Dependency resolution: one command installs a program and every library it needs, at compatible versions.
  • Signed, verified packages: checksums and cryptographic signatures protect against corrupted or tampered downloads.
  • Centralised patching: apt upgrade (or dnf update) brings the whole OS up to date in one operation — critical for security.
  • Clean uninstall: the package database knows every file a package owns, so removal leaves no scattered junk.
  • Reproducible systems: repositories and version pinning make installs repeatable across CI, containers and fleets.
Think about it

Mental model

Imagine

An app store with a dependency concierge

Think of

A package manager

A package manager is like an app store where every app declares what it needs. The store installs the app plus any libraries it depends on, keeps them updated, and knows exactly which files it put where — so removing an app does not leave orphans or break another app that still needs a shared library.

Mechanics

How it works

  • You point the manager at repositories listed in /etc/apt/sources.list, /etc/yum.repos.d or /etc/pacman.conf — signed mirrors of package files.
  • apt update downloads fresh metadata: names, versions, checksums, dependency lists and repository signatures.
  • Installing triggers a dependency solver, which picks compatible versions, then downloads and verifies each file's checksum and signature.
  • Packages are unpacked and configured in dependency order, and every installed file is recorded in a local database (/var/lib/dpkg or the rpm database).
  • Upgrades compare installed versions against repository versions, replacing only what changed and running post-install scripts to reconfigure services.

From repository to installed software.

Package repository
Refresh metadata
Package index
Resolve dependencies
Download and verify
Installed software
Reference

Key commands

sudo apt update

Refresh the package index from the configured repositories.

Hit:1 http://archive.ubuntu.com/ubuntu noble InRelease
Hit:2 http://security.ubuntu.com/ubuntu noble-security InRelease
Reading package lists... Done
sudo apt upgrade -y

Upgrade all installed packages to the repository versions.

Calculating upgrade... Done
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
sudo apt install -y nginx

Install nginx plus any missing dependencies.

The following NEW packages will be installed:
  nginx nginx-common
Setting up nginx (1.24.0-2ubuntu7)...
apt search nginx

Search repository metadata for matching packages.

nginx - small, powerful, scalable web/proxy server
apt show nginx

Show metadata: version, dependencies, size, repository.

Package: nginx
Version: 1.24.0-2ubuntu7
Depends: libc6, libssl3t64, zlib1g
sudo apt remove nginx

Remove the package; purge also deletes configuration files.

The following packages will be REMOVED:
  nginx
sudo apt autoremove

Remove packages that were installed as dependencies and are no longer needed.

The following packages will be REMOVED:
  libnginx-mod-http-perl
Hands-on

Examples

Install nginx the right way with apt

Install nginx the right way with apt
# 1. Refresh the package index (always do this first)
sudo apt update
 
# 2. Install nginx and its dependencies
sudo apt install -y nginx
 
# 3. Verify the install and see which files it owns
dpkg -l | grep nginx
dpkg -L nginx | head

apt update downloads the current package index so the install resolves the right versions. dpkg -l confirms the installed version, and dpkg -L lists every file the package owns — the same bookkeeping that makes clean upgrades and removal possible.

Real world

In production

  • Patching is a package-manager job: unattended-upgrades (Ubuntu) and dnf-automatic (RHEL) apply security updates automatically.
  • Version pinning and package holds keep critical packages at known-good versions during a rollout.
  • Signature verification is a supply-chain control — attacks like typosquatting and repo compromises are mitigated by checking keys and checksums.
  • Ansible, cloud-init and Terraform wrappers call these same managers, so learning them transfers straight into automation.
  • Distro packages beat hand-built source installs: they receive security backports and consistent library versions.
Guidelines

Best practices

  • Always run apt update before install or upgrade so you resolve against fresh metadata.
  • Test updates in staging before production, and run autoremove regularly to clean orphaned dependencies.
  • Enable automatic security updates and subscribe to your distro security advisories.
  • Prefer distro repositories over downloading .deb/.rpm files from websites.
  • On apt, upgrade the full set of packages together instead of doing partial upgrades that can break dependencies.
Watch out

Common mistakes

  • Installing without running apt update first, then hitting 'Unable to locate package'.
  • Downloading random .deb/.rpm files from the internet instead of using signed repositories.
  • Patching production without testing — a package update can restart a critical service mid-day.
  • Using apt remove instead of purge and wondering why configuration lingers.
  • Forcing installs with --force-yes or --force-bad-version, which silently break dependency state.
Root cause analysis

Common issues

Error
E: Unable to locate package nginx
Root cause

Package lists are empty or stale, or the package is not in the configured repositories.

Fix

Run sudo apt update first, then apt-cache search nginx; add the correct repository if it is genuinely missing.

Error
E: Could not get lock /var/lib/dpkg/lock-frontend
Root cause

Another apt or dpkg process is running, often an automatic update.

Fix

Wait for it to finish, or check ps aux | grep apt; kill the process only if it is truly stuck.

Error
The following packages have unmet dependencies
Root cause

A broken dpkg state, usually from a forced or interrupted install.

Fix

Run sudo apt --fix-broken install, then sudo dpkg --configure -a to repair the database.

Error
Signature verification failed: KEYEXPIRED
Root cause

The repository signing key has expired or is missing from the keyring.

Fix

Reinstall or refresh the keyring package (e.g. ubuntu-keyring) and re-import the repository key.

When things break

Debugging tips

  • apt policy <pkg> (or apt-cache policy) shows available versus installed versions.
  • dpkg -l | grep <pkg> lists installed packages and their status; dpkg -L <pkg> lists owned files.
  • If a repository 404s, the mirror list is stale — run apt update and inspect /etc/apt/sources.list.
  • On RHEL-family systems, rpm -q <pkg> confirms presence and rpm -V <pkg> verifies file integrity.
Interviews

Interview checkpoint

Practice

Hands-on lab

Install, inspect, update and clean up software with apt
15 min · beginner
In progress
Objectives
  • Refresh the package index with apt update
  • Search and inspect package metadata before installing
  • Install a package with its dependencies and verify it
  • Remove a package and clean up orphaned dependencies

Install, inspect, update and clean up software with apt

15 min · beginner

0/6 steps
0%
sandbox · Linux sandbox
$
Try these commands
Test yourself

Quick quiz

0/6
1

What does apt update actually do?

2

Which command removes a package AND its configuration files?

3

On the Fedora and RHEL family, which package manager replaced yum?

4

The apt upgrade command removes packages that are no longer supported.

5

Where does apt look up its repositories on Debian and Ubuntu?

6

You run sudo apt install jq and get "E: Unable to locate package jq". What do you do first?

Quick reference

Cheat sheet

APT (Debian, Ubuntu)
sudo apt updateRefresh the package index
sudo apt upgrade -yUpgrade installed packages
sudo apt install <pkg>Install with dependencies
sudo apt remove <pkg>Remove, keep config
sudo apt purge <pkg>Remove package + config
sudo apt autoremoveDrop orphaned dependencies
apt search <pkg>Search the index
apt show <pkg>Version, deps, size
dpkg -l | grep <pkg>Installed status
DNF (Fedora, RHEL, AlmaLinux, Rocky)
sudo dnf check-updateCheck for updates
sudo dnf updateUpdate all packages
sudo dnf install <pkg>Install a package
sudo dnf remove <pkg>Remove a package
rpm -q <pkg>Verify presence and version
Pacman (Arch) & Zypper (openSUSE)
sudo pacman -SyuSync and full upgrade
sudo pacman -S <pkg>Install
sudo pacman -R <pkg>Remove
sudo pacman -Ss <pkg>Search
sudo zypper refreshRefresh package list
sudo zypper updateUpdate all packages
sudo zypper install <pkg>Install
Inspect & repair
dpkg -L <pkg>Files a package owns
apt policy <pkg>Available vs installed versions
sudo apt --fix-broken installRepair dependency state
sudo dpkg --configure -aFinish interrupted configs
rpm -V <pkg>Verify file integrity (RHEL)
Go deeper

Official documentation

Debian — Apt documentation
docs
Ubuntu — AptGet/Howto
docs
DNF documentation
docs
Arch Linux — pacman
docs
openSUSE — zypper reference
docs