- Debian and Ubuntu use apt. AlmaLinux, Rocky, RHEL and Fedora use dnf, which replaced yum but still answers to that name.
apt updaterefreshes the package lists and installs nothing.apt upgradeis the one that changes your system.- dnf has no separate update step: it refreshes metadata automatically before each command.
- Never install software by piping a script from the internet into a shell when a package exists. The package manager can update and remove it; a script cannot.
- Adding a third-party repository means trusting whoever runs it with root on your server. Add few, and know why each one is there.
What is a package manager and why does it matter?
A package manager installs software along with everything it depends on, keeps a record of what it put where, and can update or remove it cleanly later. That record is the point. Software installed by hand, or by a script from a website, is invisible to it: nothing will patch it and nothing knows how to take it away.
| Distribution | Package manager | Package format |
|---|---|---|
| Ubuntu, Debian | apt | .deb |
| AlmaLinux, Rocky, RHEL | dnf (formerly yum) | .rpm |
| Fedora | dnf | .rpm |
| Alpine | apk | .apk |
| openSUSE | zypper | .rpm |
The two you will meet on a web server are apt and dnf. yum still works on RHEL-family systems as an alias for dnf.
curl | bash is not an install method
Piping a script straight into a shell runs code you have not read, as root, with no record kept. It cannot be updated by your patching routine and cannot be cleanly removed. If a package exists, use it. If only a script exists, download it, read it, then run it.
How do I use apt on Debian and Ubuntu?
apt separates refreshing the catalogue from changing the system. apt update downloads the current package lists and installs nothing at all. apt upgrade acts on what it found. Almost every apt problem a beginner hits is a stale catalogue, which is why the two are so often typed together.
# Refresh the catalogue. Installs nothing.
sudo apt update
# Install
sudo apt install nginx
sudo apt install -y nginx php8.3-fpm mariadb-server # -y skips the prompt
# Search and inspect
apt search redis
apt show nginx
apt list --installed | grep php
# Remove
sudo apt remove nginx # binaries go, config stays
sudo apt purge nginx # config goes too
sudo apt autoremove # tidy up orphaned dependencies
# What is upgradable?
apt list --upgradable
# Which package provides a file I have?
dpkg -S /usr/sbin/nginx
# Which package would provide a command I do not have?
sudo apt install -y apt-file && sudo apt-file update
apt-file search bin/htopapt is for interactive use. Scripts should use apt-get, whose output format is stable across releases.remove keeps your configuration, purge does not
apt remove nginx leaves /etc/nginx in place, so reinstalling later restores your setup. apt purge deletes it. Use remove unless you specifically want a clean slate, and take a copy of the config directory first either way.
How do I use dnf on AlmaLinux and Rocky?
dnf refreshes its metadata automatically, so there is no separate update step. It also keeps a transaction history you can inspect and reverse, which is the single biggest practical advantage it has over apt.
# Install
sudo dnf install nginx
sudo dnf install -y nginx php-fpm mariadb-server
# Search and inspect
dnf search redis
dnf info nginx
dnf list installed | grep php
# Remove
sudo dnf remove nginx
sudo dnf autoremove
# Updates
sudo dnf check-update
sudo dnf update
sudo dnf update --security # security patches only
# Which package owns a file?
dnf provides /usr/sbin/nginx
dnf provides '*/bin/htop' # works for files you do not have yet
# Transaction history, and undo
sudo dnf history
sudo dnf history info 42
sudo dnf history undo 42dnf provides searching for files you do not yet have is genuinely useful and has no simple apt equivalent.| Task | apt | dnf |
|---|---|---|
| Refresh catalogue | apt update | automatic |
| Install | apt install pkg | dnf install pkg |
| Remove, keep config | apt remove pkg | dnf remove pkg |
| Remove config too | apt purge pkg | no direct equivalent |
| Upgrade everything | apt upgrade | dnf update |
| Security only | unattended-upgrade | dnf update --security |
| Which package owns a file | dpkg -S /path | dnf provides /path |
| List installed | apt list --installed | dnf list installed |
| Undo a transaction | no equivalent | dnf history undo <id> |
| Prevent upgrades | apt-mark hold pkg | dnf versionlock add pkg |
Keep this table to hand if you work across both. The last two rows are the ones people look up most often.
What is a repository and when should I add one?
A repository is a server holding packages and their signatures, which your package manager trusts. Adding one is how you get software your distribution does not ship, such as a newer PHP for a WordPress version upgrade. Adding a third-party repository means giving whoever runs it the ability to install software as root on your machine, on every future update. That is a genuine trust decision, not a configuration step.
# Debian / Ubuntu: modern, key stored separately from the system keyring
curl -fsSL https://packages.example.com/gpg \
| sudo gpg --dearmor -o /usr/share/keyrings/example-archive-keyring.gpg
echo 'deb [signed-by=/usr/share/keyrings/example-archive-keyring.gpg] \
https://packages.example.com/apt stable main' \
| sudo tee /etc/apt/sources.list.d/example.list
sudo apt update
# RHEL family
sudo dnf config-manager --add-repo https://packages.example.com/example.repo
dnf repolist
# EPEL, which many common tools live in
sudo dnf install -y epel-releaseapt-key add. It trusts the key for every repository on the system, not just the one you are adding.Two repositories offering the same package is a problem
When a third-party repository ships a newer PHP or MySQL than your distribution, upgrades can flip between the two versions and break things in ways that are hard to trace. Pin the priority explicitly, or accept the distribution's version. This is the usual cause of a mysterious dependency failure.
# Debian / Ubuntu
sudo apt-mark hold nginx
apt-mark showhold
sudo apt-mark unhold nginx
# RHEL family
sudo dnf install -y python3-dnf-plugin-versionlock
sudo dnf versionlock add nginx
sudo dnf versionlock list
sudo dnf versionlock delete nginxHow do I fix common package manager errors?
| Error | Cause | Fix |
|---|---|---|
| Unable to locate package | Stale catalogue, or wrong repository | sudo apt update, then check the name with apt search |
| Could not get lock /var/lib/dpkg/lock | Another apt process is running | Wait for it; check with ps aux | grep -i apt |
| dpkg was interrupted | A previous install did not finish | sudo dpkg --configure -a |
| Held broken packages | Conflicting dependency requirements | sudo apt install -f, then read what it proposes |
| No space left on device | /boot or / is full | Clear old kernels with apt autoremove --purge |
| NO_PUBKEY / signature error | Missing or expired repository key | Re-import the key with the signed-by method above |
Rows two and three cover most of what people actually hit. When the cause is a full disk, checking disk usage finds it in one command.
# Something else holding the lock?
ps aux | grep -iE '[a]pt|[d]pkg|[u]nattended'
# Finish an interrupted installation
sudo dpkg --configure -a
# Repair broken dependencies
sudo apt install -f
# Only if you are certain nothing is running:
sudo rm /var/lib/dpkg/lock-frontend /var/lib/dpkg/lock
sudo dpkg --configure -aunattended-upgrades is usually what holds the lock
On Ubuntu, automatic security updates run shortly after boot and hold the apt lock while they work. Waiting two minutes is almost always the correct response, and far better than forcing the lock open.
Once you are comfortable installing and removing packages, the next step is patching a live server without breaking it, which is a discipline rather than a command. How to safely update and patch a Linux server covers the sequence. If you would rather not own the operating system layer at all, our managed WordPress hosting keeps it patched for you.
Frequently asked questions
What is the difference between apt and apt-get?
apt is the newer interactive front end, with a progress bar and friendlier output. apt-get is the older interface with a stable, guaranteed output format. Use apt when typing commands yourself and apt-get in scripts, where an unexpected format change would break automation.
Is yum the same as dnf?
dnf replaced yum from RHEL 8 onward, with better dependency resolution and a usable transaction history. yum still exists on those systems as an alias for dnf, so old commands and documentation keep working. New work should use dnf.
Do I need to run apt update before every install?
Not before every one, but before the first of a session and after adding a repository. Without it apt works from a stale catalogue and will report "unable to locate package" for software that exists, or try to fetch a version that has already been replaced.
What is the difference between apt remove and apt purge?
remove deletes the program but leaves its configuration files in /etc, so reinstalling restores your setup. purge deletes the configuration too. Use remove unless you specifically want to start clean, and take a copy of the config directory either way.
How do I stop a package being upgraded?
sudo apt-mark hold packagename on Debian and Ubuntu, or sudo dnf versionlock add packagename on the RHEL family. Record why you did it: a forgotten hold silently blocks security patches for that package indefinitely.
Is it safe to add third-party repositories?
It is a trust decision. Whoever runs the repository can install software as root on your server on every future update. Add only ones you would trust with that, prefer official vendor repositories, and never use the deprecated apt-key add, which trusts the key system-wide.
About G7Cloud Engineering
Articles written by the engineers who build and run G7Cloud: UK managed hosting and the AI Website Builder. We write about what we operate every day: containers, backups, databases, and the small-business websites that run on them.
More about G7Cloud →
