Linux Package Management: apt, dnf, yum, rpm, dpkg and snap Commands Explained

By Ravindra Bagale, trainer · LinkedIn · Last updated: 25 October 2026

1. An everyday example: ordering from a trusted wholesaler

Why do we need this?

A Pune shopkeeper does not make biscuits. He orders from a trusted wholesaler's catalogue. The catalogue is updated every week. When he orders tea, the wholesaler also sends the sugar it needs. Every box has a seal, so he knows it is genuine.

What is it?

Wholesaler = repository. Catalogue = package index (apt update / dnf makecache). Tea plus sugar = dependencies. Seal = GPG signature. The shopkeeper's order book = apt/dnf history.

How to do it (step by step)

2. apt update: refresh the catalogue

Why do we need this?

Without a fresh index, apt does not know about new versions and may try to download files that no longer exist (404).

What is it?

sudo apt update downloads the package lists from every repo. It does not install or upgrade anything. Run it before install or upgrade.

How to do it (step by step)

1. Refresh.

sudo apt update

Output:

Hit:1 http://archive.ubuntu.com/ubuntu noble InRelease
Get:2 http://security.ubuntu.com/ubuntu noble-security InRelease [126 kB]
Reading package lists... Done
12 packages can be upgraded. Run 'apt list --upgradable' to see them.

What it means: Only the lists changed.

2. What can be upgraded?

apt list --upgradable

Output:

openssl/noble-updates 3.0.13-0ubuntu3.4 amd64 [upgradable from: 3.0.13-0ubuntu3.1]

What it means: Name, new version, old version.

3. apt install: install packages

Why do we need this?

This is how you get nginx, git, python and almost everything else.

What is it?

sudo apt install NAME [NAME...] installs with dependencies. -y says yes automatically (use in scripts). NAME=VERSION installs a specific version. --no-install-recommends skips optional extras. apt install ./file.deb installs a local file and its deps.

How to do it (step by step)

1. Install nginx.

sudo apt install -y nginx

Output:

The following NEW packages will be installed:
  libnginx-mod-http-geoip2 nginx nginx-common
Setting up nginx (1.24.0-2ubuntu7) ...

What it means: Dependencies came along.

2. A slim install.

sudo apt install -y --no-install-recommends python3-pip

Output:

(fewer packages listed)

What it means: Good for small images.

3. Exact version.

sudo apt install -y nginx=1.24.0-2ubuntu7

Output:

nginx is already the newest version (1.24.0-2ubuntu7).

What it means: Pin a version you tested.

4. apt remove, purge and autoremove

Why do we need this?

Removing software you do not need saves disk and reduces security risk. Sometimes you also want its config gone for a clean reinstall.

What is it?

apt remove NAME removes the program but keeps config files in /etc. apt purge NAME removes config too. apt autoremove removes dependencies nobody needs any more.

How to do it (step by step)

1. Remove but keep config.

sudo apt remove -y nginx && ls /etc/nginx | head -2

Output:

conf.d
nginx.conf

What it means: Config is still there.

2. Remove everything.

sudo apt purge -y nginx nginx-common

Output:

Removing nginx-common ...
Purging configuration files for nginx-common ...

What it means: /etc/nginx is gone.

3. Clean leftovers.

sudo apt autoremove -y

Output:

Removing libnginx-mod-http-geoip2 ...

What it means: Orphans removed.

5. apt upgrade and full-upgrade

Why do we need this?

Security fixes arrive as updates. Patching is a normal weekly job.

What is it?

apt upgrade installs newer versions but never removes packages. apt full-upgrade may remove or add packages to finish the upgrade (for example new kernels). apt install --only-upgrade NAME upgrades one package. Check /var/run/reboot-required after kernel updates.

How to do it (step by step)

1. Patch the server.

sudo apt update && sudo apt upgrade -y

Output:

12 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.

What it means: Nothing was removed.

2. Only openssl.

sudo apt install --only-upgrade -y openssl

Output:

openssl is already the newest version

What it means: Targeted patch.

3. Reboot needed?

cat /var/run/reboot-required 2>/dev/null || echo no reboot

Output:

*** System restart required ***

What it means: A kernel was updated.

6. apt search, show and list

Why do we need this?

Before you install, you want to know the exact name, version, size and what it depends on.

What is it?

apt search WORD searches names and descriptions. apt show NAME shows version, size, depends, description. apt list --installed lists installed packages. apt-cache policy NAME shows candidate versions and which repo they come from.

How to do it (step by step)

1. Find a JSON tool.

apt search --names-only '^jq$'

Output:

jq/noble 1.7.1-3build1 amd64
  lightweight and flexible command-line JSON processor

What it means: Exact name match.

2. Details.

apt show jq 2>/dev/null | grep -E 'Version|Depends|Installed-Size'

Output:

Version: 1.7.1-3build1
Installed-Size: 102 kB
Depends: libjq1 (= 1.7.1-3build1), libc6 (>= 2.34)

What it means: Small and simple.

3. Which repo and version?

apt-cache policy nginx

Output:

nginx:
  Installed: (none)
  Candidate: 1.24.0-2ubuntu7
  Version table:
     1.24.0-2ubuntu7 500
        500 http://archive.ubuntu.com/ubuntu noble/main amd64 Packages

What it means: Candidate is what install would pick.

7. dpkg: the low-level Debian tool

Why do we need this?

You need to ask: which package owns this file? What files did this package install? Is it really installed?

What is it?

dpkg -l lists packages (ii = installed). dpkg -L NAME lists its files. dpkg -S /path finds the owner. dpkg -s NAME shows status. dpkg -i file.deb installs a local file but does not fetch deps (fix with apt -f install).

How to do it (step by step)

1. Is curl installed?

dpkg -l curl | tail -n1

Output:

ii  curl  8.5.0-2ubuntu10.4 amd64  command line tool for transferring data with URL syntax

What it means: ii = installed OK.

2. Who owns this file?

dpkg -S /usr/bin/curl

Output:

curl: /usr/bin/curl

What it means: Package name first.

3. Files of a package.

dpkg -L jq | grep bin

Output:

/usr/bin/jq

What it means: Where it put the binary.

4. Local .deb with missing deps.

sudo dpkg -i tool_1.0_amd64.deb; sudo apt -f install -y

Output:

dpkg: dependency problems prevent configuration of tool ...
Setting up tool (1.0) ...

What it means: apt fixes the deps.

8. dnf and yum install, remove and reinstall

Why do we need this?

Amazon Linux, RHEL, Rocky, Alma and Fedora servers are very common in companies.

What is it?

sudo dnf install NAME (yum works the same on older systems; on new ones yum is a link to dnf). -y for yes. dnf remove NAME removes it and unused deps. dnf reinstall NAME restores broken files. dnf install ./file.rpm installs a local file with deps. There is no separate update-the-list step: dnf refreshes metadata when it is old (dnf makecache forces it).

How to do it (step by step)

1. Install nginx.

sudo dnf install -y nginx

Output:

Installed:
  nginx-1:1.24.0-1.amzn2023.0.4.x86_64  nginx-core-1:1.24.0-1.amzn2023.0.4.x86_64
Complete!

What it means: Complete! means success.

2. Remove.

sudo dnf remove -y nginx

Output:

Removed:
  nginx-1:1.24.0-1.amzn2023.0.4.x86_64
Complete!

What it means: Also removes unused deps.

3. Fix a deleted binary.

sudo dnf reinstall -y curl

Output:

Reinstalled:
  curl-minimal-8.5.0-1.amzn2023.0.4.x86_64

What it means: Files restored.

9. dnf check-update, update and upgrade --security

Why do we need this?

Patching RHEL-family servers safely, sometimes only security fixes.

What is it?

dnf check-update lists available updates (exit 100 if there are some). dnf update or dnf upgrade upgrades all (same thing). dnf upgrade NAME for one. dnf upgrade --security only security errata. needs-restarting -r tells if a reboot is needed.

How to do it (step by step)

1. What would change?

dnf check-update

Output:

openssl-libs.x86_64   1:3.0.8-1.amzn2023.0.14   amazonlinux

What it means: One update waiting.

2. Security only.

sudo dnf upgrade --security -y

Output:

Upgraded:
  openssl-libs-1:3.0.8-1.amzn2023.0.14.x86_64
Complete!

What it means: Minimal change.

3. Reboot needed?

sudo dnf needs-restarting -r

Output:

Core libraries or services have been updated since boot-up:
  * kernel
Reboot is required to fully utilize these updates.

What it means: Plan a reboot.

10. dnf search, info, provides and list

Why do we need this?

'command not found': which package gives me this command? dnf provides answers that.

What is it?

dnf search WORD. dnf info NAME shows version, repo, size. dnf provides '*/bin/NAME' or a file path finds the package. dnf list installed. dnf repoquery -l NAME lists files before install.

How to do it (step by step)

1. Who gives the dig command?

dnf provides '*/bin/dig'

Output:

bind-utils-32:9.18.28-1.amzn2023.0.1.x86_64 : Utilities for querying DNS name servers
Repo        : amazonlinux
Matched from:
Filename    : /usr/bin/dig

What it means: Install bind-utils.

2. Info.

dnf info jq | grep -E 'Version|Repository'

Output:

Version      : 1.7.1
Repository   : amazonlinux

What it means: From the official repo.

3. Is it installed?

dnf list installed | grep -i nginx

Output:

nginx.x86_64   1:1.24.0-1.amzn2023.0.4   @amazonlinux

What it means: @ = installed from that repo.

11. dnf history and undo

Why do we need this?

A patch broke the app. You want to see exactly what changed and roll it back.

What is it?

dnf history lists transactions with IDs. dnf history info ID shows packages. sudo dnf history undo ID reverses it (needs old versions in the repo). dnf downgrade NAME goes to an older version. On apt, see /var/log/apt/history.log.

How to do it (step by step)

1. Recent changes.

sudo dnf history | head -4

Output:

ID | Command line              | Date and time    | Action(s) | Altered
14 | upgrade --security -y     | 2026-10-25 13:10 | Upgrade   |    1
13 | install -y nginx          | 2026-10-25 12:55 | Install   |    2

What it means: Who did what, when.

2. Undo the patch.

sudo dnf history undo 14 -y

Output:

Downgraded:
  openssl-libs-1:3.0.8-1.amzn2023.0.12.x86_64
Complete!

What it means: Rolled back.

3. apt's record.

grep -A2 'Start-Date' /var/log/apt/history.log | tail -n3

Output:

Start-Date: 2026-10-25  13:12:01
Commandline: apt upgrade -y
Upgrade: openssl:amd64 (3.0.13-0ubuntu3.1, 3.0.13-0ubuntu3.4)

What it means: Old and new versions.

12. rpm queries: -qa, -qi, -ql, -qf

Why do we need this?

rpm reads the package database directly and fast. Great for audits and scripts.

What is it?

rpm -qa lists all installed (pipe to grep). rpm -qi NAME info. rpm -ql NAME files. rpm -qf /path owner. rpm -V NAME verifies files against the database. rpm -qp --requires file.rpm reads a file not yet installed. Avoid rpm -i for installing; it does not resolve deps.

How to do it (step by step)

1. Find kernel packages.

rpm -qa | grep '^kernel-6'

Output:

kernel-6.1.112-122.189.amzn2023.x86_64
kernel-6.1.115-126.197.amzn2023.x86_64

What it means: Two kernels installed.

2. Owner of a file.

rpm -qf /etc/ssh/sshd_config

Output:

openssh-server-8.7p1-8.amzn2023.0.11.x86_64

What it means: The package that owns it.

3. Config files of a package.

rpm -qc nginx-core | head -2

Output:

/etc/nginx/fastcgi.conf
/etc/nginx/mime.types

What it means: -qc = config only.

4. Was anything changed?

rpm -V openssh-server

Output:

S.5....T.  c /etc/ssh/sshd_config

What it means: Size, checksum and time changed: someone edited it.

13. Repositories: add, list and enable

Why do we need this?

Many tools (Docker, Node.js, PostgreSQL) give newer versions from their own repo.

What is it?

apt: a .list or .sources file in /etc/apt/sources.list.d with signed-by= pointing to a key in /etc/apt/keyrings; then apt update. dnf: a .repo file in /etc/yum.repos.d (dnf config-manager --add-repo URL); dnf repolist shows enabled repos; --enablerepo/--disablerepo for one command. Only add repos you trust.

How to do it (step by step)

1. Enabled dnf repos.

dnf repolist

Output:

repo id              repo name
amazonlinux          Amazon Linux 2023 repository
kernel-livepatch     Amazon Linux 2023 Kernel Livepatch repository

What it means: Where packages come from.

2. Add Docker's repo (Fedora/RHEL).

sudo dnf config-manager --add-repo https://download.docker.com/linux/fedora/docker-ce.repo

Output:

Adding repo from: https://download.docker.com/linux/fedora/docker-ce.repo

What it means: A .repo file now exists.

3. apt repo with a key.

curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
echo 'deb [signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu noble stable' | sudo tee /etc/apt/sources.list.d/docker.list
sudo apt update

Output:

Get:5 https://download.docker.com/linux/ubuntu noble InRelease [48.8 kB]

What it means: The key is scoped to this repo only.

14. Holding versions: apt-mark hold and dnf versionlock

Why do we need this?

A database or Kubernetes package must not jump versions during a routine patch.

What is it?

apt-mark hold NAME stops upgrades; apt-mark showhold lists; unhold releases. dnf: install python3-dnf-plugin-versionlock, then dnf versionlock add NAME, list, delete. Or exclude=NAME in /etc/dnf/dnf.conf.

How to do it (step by step)

1. Hold kubelet.

sudo apt-mark hold kubelet kubeadm && apt-mark showhold

Output:

kubelet set on hold.
kubeadm set on hold.
kubeadm
kubelet

What it means: Upgrades skip them.

2. Lock on dnf.

sudo dnf versionlock add postgresql16-server

Output:

Adding versionlock on: postgresql16-server-0:16.4-1.amzn2023.0.1.*

What it means: Locked to this version.

3. Release.

sudo apt-mark unhold kubelet

Output:

Canceled hold on kubelet.

What it means: Upgrade when you are ready.

15. Cleaning caches

Why do we need this?

Downloaded package files pile up and fill small disks and container images.

What is it?

apt clean deletes /var/cache/apt/archives. apt autoclean deletes only old versions. dnf clean all deletes dnf caches. In Dockerfiles, clean in the same RUN line.

How to do it (step by step)

1. Cache size.

sudo du -sh /var/cache/apt /var/cache/dnf 2>/dev/null

Output:

412M	/var/cache/apt

What it means: Space you can get back.

2. Clean.

sudo apt clean && sudo du -sh /var/cache/apt

Output:

36K	/var/cache/apt

What it means: Freed.

3. Dockerfile pattern.

RUN apt-get update && apt-get install -y --no-install-recommends curl && rm -rf /var/lib/apt/lists/*

Output:

(image layer)

What it means: Smaller image.

16. snap: install, list, refresh, remove

Why do we need this?

Some tools ship as snaps with all their libraries inside and auto updates, the same on every distro.

What is it?

sudo snap install NAME. --classic for tools that need full system access (like code editors). snap list shows installed. snap refresh updates now; snap refresh --hold pauses updates. snap remove NAME. snap info NAME shows channels (stable, edge).

How to do it (step by step)

1. Install a snap.

sudo snap install aws-cli --classic

Output:

aws-cli (v2/stable) 2.18.10 from Amazon Web Services (aws✓) installed

What it means: ✓ = verified publisher.

2. List.

snap list

Output:

Name     Version   Rev   Tracking   Publisher   Notes
aws-cli  2.18.10   1211  v2/stable  aws✓        classic
core22   20241001  1663  latest/stable canonical✓ base

What it means: Tracking = channel.

3. Pause updates during an event.

sudo snap refresh --hold=72h aws-cli

Output:

General refreshes of "aws-cli" held until 2026-10-28T13:20:00+05:30

What it means: No surprises for 3 days.

17. Real examples from many industries

Why do we need this?

The same Linux skill shows up in every kind of company. Seeing it in many places helps you remember it.

What is it?

Each row is a made-up team. It shows who uses this and how.

How to do it (step by step)

18. Common errors and how to fix them

Why do we need this?

Everyone hits these errors. Knowing the cause saves hours.

What is it?

Read the exact message first. Then match it to a row below.

How to do it (step by step)

19. Troubleshooting step by step

Why do we need this?

When an install fails, check name, repos, locks and keys in that order.

What is it?

Go top to bottom. Stop at the first step that shows the problem.

How to do it (step by step)

1. Refresh and search the name.

sudo apt update && apt search --names-only NAME

2. Check which repos are on.

dnf repolist; ls /etc/apt/sources.list.d

3. See who holds the lock.

sudo lsof /var/lib/dpkg/lock-frontend

4. Finish half-done installs.

sudo dpkg --configure -a && sudo apt -f install

5. Look at history.

sudo dnf history | head; tail /var/log/apt/history.log

6. Clean caches and retry.

sudo dnf clean all && sudo dnf makecache

20. Lab 1: Full package life cycle on Ubuntu

Why do we need this?

Search, inspect, install, query files, hold, remove and purge a package.

What is it?

A full hands-on lab. Run every step on a test Linux machine (an EC2 instance, a VM, or WSL).

How to do it (step by step)

1. Refresh and search.

sudo apt update -qq && apt search --names-only '^tree$'

Output:

tree/noble 2.1.1-2 amd64

2. Install.

sudo apt install -y tree

Output:

Setting up tree (2.1.1-2) ...

3. Query files and owner.

dpkg -L tree | grep bin; dpkg -S $(which tree)

Output:

/usr/bin/tree
tree: /usr/bin/tree

4. Hold and check.

sudo apt-mark hold tree && apt-mark showhold

Output:

tree set on hold.
tree

5. Unhold and purge.

sudo apt-mark unhold tree && sudo apt purge -y tree && dpkg -l tree | tail -n1

Output:

dpkg-query: no packages found matching tree

21. Lab 2: dnf with history undo and rpm audit

Why do we need this?

Install with dnf, find what you got with rpm, verify files, then undo the install.

What is it?

A full hands-on lab. Run every step on a test Linux machine (an EC2 instance, a VM, or WSL).

How to do it (step by step)

1. Find who gives a command.

dnf provides '*/bin/tree'

Output:

tree-2.1.0-1.amzn2023.0.2.x86_64 : File system tree viewer

2. Install.

sudo dnf install -y tree

Output:

Complete!

3. rpm info and files.

rpm -qi tree | head -3; rpm -ql tree | grep bin

Output:

Name        : tree
Version     : 2.1.0
/usr/bin/tree

4. Verify.

rpm -V tree && echo clean

Output:

clean

5. Undo the last transaction.

sudo dnf history undo last -y

Output:

Removed:
  tree-2.1.0-1.amzn2023.0.2.x86_64
Complete!

22. Frequently asked questions

23. Interview questions and answers

Beginner level

Mid level level

Senior level

24. Related chapters

• Linux Ops Refresh for DevOps
• Bash Scripting for Automation
• Linux grep and find Commands with Examples
• How to Set Up Passwordless SSH Between Linux Servers

Revision, comparison and interview cards

Revise this lesson in a few minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens this lesson.

More cards: Ravi Sir's Cards.