apt Commands: Installing, Updating and Removing Packages in Ubuntu and Debian

apt is the standard package manager in Ubuntu, Debian and their derivatives (Linux Mint, Pop!_OS). It downloads programs from repositories, pulls in dependencies automatically and updates the system with a single command. Below are all the apt commands you need in everyday work, grouped by task, plus common errors and how to fix them.

How apt works

A package is a .deb archive with a program, its metadata and a list of dependencies. Repositories are servers that host the packages; their addresses are listed in /etc/apt/sources.list and in the /etc/apt/sources.list.d/ directory. apt keeps a local copy of the list of available packages and checks against it during installation, which is why it must be refreshed regularly.

Under the hood apt calls the low-level dpkg, which unpacks and registers packages but cannot resolve dependencies. The apt-get and apt-cache commands are the older interface with the same functionality: stable output, convenient in scripts. apt is a newer wrapper meant for people: a progress bar, colours and shorter commands.

Almost all commands that change the system require administrator rights, so they are run with sudo. Searching and viewing information works without it.

Cheat sheet: the main apt commands

apt update and apt upgrade: how to update the system

These are two different operations, and they are often confused. apt update installs nothing: it only downloads fresh package lists. apt upgrade installs new versions of the programs you have, based on those lists.

$ sudo apt update
Hit:1 http://archive.ubuntu.com/ubuntu noble InRelease
Get:2 http://security.ubuntu.com/ubuntu noble-security InRelease [126 kB]
...
12 packages can be upgraded. Run 'apt list --upgradable' to see them.

$ apt list --upgradable
$ sudo apt upgrade

The usual combination for a server, in one line, with automatic confirmation:

sudo apt update && sudo apt upgrade -y

How upgrade differs from full-upgrade

apt upgrade may install new dependencies, but it never removes packages that are already installed. If an update requires removing something (for example, when the kernel or a library changes version), such packages are "held back" — the output shows the line The following packages have been kept back. apt full-upgrade (the equivalent of apt-get dist-upgrade) allows removals and completes the update. Before running it, read carefully what apt is going to remove.

Upgrade a single package

sudo apt install --only-upgrade nginx

If the package is not installed, the command with --only-upgrade will not install it — this protects against accidental installation.

apt install: installing packages

sudo apt install nginx                 # one package
sudo apt install git curl htop         # several at once
sudo apt install -y docker.io          # without the Y/n question
sudo apt install nginx=1.24.0-2ubuntu7 # a specific version
sudo apt install --no-install-recommends ffmpeg  # without recommended packages
sudo apt install ./google-chrome-stable_current_amd64.deb  # a local .deb

During installation apt shows which packages will be added and how much space they take, and asks for confirmation. The -y flag answers "yes" automatically — convenient in scripts and Dockerfiles, but in interactive work it is better to read the list.

By default apt installs not only the mandatory dependencies (Depends) but also the recommended ones (Recommends). On servers and in containers, --no-install-recommends noticeably reduces the size.

Installing a .deb file: apt or dpkg -i

A downloaded .deb is better installed with apt install ./file.deb — the path must start with ./ or be a full path, otherwise apt will look for a package with that name in the repositories. Unlike dpkg -i, apt downloads any missing dependencies by itself. If you have already installed a package with dpkg and got a dependency error, sudo apt --fix-broken install will fix it.

sudo dpkg -i package.deb
sudo apt --fix-broken install

apt remove, purge and autoremove: removing packages

sudo apt remove nginx
sudo apt purge nginx            # the same + configs
sudo apt autoremove             # leftover dependencies
sudo apt autoremove --purge     # leftover dependencies together with their configs

remove is suitable if you plan to bring the program back and want to keep its settings. purge is for a full reinstall from a clean slate. Note that files in the user's home directory (for example ~/.config) are not deleted by any of these commands.

To find packages that were removed but left their configuration files, look for the status rc:

dpkg -l | grep '^rc'

Searching for packages and information about them

apt search postgresql          # search by name and description
apt search --names-only '^php8' # by name only, with a regular expression
apt show htop                  # version, size, dependencies, description
apt policy docker.io           # which versions are available and from where
apt list --installed | grep python3
apt-cache depends curl         # what the package depends on
apt-cache rdepends libssl3     # which packages depend on it

Which package owns a file

$ dpkg -S /usr/bin/curl
curl: /usr/bin/curl

$ dpkg -L curl        # which files the package installed

If a command is not yet on the system, Ubuntu will suggest the right package when you try to run it (the message Command 'tree' not found, but can be installed with: sudo apt install tree). To search the files of packages that are not installed, there is the apt-file tool: apt-file search bin/dig after sudo apt-file update.

Pinning a version: apt-mark hold

Sometimes a package must not be updated — for example, the version of a DBMS or the kernel on production is changed only by hand. For this the package is "frozen":

sudo apt-mark hold postgresql-16
apt-mark showhold
sudo apt-mark unhold postgresql-16

Another useful pair is apt-mark manual and apt-mark auto. Packages installed as a dependency are marked automatic and will be caught by autoremove once they are no longer needed. The manual mark protects a package from this.

Repositories: how to add them and where they are stored

The list of sources is in /etc/apt/sources.list and in the files /etc/apt/sources.list.d/*.list. In Ubuntu 24.04 and Debian 12+ the deb822 format with the .sources extension is increasingly used (for example /etc/apt/sources.list.d/ubuntu.sources).

A third-party repository with a key

The modern way is to store the repository key separately and bind it with signed-by. The apt-key command is outdated and has been removed in newer versions.

sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo $VERSION_CODENAME) stable" | sudo tee /etc/apt/sources.list.d/docker.list
sudo apt update
sudo apt install docker-ce

PPA in Ubuntu

sudo add-apt-repository ppa:deadsnakes/ppa
sudo apt update
sudo add-apt-repository --remove ppa:deadsnakes/ppa

PPAs are personal repositories on Launchpad. Add only those you trust: packages from them are installed with root rights.

Cache and disk space

Downloaded packages stay in /var/cache/apt/archives/. On small disks and in Docker images the cache should be cleared.

du -sh /var/cache/apt/archives
sudo apt clean          # delete the whole .deb cache
sudo apt autoclean      # delete only outdated versions

In a Dockerfile, installation is usually written in one layer and the package lists are removed right away:

RUN apt-get update \
 && apt-get install -y --no-install-recommends curl ca-certificates \
 && rm -rf /var/lib/apt/lists/*

Scripts use apt-get rather than apt: the apt interface is not stable, and it warns about this directly (WARNING: apt does not have a stable CLI interface). To stop the installer from asking questions, add DEBIAN_FRONTEND=noninteractive.

Common apt errors and how to fix them

Could not get lock /var/lib/dpkg/lock-frontend

Another process is already working with packages: a second terminal with apt is open, the "Software Center" is running, or the background automatic updates unattended-upgrades are active. Wait a few minutes and check who holds the lock:

ps aux | grep -E 'apt|dpkg'

Do not delete the lock files by hand while the process is alive: an interrupted installation can leave the system in an inconsistent state. If the process has really hung or was killed, run sudo dpkg --configure -a after it ends.

Unable to locate package

apt could not find the package. Most often you did not run sudo apt update on a fresh system, made a typo in the name, or the package is in a disabled component (universe in Ubuntu). Enable the component with sudo add-apt-repository universe.

Unmet dependencies / held broken packages

Dependencies do not match — usually after a manual installation of a .deb or after mixing repositories of different distribution versions.

sudo apt --fix-broken install
sudo dpkg --configure -a
apt policy problem-package

dpkg was interrupted

The installation was interrupted (the terminal was closed, power was lost). The message itself suggests the fix: sudo dpkg --configure -a.

NO_PUBKEY during apt update

A third-party repository has no signing key or an outdated one. Download the current key from the project's website into /etc/apt/keyrings/ and reference it in signed-by, as in the Docker example above.

Automatic security updates

Ubuntu Server ships with the unattended-upgrades package by default, which installs security updates by itself. To check and enable it:

sudo apt install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades
cat /var/log/unattended-upgrades/unattended-upgrades.log

Whether a reboot is needed after an update is shown by the file /var/run/reboot-required: if it exists, the kernel or key libraries were updated.

Summary

The basic apt commands fit into a short cycle: update before any action, install to install, upgrade to update, remove or purge to delete, and autoremove for cleanup. For versions there are apt policy and apt-mark hold; for breakage, --fix-broken install and dpkg --configure -a; and in scripts use apt-get. Package management is covered in practice in our Linux course.