apt is the package manager front-end on Ubuntu and Debian. It installs software from repositories, resolves dependencies and keeps everything updated. These are the commands you’ll use on a server.

Refresh and upgrade

sudo apt update              # refresh package lists from the repositories
sudo apt upgrade             # upgrade installed packages (never removes any)
sudo apt full-upgrade        # upgrade, adding/removing packages if needed (e.g. new kernels)
apt list --upgradable        # what would be upgraded

update doesn’t upgrade anything — it only downloads the latest lists. Always run it before installing or upgrading.

After kernel or core library updates, check whether a reboot is needed:

[ -f /var/run/reboot-required ] && cat /var/run/reboot-required.pkgs

Install

sudo apt install nginx
sudo apt install -y git curl htop          # several, no confirmation
sudo apt install --no-install-recommends php-cli   # skip "recommended" extras
sudo apt install ./package.deb             # a local .deb, with dependencies
sudo apt install nginx=1.24.0-2ubuntu7     # a specific version
sudo apt reinstall nginx                   # reinstall (restores deleted package files)

Remove

sudo apt remove apache2       # remove the package, keep its config files
sudo apt purge apache2        # remove the package and its config files
sudo apt autoremove           # remove dependencies nothing needs anymore
sudo apt autoremove --purge   # same, including their configs

autoremove also cleans out old kernels — a frequent cause of a full /boot partition.

Search and inspect

apt search redis              # search names and descriptions
apt show redis-server         # details: version, size, dependencies
apt list --installed | grep php
apt policy nginx              # installed/candidate versions and which repo they come from
apt-cache depends nginx       # dependencies
apt-cache rdepends libssl3    # what depends on a package
dpkg -L nginx                 # files installed by a package
dpkg -S /usr/sbin/nginx       # which package owns a file

apt policy is the go-to command when you’re unsure whether a package comes from Ubuntu’s archive, a PPA or a third-party repository.

Hold a package at its version

sudo apt-mark hold docker-ce
apt-mark showhold
sudo apt-mark unhold docker-ce

Held packages are skipped by upgrade — useful while you test a new version elsewhere. Don’t forget to unhold later, or you’ll miss security fixes.

Clean up disk space

sudo apt clean         # delete all downloaded .deb files in /var/cache/apt/archives
sudo apt autoclean     # delete only outdated ones

Fix problems

sudo apt --fix-broken install     # resolve broken dependencies
sudo dpkg --configure -a          # finish interrupted installations

Could not get lock /var/lib/dpkg/lock-frontend — another apt process is running, often unattended-upgrades in the background after boot. Wait for it (ps aux | grep -E 'apt|dpkg') rather than deleting lock files.

The following packages have been kept back — they need new dependencies; sudo apt full-upgrade installs them, or this is a phased update Ubuntu is rolling out gradually.

More fixes in apt update errors.

Repositories

Repository definitions live in /etc/apt/sources.list and /etc/apt/sources.list.d/ (newer releases use the .sources deb822 format). Third-party repositories are added with their signing key:

sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://example.com/key.asc | sudo tee /etc/apt/keyrings/example.asc > /dev/null
echo "deb [signed-by=/etc/apt/keyrings/example.asc] https://repo.example.com/apt stable main" | sudo tee /etc/apt/sources.list.d/example.list
sudo apt update

Ubuntu PPAs: sudo add-apt-repository ppa:owner/name. See add-apt-repository and PPAs.

Add only repositories you trust — a repository can replace any package on your system.

Unattended security updates

sudo apt install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

See automatic security updates.

apt vs apt-get

apt is designed for interactive use (progress bars, colour, friendlier output). apt-get and apt-cache have stable output and options for scripts — use them in automation, Dockerfiles and CI:

apt-get update && apt-get install -y --no-install-recommends curl

Quick reference

Task Command
Refresh lists apt update
Upgrade all apt upgrade / apt full-upgrade
Install apt install PKG
Remove / purge apt remove PKG / apt purge PKG
Remove unused deps apt autoremove
Search apt search TERM
Details apt show PKG
Which repo/version apt policy PKG
Hold apt-mark hold PKG
Fix broken apt --fix-broken install
Clear cache apt clean

On RHEL-family systems, see dnf and yum commands.

  • apt
  • Ubuntu
  • Debian