aptInstall, upgrade and remove packages on Debian and Ubuntu
apt is the package manager you use by hand on Debian and Ubuntu. It refreshes the signed package indexes, resolves dependencies, downloads .deb files and hands them to dpkg to install, upgrade or remove software.
apt [OPTION]... update | upgrade | full-upgrade | install PKG[=VERSION]... | remove | purge | autoremove | search | show | listA fresh Ubuntu 24.04 server needs a web server. Update the package lists first, then install.
sudoInstalling writes to /usr, /etc and the dpkg database, so it needs root. Read-only commands (search, show, list) don't.
apt update reads /etc/apt/sources.list.d/ubuntu.sources (deb822 format on 24.04), downloads each suite's InRelease file over HTTP, checks its OpenPGP signature against the key named in Signed-By, then fetches the Packages indexes whose SHA256 sums InRelease lists. They land in /var/lib/apt/lists. apt install takes the lock /var/lib/dpkg/lock-frontend, loads those indexes plus /var/lib/dpkg/status, picks a candidate version per package by pin priority, and solves dependencies. It downloads the .deb files to /var/cache/apt/archives, verifies each against the hash in the signed index, and runs dpkg to unpack and configure them in dependency order. dpkg runs each package's maintainer scripts; on Ubuntu the postinst enables and starts services through systemd. Packages pulled in only as dependencies are marked automatic in /var/lib/apt/extended_states, which is what autoremove uses. Every run is logged to /var/log/apt/history.log.
apt trusts one signed file per suite; every index and .deb is checked against hashes chained from it, then dpkg installs.
For every suite in ubuntu.sources (noble, noble-updates, noble-security), apt downloads InRelease: a small file listing every index with its SHA256, signed by the archive key.
updateRefresh the package indexes from the repositories. Installs nothingupgradeUpgrade installed packages; never removes packagesfull-upgradeUpgrade and allow removals/new installs to resolve changes (old dist-upgrade)install PKGInstall packages and their dependencies; PKG=VERSION pins a versioninstall --only-upgrade PKGUpgrade PKG if installed, never install it freshremove PKGRemove the package but keep its config files in /etcpurge PKGRemove the package and its config filesautoremoveRemove automatic dependencies nothing needs any moresearch / showSearch names and descriptions / print one package's metadatalist --installed / --upgradableWhat's installed / what has a newer version-yAssume yes at prompts (automation)-s, --simulatePrint what would happen without changing anything--no-install-recommendsInstall hard dependencies only, skip RecommendsRUN apt install -y curl in a Dockerfileapt warns 'does not have a stable CLI interface' and its output can change between releases. In a fresh image the lists are also empty, so the install fails with 'Unable to locate package'.
RUN apt-get update && apt-get install -y --no-install-recommends curl && rm -rf /var/lib/apt/lists/*sudo rm /var/lib/dpkg/lock-frontend when apt says 'Could not get lock'Another apt or dpkg (often unattended-upgrades) is really running. Deleting the lock lets two writers corrupt /var/lib/dpkg/status.
ps -o pid,cmd -p <PID from the message> # wait for it, or apt-get -o DPkg::Lock::Timeout=300 ...sudo apt upgrade -y on a production host in the middle of the dayIt upgrades every package at once, including the database or runtime, and services restart under traffic.
apt list --upgradable; sudo apt-mark hold postgresql-16; sudo apt install --only-upgrade <pkg>apt remove nginx and expecting the old config to be goneremove keeps /etc/nginx (state rc). Reinstalling brings back the same broken config.
sudo apt purge nginx nginx-common && sudo apt autoremoveTry these on a Linux machine of your own. Each task has a hint and a solution.
Count how many packages are installed in the sandbox.
Run an apt update and explain the error. (The sandbox has no network.)
Without changing anything, find out what would be removed if you uninstalled curl.
List the packages that were installed on purpose (not as dependencies).
Find the exact command line that installed the packages in this sandbox image.
aptInstall, upgrade and remove packages on Debian and Ubuntu
apt is the package manager you use by hand on Debian and Ubuntu. It refreshes the signed package indexes, resolves dependencies, downloads .deb files and hands them to dpkg to install, upgrade or remove software.
apt [OPTION]... update | upgrade | full-upgrade | install PKG[=VERSION]... | remove | purge | autoremove | search | show | listA fresh Ubuntu 24.04 server needs a web server. Update the package lists first, then install.
sudoInstalling writes to /usr, /etc and the dpkg database, so it needs root. Read-only commands (search, show, list) don't.
apt update reads /etc/apt/sources.list.d/ubuntu.sources (deb822 format on 24.04), downloads each suite's InRelease file over HTTP, checks its OpenPGP signature against the key named in Signed-By, then fetches the Packages indexes whose SHA256 sums InRelease lists. They land in /var/lib/apt/lists. apt install takes the lock /var/lib/dpkg/lock-frontend, loads those indexes plus /var/lib/dpkg/status, picks a candidate version per package by pin priority, and solves dependencies. It downloads the .deb files to /var/cache/apt/archives, verifies each against the hash in the signed index, and runs dpkg to unpack and configure them in dependency order. dpkg runs each package's maintainer scripts; on Ubuntu the postinst enables and starts services through systemd. Packages pulled in only as dependencies are marked automatic in /var/lib/apt/extended_states, which is what autoremove uses. Every run is logged to /var/log/apt/history.log.
apt trusts one signed file per suite; every index and .deb is checked against hashes chained from it, then dpkg installs.
For every suite in ubuntu.sources (noble, noble-updates, noble-security), apt downloads InRelease: a small file listing every index with its SHA256, signed by the archive key.
updateRefresh the package indexes from the repositories. Installs nothingupgradeUpgrade installed packages; never removes packagesfull-upgradeUpgrade and allow removals/new installs to resolve changes (old dist-upgrade)install PKGInstall packages and their dependencies; PKG=VERSION pins a versioninstall --only-upgrade PKGUpgrade PKG if installed, never install it freshremove PKGRemove the package but keep its config files in /etcpurge PKGRemove the package and its config filesautoremoveRemove automatic dependencies nothing needs any moresearch / showSearch names and descriptions / print one package's metadatalist --installed / --upgradableWhat's installed / what has a newer version-yAssume yes at prompts (automation)-s, --simulatePrint what would happen without changing anything--no-install-recommendsInstall hard dependencies only, skip RecommendsRUN apt install -y curl in a Dockerfileapt warns 'does not have a stable CLI interface' and its output can change between releases. In a fresh image the lists are also empty, so the install fails with 'Unable to locate package'.
RUN apt-get update && apt-get install -y --no-install-recommends curl && rm -rf /var/lib/apt/lists/*sudo rm /var/lib/dpkg/lock-frontend when apt says 'Could not get lock'Another apt or dpkg (often unattended-upgrades) is really running. Deleting the lock lets two writers corrupt /var/lib/dpkg/status.
ps -o pid,cmd -p <PID from the message> # wait for it, or apt-get -o DPkg::Lock::Timeout=300 ...sudo apt upgrade -y on a production host in the middle of the dayIt upgrades every package at once, including the database or runtime, and services restart under traffic.
apt list --upgradable; sudo apt-mark hold postgresql-16; sudo apt install --only-upgrade <pkg>apt remove nginx and expecting the old config to be goneremove keeps /etc/nginx (state rc). Reinstalling brings back the same broken config.
sudo apt purge nginx nginx-common && sudo apt autoremoveTry these on a Linux machine of your own. Each task has a hint and a solution.
Count how many packages are installed in the sandbox.
Run an apt update and explain the error. (The sandbox has no network.)
Without changing anything, find out what would be removed if you uninstalled curl.
List the packages that were installed on purpose (not as dependencies).
Find the exact command line that installed the packages in this sandbox image.