Skip to main content

Package management

Debian and Ubuntu. apt is the command intended for interactive use; apt-get is the older, script-stable interface. They accept the same package operations.

Update and upgrade​

sudo apt update          # refresh the package index
sudo apt upgrade         # install newer versions of installed packages
sudo apt full-upgrade    # same, but may remove packages to resolve conflicts
sudo apt autoremove      # drop dependencies nothing needs any more
sudo apt clean           # clear the downloaded-package cache

"The following packages have been kept back"​

apt upgrade refuses to upgrade a package when the new version pulls in a dependency that is not installed yet, because plain upgrade is not allowed to add or remove packages. Either allow new dependencies or name the packages explicitly:

sudo apt upgrade --with-new-pkgs
# or
sudo apt install PACKAGE_1 PACKAGE_2

sudo apt full-upgrade has the same effect and additionally allows removals, so read its plan before confirming.

Phased updates are a second, unrelated cause on Ubuntu: a package can be held back deliberately until the rollout reaches your machine. apt-cache policy PACKAGE shows the phasing state, and waiting is the correct response.

Query packages​

apt list --upgradable        # what is pending
apt policy PACKAGE           # installed version and candidate version
apt show PACKAGE             # description and dependencies
dpkg -l | grep PACKAGE       # installed packages matching a name
dpkg -L PACKAGE              # files a package installed
dpkg -S /path/to/file        # which package owns a file

Check the release of a running Alpine container:

cat /etc/alpine-release

Release upgrade​

screen                                 # survive a dropped connection
sudo apt update -y && sudo apt upgrade -y
sudo apt dist-upgrade -y
sudo apt autoclean
sudo apt autoremove -y
sudo apt install update-manager-core
sudo reboot
sudo do-release-upgrade --check-dist-upgrade-only
sudo do-release-upgrade                # add -d to target a development release

Recovering a broken dpkg state​

Could not get lock /var/lib/dpkg/lock-frontend means another package operation is running — or crashed and left a stale lock. If nothing is actually running:

sudo rm /var/lib/dpkg/lock-frontend
sudo rm /var/lib/dpkg/lock
sudo rm /var/cache/apt/archives/lock

For a more thoroughly wedged state:

sudo dpkg --configure -a
sudo apt clean
sudo apt update --fix-missing
sudo apt install -f          # fix broken dependencies

Repository keys​

apt-key is deprecated. Store keyring files in /etc/apt/trusted.gpg.d/ and reference them from the source list instead.

# Convert an old apt-key entry into a keyring file
apt-key export E2C63C11 | sudo gpg --dearmour -o /etc/apt/trusted.gpg.d/mongodb5.gpg

# In the *.list file, point the entry at the keyring:
# deb [arch=amd64,arm64 signed-by=/etc/apt/trusted.gpg.d/mongodb5.gpg] ...
ls /etc/apt/sources.list.d

# Remove an old apt-key entry
sudo apt-key list
sudo apt-key del 557BEFF9

Unattended upgrades​

sudo apt install unattended-upgrades
sudo vi /etc/apt/apt.conf.d/50unattended-upgrades

Recommended lines:

Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
Unattended-Upgrade::Remove-New-Unused-Dependencies "true";
Unattended-Upgrade::Remove-Unused-Dependencies "true";
Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "02:38";

Enable the periodic run in /etc/apt/apt.conf.d/20auto-upgrades:

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Download-Upgradeable-Packages "1";
APT::Periodic::Unattended-Upgrade "1";
APT::Periodic::AutocleanInterval "7";

Verify and inspect:

sudo unattended-upgrades --dry-run --debug
sudo dpkg-reconfigure -plow unattended-upgrades   # interactive enable
cat /var/log/unattended-upgrades/unattended-upgrades.log