Every distribution installs software from repositories, and every distribution family uses a different command to do it. The concepts are nearly identical; only the spelling changes. This page puts the three main ones side by side so you can translate between them.
| Family | Tool | Distributions |
|---|---|---|
| Debian | apt | Debian, Ubuntu, Mint, Pop!_OS, Raspberry Pi OS |
| Red Hat | dnf | Fedora, RHEL, Rocky, AlmaLinux, CentOS Stream |
| Arch | pacman | Arch, Manjaro, EndeavourOS |
| SUSE | zypper | openSUSE, SLES |
| Alpine | apk | Alpine — common in containers |
The same job, three ways
| Task | apt | dnf | pacman |
|---|---|---|---|
| Refresh package lists | apt update | automatic | pacman -Sy* |
| Upgrade everything | apt upgrade | dnf upgrade | pacman -Syu |
| Install | apt install X | dnf install X | pacman -S X |
| Remove | apt remove X | dnf remove X | pacman -R X |
| Remove with config | apt purge X | dnf remove X | pacman -Rns X |
| Search | apt search X | dnf search X | pacman -Ss X |
| Show details | apt show X | dnf info X | pacman -Si X |
| List installed | apt list --installed | dnf list installed | pacman -Q |
| Files in a package | dpkg -L X | rpm -ql X | pacman -Ql X |
| Which package owns a file | dpkg -S /path | dnf provides /path | pacman -Qo /path |
| Clean the cache | apt clean | dnf clean all | pacman -Sc |
| Remove orphans | apt autoremove | dnf autoremove | pacman -Rns $(pacman -Qtdq) |
* pacman -Sy on its own is dangerous. See the Arch section below — this is the one entry in the table you should not copy blindly.
Debian and Ubuntu: apt
sudo apt update # refresh the list of what is available
sudo apt upgrade # actually install the newer versions
sudo apt full-upgrade # allows removing packages to resolve conflicts
sudo apt install nginx
sudo apt install ./local.deb # install a downloaded .deb with dependencies
sudo apt remove nginx # keep configuration files
sudo apt purge nginx # remove configuration too
sudo apt autoremove # drop dependencies nothing needs any moreupdate and upgrade are not the same thing, and this catches every newcomer. apt update downloads the catalogue and changes nothing on your system. apt upgrade installs what the catalogue offers. You almost always want both:
sudo apt update && sudo apt upgradeapt is the friendly modern front end. In scripts, use apt-get — its output is stable and machine-readable, while apt prints a warning that it “does not have a stable CLI interface” and may change formatting between releases.
sudo DEBIAN_FRONTEND=noninteractive apt-get install -y nginxDebian-specific traps
- The dpkg lock.
Could not get lock /var/lib/dpkg/lock-frontendmeans something else is installing — very often the unattended-upgrades timer. Wait for it. Deleting the lock file mid-transaction is how you end up with a broken package database. - Held-back packages. “The following packages have been kept back” means the upgrade would need to install or remove something else.
apt full-upgraderesolves it — read what it proposes first. - PPAs are third-party repositories. Convenient, but they can and do break upgrades between releases.
ppa-purgeremoves one cleanly. - Configuration file prompts. During an upgrade you may be asked to keep or replace a config file. The default keeps yours.
Dshows a diff, which is almost always worth reading.
Fedora, RHEL and friends: dnf
sudo dnf upgrade # refreshes metadata automatically
sudo dnf install nginx
sudo dnf remove nginx
dnf search web server
dnf provides /usr/bin/htop # which package would give me this file
dnf list installed | grep nginx
sudo dnf autoremoveThere is no separate update step — dnf refreshes metadata on its own when it has gone stale. dnf update exists as an alias for upgrade.
The genuinely excellent dnf feature is transaction history, which no other family does as well:
dnf history # every transaction, numbered
dnf history info 42 # exactly what changed in one
sudo dnf history undo 42 # roll it backIf an upgrade breaks something, dnf history undo is often a genuine fix rather than a hopeful one.
Other things worth knowing: dnf groupinstall "Development Tools" installs a whole set at once; extra software usually means enabling EPEL on RHEL-family systems; and dnf needs-restarting -r tells you whether a reboot is actually required.
Arch: pacman
sudo pacman -Syu # refresh and upgrade — the only correct way
sudo pacman -S nginx
sudo pacman -Rns nginx # remove with config and unused dependencies
pacman -Ss editor # search
pacman -Qe # what did I explicitly install
pacman -Qtdq # orphans
sudo pacman -Sc # clean old packages from the cacheThe flags are terse but systematic: -S sync (install from repositories), -R remove, -Q query the local database, -y refresh lists, -u upgrade.
Never run pacman -Sy on its own
This is the single most important thing on this page for Arch users. pacman -Sy package refreshes the package lists and then installs one package against them — leaving you with a system where one component is new and everything else is old. Arch is a rolling release with no support for that combination.
The result is called a partial upgrade, and it produces library mismatches that can leave the machine unbootable. Always upgrade the whole system together:
# Correct
sudo pacman -Syu package
# Do not do this
sudo pacman -Sy packageTwo other Arch notes: after a long gap, refresh the keyring first with sudo pacman -S archlinux-keyring, and read the Arch news before a big upgrade — manual interventions are announced there and nowhere else.
The AUR is not part of pacman. Packages there are user-submitted build scripts, reviewed by nobody in particular. Helpers like yay and paru make them convenient, which is exactly why it is worth reading the PKGBUILD before installing something obscure.
Problems common to all three
Repository signature errors
Expired or missing GPG keys are the usual cause. Fix the key properly — refresh the keyring, reinstall the repository’s key package. Disabling signature checking to make the error go away removes the only thing verifying that your packages come from who they claim to.
404s on package downloads
Usually stale metadata pointing at files a mirror has since removed. Refresh: apt update, dnf clean all, or pacman -Syy. If it persists, the mirror is out of date — switch to another.
The package is too old
Debian stable and RHEL deliberately freeze versions and backport security fixes only. That is a feature for servers and a frustration on a desktop. Options, roughly in order of how much they can break: official backports, the vendor’s own repository, Flatpak or Snap, a container, or building from source. Adding a third-party repository for one package is the most common way people quietly break their next distribution upgrade.
Do not fight the package manager
make install into /usr puts files where the package manager believes it is in charge, and nothing will ever clean them up. If you must build from source, install to /usr/local or /opt, or use checkinstall to produce a real package.
Quick reference
# Debian / Ubuntu
sudo apt update && sudo apt upgrade
sudo apt install PKG
sudo apt purge PKG && sudo apt autoremove
dpkg -S /path/to/file # which package owns this
# Fedora / RHEL / Rocky / Alma
sudo dnf upgrade
sudo dnf install PKG
sudo dnf remove PKG
dnf provides /path/to/file
dnf history # and: dnf history undo N
# Arch
sudo pacman -Syu # never plain -Sy
sudo pacman -S PKG
sudo pacman -Rns PKG
pacman -Qo /path/to/fileRelated
- Disk space — package caches are a routine cause of a full disk.
- systemctl — most packages install a service you then need to enable.
- grep — for filtering long package lists.
flatpakandsnap— distribution-independent packaging, useful when the repository version is too old.