Master Linux Package Managers: apt, pacman, and dnf
Hello and welcome back — SuiiKawaii here. Today we are demystifying Linux package managers in a practical, do-first way. If you can install, update, roll back, and troubleshoot packages confidently, you can keep any Linux box healthy — whether it is a home lab or a production server.
What you will learn in this guide
- Daily workflows for apt, pacman, and dnf
- Where configuration, repositories, keys, cache, and logs live
- Safe cleanup routines that do not brick your system
- Fast rollbacks and recovery when upgrades go wrong
If you’re on a security track, pair this with Mastering Linux for Cybersecurity.
Table of Contents
- Why Package Managers Matter
- Quick Comparison
- apt (Debian/Ubuntu)
- pacman (Arch)
- dnf (Fedora/RHEL)
- Rollback & Safety Patterns
- Hands-on Example: Install Nmap Across apt, pacman, and dnf
- Safe Cleanups
- Common Errors & Fixes
- Package Manager Health Check
- Bonus: Cross-Distro Helper
- Mini Cheatsheet
- Further Reading
Why Package Managers Matter
Package managers (PMs) keep your system consistent: they resolve dependencies, verify signatures, upgrade safely, and maintain history. Learn one deeply, then map the muscle memory to others.
sudo
. Avoid mixing different PM ecosystems (e.g., using pip
with sudo
to overwrite distro Python packages). Prefer pipx
for CLI Python tools to avoid polluting system packages.
Quick Comparison
Feature | apt (Debian/Ubuntu) | pacman (Arch) | dnf (Fedora/RHEL) |
---|---|---|---|
Daily install | sudo apt install pkg |
sudo pacman -S pkg |
sudo dnf install pkg |
Upgrade all | sudo apt update && sudo apt upgrade |
sudo pacman -Syu |
sudo dnf upgrade --refresh |
Search | apt search term |
pacman -Ss term |
dnf search term |
Info | apt show pkg |
pacman -Si pkg / -Qi |
dnf info pkg |
Remove | sudo apt remove pkg / purge |
sudo pacman -R pkg / -Rns |
sudo dnf remove pkg |
List installed | apt list --installed |
pacman -Q / -Qs |
dnf list installed |
Config file | /etc/apt/apt.conf* |
/etc/pacman.conf |
/etc/dnf/dnf.conf |
Repos | /etc/apt/sources.list{,.d} |
/etc/pacman.d/mirrorlist |
/etc/yum.repos.d/*.repo |
GPG keys | /etc/apt/trusted.gpg.d/ , /usr/share/keyrings/ |
pacman-key DB at /etc/pacman.d/gnupg |
RPM keys in /etc/pki/rpm-gpg/ |
Cache dir | /var/cache/apt/archives |
/var/cache/pacman/pkg |
/var/cache/dnf |
Logs/history | /var/log/apt/ (history.log , term.log ) |
/var/log/pacman.log |
/var/log/dnf.log , dnf history |
Reference video:
apt (Debian/Ubuntu)
Daily operations
# search & info
apt search <term>
apt show <pkg> # detailed info
apt policy <pkg> # show available versions / pinning
# install / remove
sudo apt install <pkg>
sudo apt remove <pkg> # keep config files
sudo apt purge <pkg> # remove with config
# update / upgrade
sudo apt update
sudo apt upgrade # safe upgrade
sudo apt full-upgrade # may remove/replace packages (formerly dist-upgrade)
# list things
apt list --installed
apt list --upgradable
Sources & configuration
- Repos:
/etc/apt/sources.list
and/etc/apt/sources.list.d/*.list
- Main config:
/etc/apt/apt.conf
(and.d/
includes) - Pinning:
/etc/apt/preferences.d/*.pref
Add a PPA or repository:
# Ubuntu PPA helper (adds repo + key):
sudo add-apt-repository ppa:<owner>/<ppa>
sudo apt update
# Generic (signed-by best practice)
echo "deb [signed-by=/usr/share/keyrings/vendor.gpg] https://repo.example.org stable main" \
| sudo tee /etc/apt/sources.list.d/vendor.list
curl -fsSL https://repo.example.org/key.gpg | sudo gpg --dearmor -o /usr/share/keyrings/vendor.gpg
sudo apt update
Note:
apt-key
is deprecated; prefersigned-by=
with a dedicated keyring.
GPG, cache, and logs
- Keys:
/etc/apt/trusted.gpg.d/
,/usr/share/keyrings/
- Cache:
/var/cache/apt/archives
- Logs:
/var/log/apt/history.log
,/var/log/apt/term.log
Fixes you will actually use
# finish interrupted dpkg configuration
sudo dpkg --configure -a
# fix broken deps
sudo apt --fix-broken install
# release locks (only if no apt/dpkg is running!)
sudo lsof /var/lib/dpkg/lock-frontend /var/lib/apt/lists/lock /var/cache/apt/archives/lock
# if stale: sudo rm -f <lockfile> && sudo dpkg --configure -a
pacman (Arch)
Daily operations
# refresh DB + upgrade everything (Arch discourages partial upgrades)
sudo pacman -Syu
# search & info
pacman -Ss <term>
pacman -Si <pkg> # repo info
pacman -Qi <pkg> # local install info
pacman -Qs <term> # search installed
# install / remove
sudo pacman -S <pkg>
sudo pacman -R <pkg> # remove keeping deps if still required
sudo pacman -Rns <pkg> # remove with deps not needed + configs
# query files / ownership
pacman -Ql <pkg> # list files in package
pacman -Qo /path/to/file # which package owns this file?
# local file install
sudo pacman -U ./pkgfile.pkg.tar.zst
Configuration, mirrors, keys
-
Config:
/etc/pacman.conf
Example additions:Color ParallelDownloads = 5
- Mirrors:
/etc/pacman.d/mirrorlist
(order matters). Tools likereflector
can auto-rank mirrors. -
Keys: pacman uses its own keyring:
sudo pacman -Sy archlinux-keyring sudo pacman-key --init sudo pacman-key --populate archlinux
Cache, logs, hooks
- Cache:
/var/cache/pacman/pkg
- Logs:
/var/log/pacman.log
- Hooks:
/usr/share/libalpm/hooks/
(pkg-provided) and/etc/pacman.d/hooks/
(local)
AUR helpers (e.g.,
yay
,paru
) are community tools; learn pure pacman first and read PKGBUILDs before installing.
dnf (Fedora/RHEL)
Daily operations
# refresh metadata + upgrade all
sudo dnf upgrade --refresh
# search & info
dnf search <term>
dnf info <pkg>
dnf list installed
dnf check-update
# install / remove
sudo dnf install <pkg>
sudo dnf remove <pkg>
# history
dnf history
sudo dnf history undo <ID> # rollback a transaction (when possible)
Repos, modules, configuration
- Repos:
/etc/yum.repos.d/*.repo
-
Config:
/etc/dnf/dnf.conf
Example:[main] fastestmirror=1 max_parallel_downloads=10 installonly_limit=3
-
Modularity (Fedora/RHEL streams):
dnf module list sudo dnf module enable nodejs:20 sudo dnf module install nodejs:20/common
Keys, cache, logs
- Keys:
/etc/pki/rpm-gpg/
(import viasudo rpm --import ...
) - Cache:
/var/cache/dnf
- Logs & history:
/var/log/dnf.log
anddnf history
for transactions
Useful checks
sudo dnf check
sudo dnf repoquery --duplicated
sudo dnf distro-sync
Rollback & Safety Patterns
When updates go sideways, these are quick exits that save time:
apt
# prevent a package from upgrading temporarily
echo "<pkg> hold" | sudo dpkg --set-selections
apt-mark showhold
# unhold later:
echo "<pkg> install" | sudo dpkg --set-selections
# install a specific version (see apt policy first)
sudo apt install <pkg>=<version>
pacman
# downgrade using a cached package (if still in cache)
ls -t /var/cache/pacman/pkg/<pkg>-*.pkg.tar.zst | head
sudo pacman -U /var/cache/pacman/pkg/<pkg>-<ver>-x86_64.pkg.tar.zst
dnf
# list history and rollback a transaction
dnf history
sudo dnf history undo <ID>
Keep reasonable caches (see Safe Cleanups) so you actually have old packages to roll back to.
Hands-on Example: Install Nmap Across apt, pacman, and dnf
The same task on three ecosystems. We’ll install Nmap, verify it works, confirm what got logged, and then cleanly roll back.
Debian/Ubuntu (apt)
# install
sudo apt update
sudo apt install -y nmap
# verify
nmap --version
dpkg -L nmap | head # files installed by the package
# see what happened (logs)
grep -i nmap /var/log/apt/history.log || true
grep -i nmap /var/log/apt/term.log || true
# remove (keep config) / purge (remove config)
sudo apt remove -y nmap
# sudo apt purge -y nmap
Arch (pacman)
# install (Arch discourages partial upgrades, so do -Syu)
sudo pacman -Syu --needed nmap
# verify
nmap --version
pacman -Ql nmap | head # files in package
# logs & history
grep -i nmap /var/log/pacman.log || true
# remove (with configs and unneeded deps)
sudo pacman -Rns nmap
Fedora/RHEL (dnf)
# install
sudo dnf install -y nmap
# verify
nmap --version
rpm -ql nmap | head # files in RPM
# history / logs
dnf history | head
sudo grep -i nmap /var/log/dnf.log || true
# remove
sudo dnf remove -y nmap
Tip: if you’re comparing behavior, also check cache directories: – apt →
/var/cache/apt/archives
– pacman →/var/cache/pacman/pkg
– dnf →/var/cache/dnf
Safe Cleanups
Manager | Clean cache | Remove orphans | Notes |
---|---|---|---|
apt | sudo apt clean (all) / sudo apt autoclean (old) |
sudo apt autoremove |
clean can free multiple GB on long-lived systems. Review the list before confirming. |
pacman | sudo pacman -Sc (safe) / sudo pacman -Scc (aggressive) |
pacman -Qtdq lists; sudo pacman -Rns $(pacman -Qtdq) |
-Scc deletes all cached packages including current ones; only for space emergencies. |
dnf | sudo dnf clean packages / sudo dnf clean all |
sudo dnf autoremove |
Consider setting installonly_limit=2 in /etc/dnf/dnf.conf to cap old kernels. |
Common Errors & Fixes
apt
-
NO_PUBKEY
or signature errors Use per-repo keyring andsigned-by=
(avoid deprecatedapt-key
):curl -fsSL https://repo.example.org/key.gpg | sudo gpg --dearmor -o /usr/share/keyrings/vendor.gpg # ensure your .list uses: [signed-by=/usr/share/keyrings/vendor.gpg] sudo apt update
-
Interrupted dpkg / broken deps
sudo dpkg --configure -a sudo apt --fix-broken install
-
Lock files present (no apt running) Check and remove stale locks cautiously:
sudo lsof /var/lib/dpkg/lock-frontend /var/lib/apt/lists/lock /var/cache/apt/archives/lock sudo rm -f /var/lib/dpkg/lock-frontend /var/lib/apt/lists/lock /var/cache/apt/archives/lock sudo dpkg --configure -a
pacman
-
database is locked
sudo rm -f /var/lib/pacman/db.lck
-
Keyring / PGP signature failures
sudo pacman -Sy archlinux-keyring sudo pacman-key --init sudo pacman-key --populate archlinux # ensure system clock is sane timedatectl status
-
Failed to synchronize databases / bad mirrors Update mirrorlist (example with reflector):
sudo pacman -S reflector sudo reflector -c <YourCountry> -a 12 -p https --sort rate --save /etc/pacman.d/mirrorlist sudo pacman -Syyu
-
Partial upgrades Avoid
-Sy
followed by-S <pkg>
later. Always use-Syu
together.
dnf
-
GPG check failed Import or validate the repo key and ensure
gpgcheck=1
to keep safety:sudo rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-40-x86_64 sudo dnf clean metadata && sudo dnf makecache
-
Metadata/cache issues
sudo dnf clean metadata sudo dnf makecache
-
RPM database problems
sudo rpm --rebuilddb sudo dnf distro-sync
-
DNF is locked If no transaction is running, remove the stale PID:
sudo rm -f /var/run/dnf.pid /var/run/yum.pid
Package Manager Health Check
This read-only script inspects common pitfalls: stale locks, keyrings, repo files, cache size, and basic network/DNS reachability. It doesn’t install or remove anything.
Save as pm-health.sh
, make it executable (chmod +x pm-health.sh
), then run: ./pm-health.sh
.
#!/usr/bin/env bash
set -Eeuo pipefail
bold() { printf "\033[1m%s\033[0m\n" "$*"; }
ok() { printf "[OK] %s\n" "$*"; }
warn() { printf "[WARN] %s\n" "$*" >&2; }
err() { printf "[ERR] %s\n" "$*" >&2; }
pm=""; os=""
command -v apt >/dev/null 2>&1 && pm="apt"
command -v pacman >/dev/null 2>&1 && pm="pacman"
command -v dnf >/dev/null 2>&1 && pm="dnf"
os="$(uname -s)"
bold "Package Manager Health Check"
echo "Detected PM: ${pm:-none} | OS: $os"
echo "------------------------------------------"
# 1) Network & DNS
bold "1) Network & DNS"
if getent hosts example.com >/dev/null 2>&1; then
ok "DNS resolution works (example.com)"
else
warn "DNS resolution failed (example.com)"
fi
if curl -I -s --max-time 5 https://github.com >/dev/null 2>&1; then
ok "HTTPS reachability OK (github.com)"
else
warn "HTTPS check failed (github.com)"
fi
echo
# 2) Locks
bold "2) Locks"
case "$pm" in
apt)
for f in /var/lib/dpkg/lock-frontend /var/lib/apt/lists/lock /var/cache/apt/archives/lock; do
if [ -e "$f" ]; then
if fuser "$f" >/dev/null 2>&1; then warn "Lock in use: $f"; else warn "Stale lock found: $f"; fi
fi
done
;;
pacman)
f=/var/lib/pacman/db.lck
[ -e "$f" ] && warn "Lock present: $f" || ok "No pacman lock"
;;
dnf)
for f in /var/run/dnf.pid /var/run/yum.pid; do
[ -e "$f" ] && warn "Lock present: $f" || true
done
[ ! -e /var/run/dnf.pid ] && [ ! -e /var/run/yum.pid ] && ok "No dnf/yum lock"
;;
*)
warn "Unknown PM; skipping lock checks"
;;
esac
echo
# 3) Repos & Keys
bold "3) Repos & Keys"
case "$pm" in
apt)
repos=$(ls -1 /etc/apt/sources.list /etc/apt/sources.list.d 2>/dev/null | wc -l || echo 0)
keys=$(ls -1 /etc/apt/trusted.gpg.d 2>/dev/null | wc -l || echo 0)
k2=$(ls -1 /usr/share/keyrings 2>/dev/null | wc -l || echo 0)
ok "Repo files: $repos | Keyrings: trusted.gpg.d=$keys, /usr/share/keyrings=$k2"
;;
pacman)
[ -s /etc/pacman.conf ] && ok "pacman.conf present"
[ -s /etc/pacman.d/mirrorlist ] && ok "mirrorlist present"
if sudo -n pacman-key --list-keys >/dev/null 2>&1; then
ok "keyring readable"
else
warn "keyring may need init: pacman-key --init && --populate archlinux"
fi
;;
dnf)
repos=$(ls -1 /etc/yum.repos.d/*.repo 2>/dev/null | wc -l || echo 0)
ok "Repo files: $repos"
if rpm -qa gpg-pubkey >/dev/null 2>&1; then
ok "RPM GPG keys installed ($(rpm -qa gpg-pubkey | wc -l))"
else
warn "No RPM GPG keys detected"
fi
;;
esac
echo
# 4) Cache Size
bold "4) Cache Size"
case "$pm" in
apt) dir=/var/cache/apt/archives ;;
pacman) dir=/var/cache/pacman/pkg ;;
dnf) dir=/var/cache/dnf ;;
*) dir="" ;;
esac
if [ -n "${dir}" ] && [ -d "${dir}" ]; then
sz=$(du -sh "${dir}" 2>/dev/null | awk '{print $1}')
ok "Cache ${dir}: ${sz}"
else
warn "Cache directory not found"
fi
echo
# 5) Sanity Checks (non-invasive)
bold "5) Sanity Checks"
case "$pm" in
apt)
if sudo -n true 2>/dev/null; then
if sudo apt-get -s upgrade >/dev/null 2>&1; then ok "apt dependency graph OK (dry-run)"; else warn "apt dry-run upgrade reported issues"; fi
else
warn "Run with sudo for full apt checks"
fi
;;
pacman)
if pacman -Sl >/dev/null 2>&1; then ok "pacman sync DB readable"; else warn "pacman sync DB issue (try: sudo pacman -Syy)"; fi
;;
dnf)
if sudo -n dnf check >/dev/null 2>&1; then ok "dnf check OK"; else warn "dnf check reported issues"; fi
;;
esac
echo
bold "Done."
Bonus: Cross-Distro Helper
Drop this in your shell profile (e.g., ~/.bashrc
) to normalize basic operations across apt/pacman/dnf:
pm() {
local action="$1"; shift || true
if command -v apt >/dev/null 2>&1; then
case "$action" in
install) sudo apt update && sudo apt install -y "$@";;
remove) sudo apt remove -y "$@";;
purge) sudo apt purge -y "$@";;
search) apt search "$@";;
upgrade) sudo apt update && sudo apt upgrade -y;;
clean) sudo apt autoremove -y && sudo apt clean;;
*) echo "apt wrapper: install|remove|purge|search|upgrade|clean";;
esac
elif command -v pacman >/dev/null 2>&1; then
case "$action" in
install) sudo pacman -Syu --needed "$@";;
remove) sudo pacman -Rns "$@";;
search) pacman -Ss "$@";;
upgrade) sudo pacman -Syu;;
clean) sudo pacman -Sc;;
*) echo "pacman wrapper: install|remove|search|upgrade|clean";;
esac
elif command -v dnf >/dev/null 2>&1; then
case "$action" in
install) sudo dnf install -y "$@";;
remove) sudo dnf remove -y "$@";;
search) dnf search "$@";;
upgrade) sudo dnf upgrade --refresh -y;;
clean) sudo dnf autoremove -y && sudo dnf clean packages;;
*) echo "dnf wrapper: install|remove|search|upgrade|clean";;
esac
else
echo "No supported package manager found."
return 1
fi
}
Usage:
pm install nmap
pm search wireshark
pm clean
Mini Cheatsheet
# apt
sudo apt update && sudo apt upgrade
sudo apt install <pkg> && sudo apt remove <pkg> && sudo apt purge <pkg>
apt search <term> && apt show <pkg>
sudo apt autoremove && sudo apt clean
# pacman
sudo pacman -Syu
sudo pacman -S <pkg> && sudo pacman -Rns <pkg>
pacman -Ss <term> && pacman -Si <pkg> && pacman -Qi <pkg>
sudo pacman -Sc
# dnf
sudo dnf upgrade --refresh
sudo dnf install <pkg> && sudo dnf remove <pkg>
dnf search <term> && dnf info <pkg> && dnf list installed
sudo dnf autoremove && sudo dnf clean packages
Further Reading
Videos
- Linux Packaging Formats explained: Flatpak vs Snaps vs DEB & RPM vs AppImage vs AUR
- apt, dpkg, git, Python PiP (Linux Package Management) // Linux for Hackers // EP 5
- Linux Package Management | Debian, Fedora, and Arch Linux
- The Best Package Manager
Official docs & references
- Flatpak docs
- Snapcraft docs
- AppImage docs
- Arch User Repository (AUR)
- dpkg manual
- RPM packaging
- DNF docs
- Python Packaging User Guide
Thanks for reading!
Until next time — Otsumachi!! 💖☄️✨