Master Linux Package Managers: apt, pacman, and dnf
Hello and welcome back — SuiiKawaii here. Today we are demystifying Linux package managers in a practical, do-first way. If you can install, update, roll back, and troubleshoot packages confidently, you can keep any Linux box healthy — whether it is a home lab or a production server.

What you will learn in this guide
- Daily workflows for apt, pacman, and dnf
- Where configuration, repositories, keys, cache, and logs live
- Safe cleanup routines that do not brick your system
- Fast rollbacks and recovery when upgrades go wrong
If you’re on a security track, pair this with Mastering Linux for Cybersecurity.
Table of Contents
- Why Package Managers Matter
- Quick Comparison
- apt (Debian/Ubuntu)
- pacman (Arch)
- dnf (Fedora/RHEL)
- Rollback & Safety Patterns
- Hands-on Example: Install Nmap Across apt, pacman, and dnf
- Safe Cleanups
- Common Errors & Fixes
- Package Manager Health Check
- Bonus: Cross-Distro Helper
- Mini Cheatsheet
- Further Reading
Why Package Managers Matter
Package managers (PMs) keep your system consistent: they resolve dependencies, verify signatures, upgrade safely, and maintain history. Learn one deeply, then map the muscle memory to others.
sudo. Avoid mixing different PM ecosystems (e.g., using pip with sudo to overwrite distro Python packages). Prefer pipx for CLI Python tools to avoid polluting system packages.
Quick Comparison
| Feature | apt (Debian/Ubuntu) | pacman (Arch) | dnf (Fedora/RHEL) |
|---|---|---|---|
| Daily install | sudo apt install pkg |
sudo pacman -S pkg |
sudo dnf install pkg |
| Upgrade all | sudo apt update && sudo apt upgrade |
sudo pacman -Syu |
sudo dnf upgrade --refresh |
| Search | apt search term |
pacman -Ss term |
dnf search term |
| Info | apt show pkg |
pacman -Si pkg / -Qi |
dnf info pkg |
| Remove | sudo apt remove pkg / purge |
sudo pacman -R pkg / -Rns |
sudo dnf remove pkg |
| List installed | apt list --installed |
pacman -Q / -Qs |
dnf list installed |
| Config file | /etc/apt/apt.conf* |
/etc/pacman.conf |
/etc/dnf/dnf.conf |
| Repos | /etc/apt/sources.list{,.d} |
/etc/pacman.d/mirrorlist |
/etc/yum.repos.d/*.repo |
| GPG keys | /etc/apt/trusted.gpg.d/, /usr/share/keyrings/ |
pacman-key DB at /etc/pacman.d/gnupg |
RPM keys in /etc/pki/rpm-gpg/ |
| Cache dir | /var/cache/apt/archives |
/var/cache/pacman/pkg |
/var/cache/dnf |
| Logs/history | /var/log/apt/ (history.log, term.log) |
/var/log/pacman.log |
/var/log/dnf.log, dnf history |
Reference video:
apt (Debian/Ubuntu)
Daily operations
# search & info
apt search <term>
apt show <pkg> # detailed info
apt policy <pkg> # show available versions / pinning
# install / remove
sudo apt install <pkg>
sudo apt remove <pkg> # keep config files
sudo apt purge <pkg> # remove with config
# update / upgrade
sudo apt update
sudo apt upgrade # safe upgrade
sudo apt full-upgrade # may remove/replace packages (formerly dist-upgrade)
# list things
apt list --installed
apt list --upgradable
Sources & configuration
- Repos:
/etc/apt/sources.listand/etc/apt/sources.list.d/*.list - Main config:
/etc/apt/apt.conf(and.d/includes) - Pinning:
/etc/apt/preferences.d/*.pref
Add a PPA or repository:
# Ubuntu PPA helper (adds repo + key):
sudo add-apt-repository ppa:<owner>/<ppa>
sudo apt update
# Generic (signed-by best practice)
echo "deb [signed-by=/usr/share/keyrings/vendor.gpg] https://repo.example.org stable main" \
| sudo tee /etc/apt/sources.list.d/vendor.list
curl -fsSL https://repo.example.org/key.gpg | sudo gpg --dearmor -o /usr/share/keyrings/vendor.gpg
sudo apt update
Note:
apt-keyis deprecated; prefersigned-by=with a dedicated keyring.
GPG, cache, and logs
- Keys:
/etc/apt/trusted.gpg.d/,/usr/share/keyrings/ - Cache:
/var/cache/apt/archives - Logs:
/var/log/apt/history.log,/var/log/apt/term.log
Fixes you will actually use
# finish interrupted dpkg configuration
sudo dpkg --configure -a
# fix broken deps
sudo apt --fix-broken install
# release locks (only if no apt/dpkg is running!)
sudo lsof /var/lib/dpkg/lock-frontend /var/lib/apt/lists/lock /var/cache/apt/archives/lock
# if stale: sudo rm -f <lockfile> && sudo dpkg --configure -a
pacman (Arch)
Daily operations
# refresh DB + upgrade everything (Arch discourages partial upgrades)
sudo pacman -Syu
# search & info
pacman -Ss <term>
pacman -Si <pkg> # repo info
pacman -Qi <pkg> # local install info
pacman -Qs <term> # search installed
# install / remove
sudo pacman -S <pkg>
sudo pacman -R <pkg> # remove keeping deps if still required
sudo pacman -Rns <pkg> # remove with deps not needed + configs
# query files / ownership
pacman -Ql <pkg> # list files in package
pacman -Qo /path/to/file # which package owns this file?
# local file install
sudo pacman -U ./pkgfile.pkg.tar.zst
Configuration, mirrors, keys
-
Config:
/etc/pacman.confExample additions:Color ParallelDownloads = 5 - Mirrors:
/etc/pacman.d/mirrorlist(order matters). Tools likereflectorcan auto-rank mirrors. -
Keys: pacman uses its own keyring:
sudo pacman -Sy archlinux-keyring sudo pacman-key --init sudo pacman-key --populate archlinux
Cache, logs, hooks
- Cache:
/var/cache/pacman/pkg - Logs:
/var/log/pacman.log - Hooks:
/usr/share/libalpm/hooks/(pkg-provided) and/etc/pacman.d/hooks/(local)
AUR helpers (e.g.,
yay,paru) are community tools; learn pure pacman first and read PKGBUILDs before installing.
dnf (Fedora/RHEL)
Daily operations
# refresh metadata + upgrade all
sudo dnf upgrade --refresh
# search & info
dnf search <term>
dnf info <pkg>
dnf list installed
dnf check-update
# install / remove
sudo dnf install <pkg>
sudo dnf remove <pkg>
# history
dnf history
sudo dnf history undo <ID> # rollback a transaction (when possible)
Repos, modules, configuration
- Repos:
/etc/yum.repos.d/*.repo -
Config:
/etc/dnf/dnf.confExample:[main] fastestmirror=1 max_parallel_downloads=10 installonly_limit=3 -
Modularity (Fedora/RHEL streams):
dnf module list sudo dnf module enable nodejs:20 sudo dnf module install nodejs:20/common
Keys, cache, logs
- Keys:
/etc/pki/rpm-gpg/(import viasudo rpm --import ...) - Cache:
/var/cache/dnf - Logs & history:
/var/log/dnf.loganddnf historyfor transactions
Useful checks
sudo dnf check
sudo dnf repoquery --duplicated
sudo dnf distro-sync
Rollback & Safety Patterns
When updates go sideways, these are quick exits that save time:
apt
# prevent a package from upgrading temporarily
echo "<pkg> hold" | sudo dpkg --set-selections
apt-mark showhold
# unhold later:
echo "<pkg> install" | sudo dpkg --set-selections
# install a specific version (see apt policy first)
sudo apt install <pkg>=<version>
pacman
# downgrade using a cached package (if still in cache)
ls -t /var/cache/pacman/pkg/<pkg>-*.pkg.tar.zst | head
sudo pacman -U /var/cache/pacman/pkg/<pkg>-<ver>-x86_64.pkg.tar.zst
dnf
# list history and rollback a transaction
dnf history
sudo dnf history undo <ID>
Keep reasonable caches (see Safe Cleanups) so you actually have old packages to roll back to.
Hands-on Example: Install Nmap Across apt, pacman, and dnf
The same task on three ecosystems. We’ll install Nmap, verify it works, confirm what got logged, and then cleanly roll back.
Debian/Ubuntu (apt)
# install
sudo apt update
sudo apt install -y nmap
# verify
nmap --version
dpkg -L nmap | head # files installed by the package
# see what happened (logs)
grep -i nmap /var/log/apt/history.log || true
grep -i nmap /var/log/apt/term.log || true
# remove (keep config) / purge (remove config)
sudo apt remove -y nmap
# sudo apt purge -y nmap
Arch (pacman)
# install (Arch discourages partial upgrades, so do -Syu)
sudo pacman -Syu --needed nmap
# verify
nmap --version
pacman -Ql nmap | head # files in package
# logs & history
grep -i nmap /var/log/pacman.log || true
# remove (with configs and unneeded deps)
sudo pacman -Rns nmap
Fedora/RHEL (dnf)
# install
sudo dnf install -y nmap
# verify
nmap --version
rpm -ql nmap | head # files in RPM
# history / logs
dnf history | head
sudo grep -i nmap /var/log/dnf.log || true
# remove
sudo dnf remove -y nmap
Tip: if you’re comparing behavior, also check cache directories: – apt →
/var/cache/apt/archives– pacman →/var/cache/pacman/pkg– dnf →/var/cache/dnf
Safe Cleanups
| Manager | Clean cache | Remove orphans | Notes |
|---|---|---|---|
| apt | sudo apt clean (all) / sudo apt autoclean (old) |
sudo apt autoremove |
clean can free multiple GB on long-lived systems. Review the list before confirming. |
| pacman | sudo pacman -Sc (safe) / sudo pacman -Scc (aggressive) |
pacman -Qtdq lists; sudo pacman -Rns $(pacman -Qtdq) |
-Scc deletes all cached packages including current ones; only for space emergencies. |
| dnf | sudo dnf clean packages / sudo dnf clean all |
sudo dnf autoremove |
Consider setting installonly_limit=2 in /etc/dnf/dnf.conf to cap old kernels. |
Common Errors & Fixes
apt
-
NO_PUBKEYor signature errors Use per-repo keyring andsigned-by=(avoid deprecatedapt-key):curl -fsSL https://repo.example.org/key.gpg | sudo gpg --dearmor -o /usr/share/keyrings/vendor.gpg # ensure your .list uses: [signed-by=/usr/share/keyrings/vendor.gpg] sudo apt update -
Interrupted dpkg / broken deps
sudo dpkg --configure -a sudo apt --fix-broken install -
Lock files present (no apt running) Check and remove stale locks cautiously:
sudo lsof /var/lib/dpkg/lock-frontend /var/lib/apt/lists/lock /var/cache/apt/archives/lock sudo rm -f /var/lib/dpkg/lock-frontend /var/lib/apt/lists/lock /var/cache/apt/archives/lock sudo dpkg --configure -a
pacman
-
database is lockedsudo rm -f /var/lib/pacman/db.lck -
Keyring / PGP signature failures
sudo pacman -Sy archlinux-keyring sudo pacman-key --init sudo pacman-key --populate archlinux # ensure system clock is sane timedatectl status -
Failed to synchronize databases / bad mirrors Update mirrorlist (example with reflector):
sudo pacman -S reflector sudo reflector -c <YourCountry> -a 12 -p https --sort rate --save /etc/pacman.d/mirrorlist sudo pacman -Syyu -
Partial upgrades Avoid
-Syfollowed by-S <pkg>later. Always use-Syutogether.
dnf
-
GPG check failed Import or validate the repo key and ensure
gpgcheck=1to keep safety:sudo rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-40-x86_64 sudo dnf clean metadata && sudo dnf makecache -
Metadata/cache issues
sudo dnf clean metadata sudo dnf makecache -
RPM database problems
sudo rpm --rebuilddb sudo dnf distro-sync -
DNF is locked If no transaction is running, remove the stale PID:
sudo rm -f /var/run/dnf.pid /var/run/yum.pid
Package Manager Health Check
This read-only script inspects common pitfalls: stale locks, keyrings, repo files, cache size, and basic network/DNS reachability. It doesn’t install or remove anything.
Save as pm-health.sh, make it executable (chmod +x pm-health.sh), then run: ./pm-health.sh.
#!/usr/bin/env bash
set -Eeuo pipefail
bold() { printf "\033[1m%s\033[0m\n" "$*"; }
ok() { printf "[OK] %s\n" "$*"; }
warn() { printf "[WARN] %s\n" "$*" >&2; }
err() { printf "[ERR] %s\n" "$*" >&2; }
pm=""; os=""
command -v apt >/dev/null 2>&1 && pm="apt"
command -v pacman >/dev/null 2>&1 && pm="pacman"
command -v dnf >/dev/null 2>&1 && pm="dnf"
os="$(uname -s)"
bold "Package Manager Health Check"
echo "Detected PM: ${pm:-none} | OS: $os"
echo "------------------------------------------"
# 1) Network & DNS
bold "1) Network & DNS"
if getent hosts example.com >/dev/null 2>&1; then
ok "DNS resolution works (example.com)"
else
warn "DNS resolution failed (example.com)"
fi
if curl -I -s --max-time 5 https://github.com >/dev/null 2>&1; then
ok "HTTPS reachability OK (github.com)"
else
warn "HTTPS check failed (github.com)"
fi
echo
# 2) Locks
bold "2) Locks"
case "$pm" in
apt)
for f in /var/lib/dpkg/lock-frontend /var/lib/apt/lists/lock /var/cache/apt/archives/lock; do
if [ -e "$f" ]; then
if fuser "$f" >/dev/null 2>&1; then warn "Lock in use: $f"; else warn "Stale lock found: $f"; fi
fi
done
;;
pacman)
f=/var/lib/pacman/db.lck
[ -e "$f" ] && warn "Lock present: $f" || ok "No pacman lock"
;;
dnf)
for f in /var/run/dnf.pid /var/run/yum.pid; do
[ -e "$f" ] && warn "Lock present: $f" || true
done
[ ! -e /var/run/dnf.pid ] && [ ! -e /var/run/yum.pid ] && ok "No dnf/yum lock"
;;
*)
warn "Unknown PM; skipping lock checks"
;;
esac
echo
# 3) Repos & Keys
bold "3) Repos & Keys"
case "$pm" in
apt)
repos=$(ls -1 /etc/apt/sources.list /etc/apt/sources.list.d 2>/dev/null | wc -l || echo 0)
keys=$(ls -1 /etc/apt/trusted.gpg.d 2>/dev/null | wc -l || echo 0)
k2=$(ls -1 /usr/share/keyrings 2>/dev/null | wc -l || echo 0)
ok "Repo files: $repos | Keyrings: trusted.gpg.d=$keys, /usr/share/keyrings=$k2"
;;
pacman)
[ -s /etc/pacman.conf ] && ok "pacman.conf present"
[ -s /etc/pacman.d/mirrorlist ] && ok "mirrorlist present"
if sudo -n pacman-key --list-keys >/dev/null 2>&1; then
ok "keyring readable"
else
warn "keyring may need init: pacman-key --init && --populate archlinux"
fi
;;
dnf)
repos=$(ls -1 /etc/yum.repos.d/*.repo 2>/dev/null | wc -l || echo 0)
ok "Repo files: $repos"
if rpm -qa gpg-pubkey >/dev/null 2>&1; then
ok "RPM GPG keys installed ($(rpm -qa gpg-pubkey | wc -l))"
else
warn "No RPM GPG keys detected"
fi
;;
esac
echo
# 4) Cache Size
bold "4) Cache Size"
case "$pm" in
apt) dir=/var/cache/apt/archives ;;
pacman) dir=/var/cache/pacman/pkg ;;
dnf) dir=/var/cache/dnf ;;
*) dir="" ;;
esac
if [ -n "${dir}" ] && [ -d "${dir}" ]; then
sz=$(du -sh "${dir}" 2>/dev/null | awk '{print $1}')
ok "Cache ${dir}: ${sz}"
else
warn "Cache directory not found"
fi
echo
# 5) Sanity Checks (non-invasive)
bold "5) Sanity Checks"
case "$pm" in
apt)
if sudo -n true 2>/dev/null; then
if sudo apt-get -s upgrade >/dev/null 2>&1; then ok "apt dependency graph OK (dry-run)"; else warn "apt dry-run upgrade reported issues"; fi
else
warn "Run with sudo for full apt checks"
fi
;;
pacman)
if pacman -Sl >/dev/null 2>&1; then ok "pacman sync DB readable"; else warn "pacman sync DB issue (try: sudo pacman -Syy)"; fi
;;
dnf)
if sudo -n dnf check >/dev/null 2>&1; then ok "dnf check OK"; else warn "dnf check reported issues"; fi
;;
esac
echo
bold "Done."
Bonus: Cross-Distro Helper
Drop this in your shell profile (e.g., ~/.bashrc) to normalize basic operations across apt/pacman/dnf:
pm() {
local action="$1"; shift || true
if command -v apt >/dev/null 2>&1; then
case "$action" in
install) sudo apt update && sudo apt install -y "$@";;
remove) sudo apt remove -y "$@";;
purge) sudo apt purge -y "$@";;
search) apt search "$@";;
upgrade) sudo apt update && sudo apt upgrade -y;;
clean) sudo apt autoremove -y && sudo apt clean;;
*) echo "apt wrapper: install|remove|purge|search|upgrade|clean";;
esac
elif command -v pacman >/dev/null 2>&1; then
case "$action" in
install) sudo pacman -Syu --needed "$@";;
remove) sudo pacman -Rns "$@";;
search) pacman -Ss "$@";;
upgrade) sudo pacman -Syu;;
clean) sudo pacman -Sc;;
*) echo "pacman wrapper: install|remove|search|upgrade|clean";;
esac
elif command -v dnf >/dev/null 2>&1; then
case "$action" in
install) sudo dnf install -y "$@";;
remove) sudo dnf remove -y "$@";;
search) dnf search "$@";;
upgrade) sudo dnf upgrade --refresh -y;;
clean) sudo dnf autoremove -y && sudo dnf clean packages;;
*) echo "dnf wrapper: install|remove|search|upgrade|clean";;
esac
else
echo "No supported package manager found."
return 1
fi
}
Usage:
pm install nmap
pm search wireshark
pm clean
Mini Cheatsheet
# apt
sudo apt update && sudo apt upgrade
sudo apt install <pkg> && sudo apt remove <pkg> && sudo apt purge <pkg>
apt search <term> && apt show <pkg>
sudo apt autoremove && sudo apt clean
# pacman
sudo pacman -Syu
sudo pacman -S <pkg> && sudo pacman -Rns <pkg>
pacman -Ss <term> && pacman -Si <pkg> && pacman -Qi <pkg>
sudo pacman -Sc
# dnf
sudo dnf upgrade --refresh
sudo dnf install <pkg> && sudo dnf remove <pkg>
dnf search <term> && dnf info <pkg> && dnf list installed
sudo dnf autoremove && sudo dnf clean packages
Further Reading
Videos
- Linux Packaging Formats explained: Flatpak vs Snaps vs DEB & RPM vs AppImage vs AUR
- apt, dpkg, git, Python PiP (Linux Package Management) // Linux for Hackers // EP 5
- Linux Package Management | Debian, Fedora, and Arch Linux
- The Best Package Manager
Official docs & references
- Flatpak docs
- Snapcraft docs
- AppImage docs
- Arch User Repository (AUR)
- dpkg manual
- RPM packaging
- DNF docs
- Python Packaging User Guide
Thanks for reading!
Until next time — Otsumachi!! 💖☄️✨
