LFCS 49 🐧 Package Management — APT - KandZ

⏱️ Estimated read: 10 min | |

APT (Advanced Package Tool) is the package management system used by Debian, Ubuntu, and their derivatives. It sits on top of dpkg, the low-level tool that installs and removes individual .deb files, and adds the repository logic, dependency resolution, and network retrieval that make installing software practical . For the LFCS exam, package management falls under “Operations Deployment,” which carries 25% of the exam weight and includes “search, install, verify, and maintain software packages or repositories” .

The command-line interface comes in two flavours. apt is the user-facing tool, designed for interactive use, with progress bars and a friendly output format. apt-get is the older, script-oriented tool, with more options and stable output that does not change between versions . The Ubuntu documentation is explicit: use apt interactively, use apt-get in scripts . The core commands—update, upgrade, install, remove, purge—are identical in both.

Key point: apt update refreshes the local index from the repositories; apt upgrade installs newer versions of installed packages without removing anything; apt full-upgrade may remove packages to complete the upgrade; apt install and apt remove manage individual packages, and apt purge removes configuration files that remove leaves behind.

Why APT exists as a layer above dpkg

The dependency problem. dpkg installs a .deb file, but it does not download anything and does not resolve dependencies. If you try to install a package that needs a library, dpkg fails and leaves the system in a broken state until you manually install the library . APT reads the dependency metadata, downloads the required packages, and installs them in the correct order. This is the entire reason APT exists.

The repository problem. A .deb file must come from somewhere. APT maintains a list of repositories in /etc/apt/sources.list and /etc/apt/sources.list.d/, downloads the package index from each, and uses that index to answer “what versions of this package are available?” . Without apt update, the index is stale, and APT may refuse to install a package that exists in the repository or install an outdated version.

The script compatibility problem. apt is designed for humans. Its output includes progress bars and colour, and its behaviour may change between releases. apt-get is designed for scripts: its output is stable, its options are comprehensive, and it does not assume a terminal . The underlying operations are the same, but the interface contract is different. A cron job that runs apt upgrade -y is using the right tool; a human typing apt upgrade is also using the right tool.

The configuration residue problem. apt remove uninstalls a package but leaves its configuration files in place. This is deliberate: if you reinstall the package, the previous configuration is restored. apt purge removes the package and its configuration files, which is what you want when you are cleaning up a service you will never reinstall . Understanding this distinction prevents a class of confusing behaviour where a package appears “removed” but its settings keep affecting the system.

a. Refreshing and upgrading

apt update downloads the package index from every configured repository. It does not install or upgrade anything; it only refreshes the local metadata so that subsequent commands know what versions are available .

# Download the current package index from all repositories
sudo apt update

# Install newer versions of all installed packages
# New packages may be installed for dependencies,
# but installed packages are never removed
sudo apt upgrade

# Same as upgrade, but may remove packages if necessary
# to complete the upgrade (e.g., conflicting dependencies)
sudo apt full-upgrade

The distinction between upgrade and full-upgrade is the removal policy. upgrade never removes an installed package; if a package’s newer version requires removing another package, the upgrade is skipped for that package . full-upgrade removes whatever is necessary to complete the upgrade. On a production server, upgrade is the conservative choice; full-upgrade is necessary when a package’s dependencies have changed significantly.

apt list --upgradable shows which packages have newer versions available without installing anything. apt list --installed shows every installed package .

b. Installing, removing, and purging

apt install takes one or more package names, resolves their dependencies, downloads everything, and installs it. The package name is the name, not the filename—apt install nmap, not apt install nmap_7.94.deb .

# Install a single package and its dependencies
sudo apt install nmap

# Install multiple packages in one transaction
sudo apt install nginx postgresql redis-server

# Install a specific version
sudo apt install nginx=1.24.0-1

# Reinstall a package without removing it first
# Useful if files were corrupted or accidentally modified
sudo apt install --reinstall nginx

apt remove uninstalls the package but leaves its configuration files. apt purge removes the package and the configuration files .

# Remove the package but keep its configuration files
sudo apt remove nginx

# Remove the package and delete its configuration files
sudo apt purge nginx

The autoremove command is the cleanup mechanism. When you install a package, its dependencies are marked as “automatically installed.” When you remove the package, those dependencies remain unless you run autoremove, which removes every automatically installed package that no longer has a dependent .

# Remove orphaned dependencies left by removed packages
sudo apt autoremove

# Remove orphaned dependencies and clear the downloaded .deb cache
sudo apt autoremove --purge

c. Searching, inspecting, and holding packages

apt search finds packages by name or description. The results are fuzzy—a search for spotify returns packages that mention it in their description, not necessarily packages named spotify .

# Search for packages matching a term
apt search nginx

# Show detailed information about a package
# (version, size, dependencies, description)
apt show nginx

# List all packages, or filter by state
apt list --installed
apt list --upgradable

apt-mark hold prevents a package from being upgraded. This is the correct tool when a newer version introduces a breaking change and you need to pin the current version until you have tested the upgrade .

# Prevent a package from being upgraded
sudo apt-mark hold nginx

# Show all held packages
apt-mark showhold

# Release the hold and allow upgrades again
sudo apt-mark unhold nginx

The --simulate flag is the safety net for disruptive operations. It shows what APT would do without actually doing it, which is the correct way to verify that a full-upgrade will not remove something critical .

# Show what would happen without making changes
sudo apt install --simulate nginx
sudo apt full-upgrade --simulate

Complete Example Session

The following session updates the index, installs a package, holds it, simulates a removal, and cleans up.

# ============================================
# PART 1: REFRESH THE INDEX
# ============================================
# Download the current package metadata from all repositories
sudo apt update
# Output lists the repositories being read and any available updates

# ============================================
# PART 2: INSTALL A PACKAGE
# ============================================
# Install nginx and its dependencies
sudo apt install nginx
# APT resolves dependencies, downloads the .deb files,
# and installs them in the correct order

# ============================================
# PART 3: VERIFY THE INSTALLATION
# ============================================
# Confirm the package is installed and show its version
apt list --installed | grep nginx
# Output: nginx/jammy-updates,now 1.18.0-6ubuntu14.4 amd64 [installed]

# ============================================
# PART 4: HOLD THE PACKAGE
# ============================================
# Prevent nginx from being upgraded
sudo apt-mark hold nginx
# Output: nginx set on hold

# Verify the hold is active
apt-mark showhold
# Output: nginx

# ============================================
# PART 5: SIMULATE A REMOVAL
# ============================================
# Show what would happen if nginx were removed
# without actually removing it
sudo apt remove --simulate nginx
# Output lists nginx and any packages that would be removed

# ============================================
# PART 6: REMOVE AND CLEAN UP
# ============================================
# Remove the package but keep configuration files
sudo apt remove nginx

# Remove orphaned dependencies that nginx pulled in
sudo apt autoremove

# Release the hold so future operations are not affected
sudo apt-mark unhold nginx

The six parts cover the index refresh, the installation, the verification, the hold, the simulation, and the removal with cleanup. What the session demonstrates is that apt update is a prerequisite for reliable installation, --simulate is the safety check before disruptive operations, and autoremove is what prevents dependency residue from accumulating.

Quick Reference

Core Commands

Command	Effect
`apt update`	Refresh package index
`apt upgrade`	Upgrade installed packages, no removals
`apt full-upgrade`	Upgrade, may remove packages
`apt install pkg`	Install package and dependencies
`apt remove pkg`	Remove package, keep config
`apt purge pkg`	Remove package and config
`apt autoremove`	Remove orphaned dependencies
`apt search term`	Search for packages
`apt show pkg`	Show package details
`apt list --installed`	List installed packages

Hold Management

Command	Effect
`apt-mark hold pkg`	Prevent upgrades
`apt-mark unhold pkg`	Allow upgrades
`apt-mark showhold`	List held packages

apt vs apt-get

Aspect	`apt`	`apt-get`
Target	Interactive use	Scripts
Output	Progress bars, colour	Stable, parseable
Options	Fewer, common	Comprehensive

File Locations

Path	Purpose
`/etc/apt/sources.list`	Repository definitions (older)
`/etc/apt/sources.list.d/`	Additional repository files
`/var/cache/apt/archives/`	Downloaded `.deb` cache
`/var/log/dpkg.log`	Package operation log

Best Practices

✅ Do This:

# Update the index before installing
sudo apt update && sudo apt install nginx

# Simulate before full-upgrade
sudo apt full-upgrade --simulate

# Hold a package when a new version is untested
sudo apt-mark hold nginx

# Clean up orphaned dependencies
sudo apt autoremove

❌ Don’t Do This:

# Install without updating the index
sudo apt install nginx  # may fail or install outdated version

# Use apt in a script
apt upgrade -y  # use apt-get for scripts

# Forget that remove leaves config behind
sudo apt remove nginx  # config files remain

# Run full-upgrade without simulating
sudo apt full-upgrade  # may remove critical packages

Common Pitfalls

Pitfall	Why It Happens	Fix
Package not found	Index not updated	`sudo apt update`
Upgrade removes critical package	Used `full-upgrade`	Simulate first, or use `upgrade`
Config files remain after removal	`remove` keeps them	Use `purge`
Orphaned dependencies accumulate	No `autoremove`	Run `apt autoremove`
Package keeps upgrading despite hold	Hold not set	`apt-mark hold pkg`
Lock file error	Another APT process running	Wait or check `ps aux \| grep apt`

Real-World Examples

1. Install a package

sudo apt install nginx

2. Remove with config

sudo apt purge nginx

3. Update and upgrade

sudo apt update && sudo apt upgrade

4. Simulate full-upgrade

sudo apt full-upgrade --simulate

5. Hold a package

sudo apt-mark hold postgresql

6. Search for a package

apt search nginx

7. Show package details

apt show nginx

8. List upgradable

apt list --upgradable

9. Reinstall a package

sudo apt install --reinstall nginx

10. Clean the cache

sudo apt clean

Visual

APT Layers

┌──────────────────────────────────────────────┐
│  apt / apt-get                              │
│  (dependency resolution, repository access)  │
│         │                                    │
│         ▼                                    │
│  dpkg                                        │
│  (installs individual .deb files)            │
│         │                                    │
│         ▼                                    │
│  Filesystem                                  │
└──────────────────────────────────────────────┘

Update vs Upgrade

┌──────────────────────────────────────────────┐
│  apt update                                  │
│  → downloads package INDEX                   │
│  → does NOT change installed packages        │
│                                              │
│  apt upgrade                                 │
│  → installs newer versions of installed pkgs │
│  → does NOT remove any package               │
│                                              │
│  apt full-upgrade                            │
│  → may remove packages to complete upgrade   │
└──────────────────────────────────────────────┘

Remove vs Purge

┌──────────────────────────────────────────────┐
│  apt remove nginx                            │
│  → binary removed                            │
│  → /etc/nginx/ config files remain           │
│                                              │
│  apt purge nginx                             │
│  → binary removed                            │
│  → config files deleted                      │
└──────────────────────────────────────────────┘

Hold Flow

┌──────────────────────────────────────────────┐
│  apt-mark hold nginx                         │
│         │                                    │
│         ▼                                    │
│  apt upgrade                                 │
│         │                                    │
│         ▼                                    │
│  nginx is skipped                            │
│  (other packages still upgrade)              │
│         │                                    │
│         ▼                                    │
│  apt-mark unhold nginx                       │
│  → nginx eligible for upgrade again          │
└──────────────────────────────────────────────┘

Summary

Item	Value
APT layer	Above dpkg
Index refresh	`apt update`
Safe upgrade	`apt upgrade` (no removals)
Complete upgrade	`apt full-upgrade` (may remove)
Install	`apt install pkg`
Remove	`apt remove pkg` (keeps config)
Purge	`apt purge pkg` (deletes config)
Cleanup	`apt autoremove`
Hold	`apt-mark hold pkg`
Script tool	`apt-get`

Key takeaways:

apt update is not optional. It downloads the package index from the repositories. Without it, install and upgrade operate on stale metadata and may fail or install outdated versions .
upgrade and full-upgrade differ in their removal policy. upgrade never removes an installed package; full-upgrade removes whatever is necessary to complete the upgrade. Simulate before using full-upgrade .
remove and purge differ in their treatment of configuration files. remove uninstalls the binary but leaves /etc/ files. purge deletes both .
autoremove cleans up orphaned dependencies. Without it, every package you remove leaves its automatically installed dependencies behind, consuming disk space .
apt-mark hold is the pinning mechanism. It prevents a specific package from being upgraded while allowing everything else to proceed .
Use apt interactively and apt-get in scripts. apt is designed for humans; apt-get has stable output and more options for automation .

Remember: APT is the package manager for Debian and Ubuntu systems, and it exists to solve the problems that dpkg cannot: downloading packages, resolving dependencies, and maintaining a repository index. The workflow is always the same: update the index, install or upgrade, and autoremove the residue. The distinctions that matter for the LFCS exam are between update and upgrade (index vs packages), between upgrade and full-upgrade (removal policy), and between remove and purge (configuration files). The hold mechanism and the simulate flag are the safety tools that prevent a package operation from breaking a production system.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!