LFCS 50 🐧 Package Management — DNF - KandZ

⏱️ Estimated read: 10 min | |

DNF (Dandified YUM) is the package manager for RHEL, Fedora, Rocky Linux, AlmaLinux, and other RPM-based distributions. It replaced YUM as the default in Fedora 22 and became the standard in RHEL 8 and later . The relationship between the two commands is simpler than it appears: on RHEL 8 and 9, yum is an alias for dnf . The yum command still works because Red Hat maintains it for compatibility, but every yum invocation is executed by DNF underneath.

The technical improvements over YUM are real. DNF uses libsolv, a C-based dependency solver, instead of YUM’s aging Python 2 logic. It supports parallel package downloads, has a smaller memory footprint, and provides a transaction history with rollback via dnf history undo . For the LFCS exam, the Operations Deployment domain (25% of the exam) includes “search, install, verify, and maintain software packages or repositories,” and DNF is one of the two package managers explicitly listed in the course outlines .

Key point: DNF is the default package manager on RHEL-based systems; yum is an alias for dnf on RHEL 8 and 9; the core workflow is dnf check-update, dnf upgrade, dnf install, dnf remove, and dnf history for auditing and rollback.

Why DNF replaced YUM

The dependency solver problem. YUM’s dependency resolution was slow and sometimes produced cryptic conflicts. DNF uses libsolv, a satisfiability solver that resolves complex dependency graphs with precision . When a package has multiple possible providers or conflicting version constraints, DNF finds a valid solution rather than guessing.

The performance problem. YUM downloads packages sequentially. DNF downloads them in parallel, which reduces the time spent waiting for large package sets . The metadata synchronization is also faster because DNF caches the repository data more efficiently.

The history and rollback problem. YUM’s history was limited. DNF records every transaction with an ID, the packages involved, and the command that triggered it. dnf history undo <ID> reverses a specific transaction, which is the closest thing to an undo button in package management . This is useful when an update introduces a regression and you need to revert it quickly.

The Python 3 problem. YUM was built on Python 2, which reached end-of-life in 2020. DNF was built for Python 3 from the start, which means it is actively maintained and integrates with modern automation tooling .

a. Refreshing metadata and checking for updates

DNF does not require an explicit update command to refresh metadata before installing. It synchronizes the repository metadata automatically when needed, based on the metadata_expire setting in /etc/dnf/dnf.conf. However, dnf check-update is the explicit command to see which installed packages have newer versions available.

# Check for available updates without installing them
# Returns exit code 100 if updates are available, 0 if not
dnf check-update

# Refresh the metadata cache manually
# Useful when the cache is stale or a new repository was added
sudo dnf makecache

# List all enabled repositories
dnf repolist

# List all repositories including disabled ones
dnf repolist --all

The check-update command is the script-friendly way to determine whether maintenance is needed. The exit code of 100 when updates exist allows a monitoring system to trigger alerts without parsing output .

b. Installing, removing, and querying packages

The installation commands mirror APT’s workflow, but the package names and repository structure differ.

# Install a package and resolve its dependencies
sudo dnf install nginx

# Install multiple packages in one transaction
sudo dnf install nginx postgresql redis

# Install a package group (bundles related packages)
sudo dnf group install "Development Tools"

# Install a local RPM file, downloading dependencies from repos
sudo dnf install ./package.rpm

# Remove a package and its unused dependencies
sudo dnf remove nginx

# Search for packages by name or description
dnf search nginx

# Show detailed package information
dnf info nginx

# Find which package provides a specific file
dnf provides /usr/sbin/nginx

# List installed packages
dnf list --installed

# List packages with available updates
dnf list --upgrades

The dnf provides command is the answer to “which package do I need to install to get this file?” It searches the repository metadata for a package that owns the specified path . This is the correct tool when a script fails with “command not found” and you need to identify the package that provides it.

The dnf group commands manage package groups, which bundle multiple packages for a common purpose. dnf group list shows the available groups, and dnf group info "Group Name" shows which packages the group includes .

c. Upgrading, history, and security updates

dnf upgrade installs newer versions of all installed packages. Unlike APT, DNF does not have a separate “safe” and “complete” upgrade command; dnf upgrade handles both. When a kernel package is updated, DNF installs a new kernel rather than replacing the existing one, which is why multiple kernels remain available at the boot menu .

# Upgrade all installed packages to their latest versions
sudo dnf upgrade

# Upgrade a specific package only
sudo dnf upgrade nginx

# Upgrade only security-related packages
sudo dnf upgrade --security

# Upgrade to the last security erratum (minimal update)
sudo dnf upgrade-minimal --security

# Show the transaction history
dnf history

# Show details of a specific transaction
dnf history info 5

# Undo a specific transaction
sudo dnf history undo 5

The --security flag is the production maintenance command. It applies only the updates that fix security vulnerabilities, reducing the risk of a functional regression from a non-security update . The upgrade-minimal variant goes further and installs the minimum version that fixes the vulnerability, rather than the latest version.

dnf history undo is the rollback mechanism. It reverses the transaction with the given ID, which is useful when an update breaks something. The rollback is not always possible for every package—kernel updates and packages with strict dependency chains may not revert cleanly—but it is the first tool to try.

Complete Example Session

The following session checks for updates, installs a package, holds it, and uses the history to audit the transaction.

# ============================================
# PART 1: CHECK FOR UPDATES
# ============================================
# List packages with available updates
dnf check-update
# Exit code 100 means updates are available
echo $?

# ============================================
# PART 2: INSTALL A PACKAGE
# ============================================
# Install nginx and resolve its dependencies
sudo dnf install nginx

# ============================================
# PART 3: VERIFY THE INSTALLATION
# ============================================
# Confirm the package is installed and show its version
dnf list --installed | grep nginx
# Output: nginx.x86_64  1:1.20.1-16.el9  @appstream

# ============================================
# PART 4: HOLD A PACKAGE (EXCLUDE FROM UPGRADES)
# ============================================
# Add nginx to the exclude list in dnf.conf
# This prevents nginx from being upgraded
echo "exclude=nginx*" | sudo tee -a /etc/dnf/dnf.conf

# ============================================
# PART 5: AUDIT THE TRANSACTION
# ============================================
# Show the history of package operations
dnf history
# Output lists the install transaction with an ID

# Show details of the most recent transaction
dnf history info last

# ============================================
# PART 6: REMOVE AND CLEAN UP
# ============================================
# Remove the package
sudo dnf remove nginx

# Remove the exclude line (if you want to re-enable upgrades)
sudo sed -i '/exclude=nginx/d' /etc/dnf/dnf.conf

The six parts cover the update check, the installation, the verification, the exclude mechanism, the history audit, and the removal. What the session demonstrates is that DNF’s exclude directive in /etc/dnf/dnf.conf is the pinning mechanism (the equivalent of APT’s apt-mark hold), and dnf history is the audit trail that records every transaction.

Quick Reference

Core Commands

Command	Effect
`dnf check-update`	Check for available updates (exit 100)
`dnf upgrade`	Upgrade all installed packages
`dnf upgrade --security`	Apply security updates only
`dnf install pkg`	Install package and dependencies
`dnf remove pkg`	Remove package and unused deps
`dnf search term`	Search for packages
`dnf info pkg`	Show package details
`dnf provides /path`	Find package owning a file
`dnf list --installed`	List installed packages
`dnf history`	Show transaction history

Group and Module Commands

Command	Effect
`dnf group list`	List available groups
`dnf group install "Group"`	Install a package group
`dnf module list`	List modules
`dnf module install name:stream`	Install a module stream

Configuration and Exclusion

Mechanism	Detail
Main config	`/etc/dnf/dnf.conf`
Repository config	`/etc/yum.repos.d/*.repo`
Exclude packages	`exclude=pkg*` in `dnf.conf`
Disable excludes temporarily	`--disableexcludes=all`

History and Rollback

Command	Effect
`dnf history`	List all transactions
`dnf history info ID`	Details of a transaction
`dnf history undo ID`	Reverse a transaction

Best Practices

✅ Do This:

# Check for security updates specifically
sudo dnf upgrade --security

# Use history to audit and roll back
sudo dnf history undo 5

# Exclude packages that must not upgrade
echo "exclude=nginx*" | sudo tee -a /etc/dnf/dnf.conf

# Find the package that provides a missing command
dnf provides /usr/bin/missing-tool

❌ Don’t Do This:

# Assume yum and dnf are different on RHEL 8+
yum install nginx  # actually runs dnf

# Upgrade without checking the transaction first
sudo dnf upgrade  # review with --assumeno or check-update first

# Forget that kernel updates install a new kernel
# (old kernel remains at boot menu)

Common Pitfalls

Pitfall	Why It Happens	Fix
Command not found after install	Wrong package name	`dnf provides /path/to/file`
Package keeps upgrading despite exclude	Exclude not in `dnf.conf`	Add `exclude=pkg` to config
History undo fails	Kernel or dependency chain	Manual downgrade or restore backup
Module stream conflict	Multiple streams enabled	`dnf module reset pkg`
Metadata stale	Cache expired	`sudo dnf makecache`

Real-World Examples

1. Install a package

sudo dnf install nginx

2. Upgrade security only

sudo dnf upgrade --security

3. Search for a package

dnf search nginx

4. Find package owning a file

dnf provides /usr/sbin/nginx

5. Install a group

sudo dnf group install "Development Tools"

6. Exclude a package

echo "exclude=postgresql*" | sudo tee -a /etc/dnf/dnf.conf

7. Check history

dnf history

8. Undo a transaction

sudo dnf history undo 3

9. List repositories

dnf repolist

10. Remove a package

sudo dnf remove nginx

Visual

DNF vs YUM on RHEL 8/9

┌──────────────────────────────────────────────┐
│  User types: yum install nginx               │
│         │                                    │
│         ▼                                    │
│  yum is a symlink/alias for dnf             │
│         │                                    │
│         ▼                                    │
│  DNF executes the install                    │
│  (libsolv solver, parallel downloads)        │
└──────────────────────────────────────────────┘

Update Check Flow

┌──────────────────────────────────────────────┐
│  dnf check-update                            │
│         │                                    │
│         ▼                                    │
│  Exit code 100?                              │
│  ├─ YES → updates available                  │
│  └─ NO (0) → system up to date               │
└──────────────────────────────────────────────┘

History and Rollback

┌──────────────────────────────────────────────┐
│  dnf upgrade                                 │
│         │                                    │
│         ▼                                    │
│  Transaction recorded with ID                │
│         │                                    │
│         ▼                                    │
│  dnf history                                 │
│  → shows ID, command, date, packages         │
│         │                                    │
│         ▼                                    │
│  dnf history undo <ID>                       │
│  → reverses the transaction                  │
└──────────────────────────────────────────────┘

Exclude vs Hold

┌──────────────────────────────────────────────┐
│  APT: apt-mark hold pkg                      │
│  DNF: exclude=pkg* in /etc/dnf/dnf.conf      │
│                                              │
│  Both prevent the package from upgrading     │
│  while allowing other packages to proceed    │
└──────────────────────────────────────────────┘

Summary

Item	Value
DNF	Default package manager on RHEL-based systems
`yum` on RHEL 8+	Alias for `dnf`
Dependency solver	`libsolv` (C-based)
Update check	`dnf check-update` (exit 100)
Upgrade	`dnf upgrade`
Security upgrade	`dnf upgrade --security`
Install	`dnf install pkg`
Remove	`dnf remove pkg`
Find provider	`dnf provides /path`
History	`dnf history`
Rollback	`dnf history undo ID`
Exclude	`exclude=pkg*` in `dnf.conf`

Key takeaways:

DNF is the package manager; yum is an alias. On RHEL 8 and 9, yum and dnf are the same command. The distinction is historical, not functional .
dnf check-update returns exit code 100 when updates are available. This is the script-friendly way to detect whether maintenance is needed .
dnf upgrade --security applies only security errata. This is the production maintenance command that reduces the risk of functional regressions .
dnf provides finds the package that owns a file. When a command is missing, this is the tool that identifies what to install .
dnf history undo reverses a transaction. Every operation is recorded with an ID, and the undo command reverts the packages to their previous versions .
Exclusion is the pinning mechanism. Adding exclude=pkg* to /etc/dnf/dnf.conf prevents upgrades for matching packages, equivalent to APT’s hold .
Package groups bundle related packages. dnf group install "Development Tools" installs the entire group in one transaction .

Remember: DNF is the RPM-based counterpart to APT. The workflow is the same: check for updates, upgrade, install, remove, and audit. The differences are in the command names (dnf vs apt), the exclusion mechanism (exclude= in a config file vs apt-mark hold), and the history system (dnf history undo vs the absence of a native rollback in APT). On RHEL 8 and later, yum and dnf are interchangeable at the command line, but the underlying engine is DNF. For the LFCS exam, know the core commands, the history mechanism, and the difference between a regular upgrade and a security-only upgrade.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!