Debian and Ubuntu Package Management Cheat Sheet

Keeping the operating system up to date is one of the most important routine administration tasks on any Debian-based system. Regular package updates help ensure that security vulnerabilities are patched, software bugs are fixed, compatibility is maintained, and the system continues to receive supported versions of core tools and applications. Whether you are managing a personal workstation, a development environment, a server, or a container image, understanding how Debian and Ubuntu package management works allows you to update systems safely, install software consistently, and recover more confidently when package issues occur.

This guide covers package management on Debian-based distributions such as Debian, Ubuntu, Linux Mint, Kali, and similar systems. The examples use sudo, which is the normal Ubuntu style. If you are already logged in as root, omit sudo; a root shell prompt is commonly shown as #.

1. Big picture: APT, apt, apt-get, apt-cache, and dpkg

Debian-based systems use .deb packages. At the lowest practical level, dpkg installs, removes, queries, and manages individual .deb packages already available to the system. It does not automatically fetch packages from repositories or resolve missing dependencies from the network.

APT, the Advanced Package Tool, sits above dpkg. It knows about configured repositories, package indexes, versions, dependencies, upgrades, and package downloads. Tools such as apt, apt-get, and apt-cache are front ends to APT.

Use apt for normal interactive command-line administration. It has clearer output, progress bars, and convenient commands such as apt search, apt show, apt list –installed, and apt list –upgradable.

Use apt-get and apt-cache for scripts, Dockerfiles, CI pipelines, and automation. The apt command is designed for people at a terminal and its behavior may change between versions, while apt-get and apt-cache are better suited to stable, repeatable automation.

Use dpkg when you need to inspect the package database, query files owned by installed packages, install a local .deb, or recover from lower-level package problems. For normal installs from repositories, prefer apt or apt-get because they handle dependencies.

2. Command comparison

Task	Interactive command	Script-friendly command
Update package index	sudo apt update	sudo apt-get update
Upgrade packages	sudo apt upgrade	sudo apt-get upgrade
Upgrade with dependency changes/removals	sudo apt full-upgrade	sudo apt-get dist-upgrade
Install a package	sudo apt install nginx	sudo apt-get install nginx
Reinstall a package	sudo apt reinstall nginx	sudo apt-get install –reinstall nginx
Remove a package	sudo apt remove nginx	sudo apt-get remove nginx
Remove package and system config files	sudo apt purge nginx	sudo apt-get purge nginx
Remove unused dependencies	sudo apt autoremove	sudo apt-get autoremove
Satisfy dependency expressions	sudo apt satisfy “curl, ca-certificates”	sudo apt-get satisfy “curl, ca-certificates”
Search packages	apt search nginx	apt-cache search nginx
Show package details	apt show nginx	apt-cache show nginx
List installed packages	apt list –installed	dpkg –list
List upgradable packages	apt list –upgradable	apt-get -s upgrade
Edit package sources	sudo apt edit-sources	edit /etc/apt/sources.list or files under /etc/apt/sources.list.d/

 

3. Safe everyday workflow

For a normal workstation or server maintenance session:

sudo apt update apt list –upgradable sudo apt upgrade sudo apt autoremove

 

For a fuller system upgrade where package removals or new dependency changes may be required:

sudo apt update sudo apt full-upgrade sudo apt autoremove

 

Always read the package summary before confirming. Pay special attention to packages listed under REMOVED, kernel packages, desktop environment packages, database packages, and anything that looks business-critical.

4. Best practices

1. Run apt update before installing or upgrading. It refreshes local package metadata from configured repositories. Without it, APT may make decisions using stale package information.
2. Prefer apt for humans and apt-get for automation. For example, use apt install nginx at a terminal, but use apt-get install -y nginx in Dockerfiles or CI scripts.
3. Avoid blind -y on important systems. -y is useful for automation, but on servers you should usually inspect the proposed changes first.
4. Use dry runs before risky operations:

apt-get -s upgrade apt-get -s dist-upgrade apt-get -s remove nginx

 

5. Be careful with full-upgrade and dist-upgrade. These can remove packages when needed to resolve dependency changes. They are useful, but you must review the removal list.
6. Do not mix Debian and Ubuntu repositories. Also avoid mixing Debian stable, testing, and unstable unless you understand apt pinning and dependency recovery.
7. Do not install random .deb files with dpkg -i. Prefer repository packages. If you must install a local .deb, use sudo apt install ./package.deb where possible so APT can handle dependencies.
8. Back up repository configuration before editing sources:

sudo cp /etc/apt/sources.list /etc/apt/sources.list.bak.$(date +%F)

 

9. Do not edit or delete files under /var/lib/dpkg/ manually. That directory is the package database.
10. After kernel, libc, OpenSSL, or systemd updates, check whether a reboot or service restart is required. On Ubuntu, tools such as needrestart may help identify affected services.
11. Use apt autoremove carefully. It removes packages installed automatically as dependencies and no longer required. Review the list before confirming.
12. Keep production servers conservative. Test upgrades on a staging host, VM snapshot, or backup before changing critical systems.

5. APT configuration and logs

APT configuration is commonly stored in /etc/apt/apt.conf, /etc/apt/apt.conf.d/, and repository source files such as /etc/apt/sources.list and /etc/apt/sources.list.d/*.list or *.sources.

List APT configuration snippets:

ls -l /etc/apt/apt.conf.d/

 

Edit a local APT configuration file:

sudoedit /etc/apt/apt.conf.d/99local

 

Example setting to reduce recommended packages in minimal systems:

APT::Install-Recommends “false”;

 

Use this carefully. Disabling recommended packages globally can produce smaller systems, but it can also omit useful helper packages.

APT logs are usually under /var/log/apt/.

View package install and upgrade history:

less /var/log/apt/history.log

 

View detailed terminal output from APT operations:

less /var/log/apt/term.log

 

Search recent APT logs for errors:

grep -i “error” /var/log/apt/term.log

 

6. apt commands

apt search

Searches package names and descriptions in the local APT metadata. Run sudo apt update first if you want fresh results.

apt search nginx apt search “web server”

 

Example use case: find the package name before installing a service.

apt search nfs

 

apt show

Displays package details such as version, repository, dependencies, download size, installed size, description, and homepage.

apt show nginx apt show nfs-common

 

Use this before installing unfamiliar packages.

apt install

Installs a package and its required dependencies from configured repositories.

sudo apt install nginx sudo apt install curl git vim

 

Install a specific version, if that version is available from your configured repositories:

apt policy nginx sudo apt install nginx=<version-shown-by-apt-policy>

 

Install a local .deb file while allowing APT to resolve dependencies:

sudo apt install ./example-package.deb

 

apt reinstall

Reinstalls an already installed package. This is useful if package-owned files were accidentally removed or corrupted.

sudo apt reinstall nginx

 

apt remove

Removes the package binaries and package-owned files, but usually leaves system configuration files behind.

sudo apt remove nginx

 

Use remove when you may reinstall the package later and want to keep configuration.

apt purge

Removes the package and its system configuration files. It does not remove personal data in users’ home directories.

sudo apt purge nginx

 

Purge a package that has already been removed but left configuration files behind:

sudo apt purge nginx

 

apt autoremove

Removes packages that were automatically installed as dependencies and are no longer needed.

sudo apt autoremove

 

Purge unused dependency packages and their system config files:

sudo apt autoremove –purge

 

apt list

Lists packages known to APT. This can be a very large output.

apt list

 

Search within the list:

apt list | grep nginx

 

apt list –installed

Lists installed packages.

apt list –installed apt list –installed | grep nginx

 

apt update

Downloads package indexes and metadata from configured repositories. It does not upgrade packages by itself.

sudo apt update

 

Typical output includes words such as:

• Hit: the local metadata is already current for that source.
• Get: new metadata was downloaded.
• Ign: the source was ignored, often because it was not needed or because of a transient mirror behavior.
• Err: an error occurred and should be investigated.

apt list –upgradable

Lists installed packages for which newer versions are available according to the refreshed package index.

apt list –upgradable

 

Use this after sudo apt update.

apt upgrade

Upgrades installed packages where APT can do so without removing installed packages. With the modern apt command, new packages may be installed if needed to satisfy dependencies, but installed packages are not removed.

sudo apt upgrade

 

Automatically answer yes to prompts:

sudo apt upgrade -y

 

Best practice: avoid -y on important machines unless you have already reviewed the proposed changes.

apt full-upgrade

Performs a more complete system upgrade. It can install new packages and remove existing packages when required to resolve dependencies.

sudo apt full-upgrade

 

This is commonly used for larger update sets, kernel-related dependency transitions, and release-transition situations. Always review removals before confirming.

apt satisfy

Installs packages needed to satisfy dependency strings. This is more advanced and is useful when working with dependency expressions similar to build dependencies.

sudo apt satisfy “curl, ca-certificates”

 

Example with a conflict expression:

sudo apt satisfy “nginx” “Conflicts: apache2”

 

Use carefully because it can install or remove packages to satisfy the requested expression.

View configured repositories

There is not a single universal apt list-repositories command. Use one of these approaches.

Show package sources and candidates known to APT:

apt policy

 

Show uncommented repository lines from traditional source-list files:

grep -R –no-filename ‘^[[:space:]]*[^#[:space:]]’ /etc/apt/sources.list /etc/apt/sources.list.d/ 2>/dev/null

 

List source files:

ls -l /etc/apt/sources.list /etc/apt/sources.list.d/

 

apt edit-sources

Opens repository configuration in your default editor.

sudo apt edit-sources

 

After editing sources, always refresh package metadata:

sudo apt update

 

7. apt-get commands

apt-get install

Installs one or more packages. This is the script-friendly equivalent of apt install.

sudo apt-get install nfs-common sudo apt-get install curl git vim

 

Script example:

sudo apt-get update sudo apt-get install -y nfs-common

 

apt-get install –no-install-recommends

Installs required dependencies but skips packages marked as recommended. This is common in Docker images or minimal servers where size matters.

sudo apt-get install –no-install-recommends nginx

 

Dockerfile-style example:

RUN apt-get update \     && apt-get install -y –no-install-recommends ca-certificates curl \     && rm -rf /var/lib/apt/lists/*

 

Best practice: only use this when you understand what recommended packages you are excluding.

apt-get install –allow-downgrades

Allows a downgrade when you explicitly request an older version or your repository policy selects one. This is a dangerous option and should be used only for a specific recovery or rollback scenario.

Check available versions:

apt-cache policy nginx

 

Downgrade to a specific available version:

sudo apt-get install –allow-downgrades nginx=<older-version-shown-by-policy>

 

Best practice: document why the downgrade is needed and consider placing the package on hold afterward if you must prevent it from immediately upgrading again.

apt-get build-dep

Installs the packages required to build a source package.

sudo apt-get build-dep nginx

 

This usually requires source repositories, such as deb-src entries, to be enabled.

apt-get update

Refreshes package indexes from configured repositories.

sudo apt-get update

 

Use it before apt-get upgrade, apt-get dist-upgrade, and most scripted installs.

apt-get upgrade

Upgrades installed packages without removing packages or installing packages that are not already installed. Packages that require dependency changes may be held back.

sudo apt-get upgrade

 

Dry run:

apt-get -s upgrade

 

Automatically answer yes:

sudo apt-get upgrade -y

 

apt-get dist-upgrade

The apt-get equivalent of apt full-upgrade. It can handle changing dependencies and may remove packages if required.

sudo apt-get dist-upgrade

 

Dry run first:

apt-get -s dist-upgrade

 

apt-get source

Downloads the source package into the current directory. It does not install a binary package into the dpkg database.

apt-get source nginx

 

Download a specific available source version:

apt-get source nginx=<version>

 

This normally requires matching deb-src source entries.

apt-get download

Downloads a binary .deb package into the current directory without installing it.

apt-get download nginx

 

Example: download a package for inspection:

mkdir /tmp/pkg-inspect cd /tmp/pkg-inspect apt-get download nfs-common

 

apt-get changelog

Displays the changelog for a package.

apt-get changelog nginx

 

Use this to review recent package changes before or after an upgrade.

apt-get clean

Clears downloaded package files from the local APT archive cache.

sudo apt-get clean

 

Useful when you need to reclaim disk space.

apt-get autoclean

Removes only cached package files that can no longer be downloaded. It is less aggressive than clean.

sudo apt-get autoclean

 

apt-get autoremove

Removes automatically installed dependencies that are no longer needed.

sudo apt-get autoremove

 

Purge unused dependencies and their config files:

sudo apt-get autoremove –purge

 

8. apt-cache commands

apt-cache reads APT metadata but does not change the system. Because it reads the local cache, run sudo apt update first if you need current results.

apt-cache search

Search package names and descriptions.

apt-cache search nginx apt-cache search “NFS client”

 

apt-cache show

Show package details.

apt-cache show nginx apt-cache show nfs-common

 

apt-cache policy

Show installed version, candidate version, and repository version priorities.

apt-cache policy nginx

 

This is especially useful before installing a specific version or diagnosing why APT wants to install a particular package version.

9. dpkg commands

dpkg –list

Lists packages known to the dpkg database.

dpkg –list

 

Filter for a package:

dpkg –list | grep nginx

 

Common status examples:

• ii: package is selected for install and is installed.
• rc: package was removed but configuration files remain.
• un: package is unknown or not installed.

Purge packages left in rc state:

dpkg –list | awk ‘/^rc/ {print $2}’ sudo apt purge $(dpkg –list | awk ‘/^rc/ {print $2}’)

 

Review the list first before running the purge command.

dpkg -i

Installs a local .deb file. This does not fetch missing dependencies by itself.

sudo dpkg -i ./example-package.deb

 

If dependencies are missing, repair with APT:

sudo apt –fix-broken install

 

Where possible, prefer:

sudo apt install ./example-package.deb

 

dpkg -r

Removes a package but keeps system configuration files.

sudo dpkg -r nginx

 

For normal removal, prefer:

sudo apt remove nginx

 

dpkg -P

Purges a package and removes its system configuration files.

sudo dpkg -P nginx

 

For normal purging, prefer:

sudo apt purge nginx

 

dpkg -L

Lists files installed by a package.

dpkg -L nginx

 

Example: find where a package installed configuration files:

dpkg -L nginx | grep /etc

 

dpkg -S

Finds which installed package owns a file.

dpkg -S /usr/sbin/nginx

 

dpkg -s

Shows installed package status and metadata from the local dpkg database.

dpkg -s nginx

 

dpkg –configure -a

Configures unpacked but unconfigured packages. This is useful after an interrupted package operation.

sudo dpkg –configure -a

 

Follow with:

sudo apt –fix-broken install

 

10. Common recipes

Install and verify a service package

sudo apt update sudo apt install nginx systemctl status nginx apt show nginx

 

Remove a service but keep configuration

sudo apt remove nginx

 

Remove a service and its system configuration

sudo apt purge nginx sudo apt autoremove –purge

 

Upgrade safely on a production server

sudo apt update apt list –upgradable apt-get -s upgrade sudo apt upgrade

 

For a fuller upgrade:

apt-get -s dist-upgrade sudo apt full-upgrade

 

Repair an interrupted installation

sudo dpkg –configure -a sudo apt –fix-broken install sudo apt update

 

Find why a package version is being selected

apt-cache policy nginx apt show nginx

 

Keep a minimal Docker image small

RUN apt-get update \     && apt-get install -y –no-install-recommends curl ca-certificates \     && apt-get clean \     && rm -rf /var/lib/apt/lists/*

 

Download a package without installing it

mkdir ~/deb-downloads cd ~/deb-downloads apt-get download nfs-common

 

Check package logs after a failed upgrade

less /var/log/apt/history.log less /var/log/apt/term.log grep -i “error” /var/log/apt/term.log

 

11. Troubleshooting notes

If apt update fails, check the exact repository line, network connectivity, DNS, proxy configuration, GPG key errors, and whether the distribution release is still supported.

If a package operation was interrupted, start with:

sudo dpkg –configure -a sudo apt –fix-broken install

 

If packages are held back, inspect the reason:

apt list –upgradable apt-cache policy <package-name> apt-get -s dist-upgrade

 

If APT says another process has the lock, do not immediately delete lock files. First check whether another package process is running:

ps aux | grep -E ‘apt|dpkg’

 

Wait for legitimate package processes to finish. Removing locks while apt or dpkg is active can damage package state.

12. Quick reference

# Refresh package metadata sudo apt update # Search and inspect packages apt search nginx apt show nginx apt-cache policy nginx # Install, reinstall, remove, purge sudo apt install nginx sudo apt reinstall nginx sudo apt remove nginx sudo apt purge nginx # Upgrade apt list –upgradable sudo apt upgrade sudo apt full-upgrade # Clean up sudo apt autoremove sudo apt autoremove –purge sudo apt-get clean sudo apt-get autoclean # Script-friendly install sudo apt-get update sudo apt-get install -y nfs-common # Dry runs apt-get -s upgrade apt-get -s dist-upgrade # dpkg queries dpkg –list dpkg –list | grep nginx dpkg -L nginx dpkg -S /usr/sbin/nginx # Repair sudo dpkg –configure -a sudo apt –fix-broken install # Logs less /var/log/apt/history.log less /var/log/apt/term.log

 

Conclusion

Debian and Ubuntu provide a reliable package management ecosystem built around dpkg, APT, apt, apt-get, and related tools such as apt-cache. For everyday interactive use, apt is usually the most convenient tool, while apt-get remains especially useful for scripts, automation, Dockerfiles, and repeatable administrative workflows. The best practice is to refresh package metadata before upgrading, review available updates before applying them, use upgrade for routine maintenance, reserve full-upgrade or dist-upgrade for dependency-changing upgrades, and carefully review any packages that APT proposes to remove. By following a safe workflow and understanding what each command does, administrators can keep Debian-based operating systems current, stable, and easier to maintain.

 

Check out our other Cheat Sheets and Blogs and if you would like us to write a cheat sheet for you, for FREE, (and we find it suitable) Contact Us.