Package management on Linux: APT, DNF, pacman and XBPS explained

| Distribution | Package format | Manager | |---|---|---| | Debian, Ubuntu | .deb | APT | | Fedora, Rocky, AlmaLinux | .rpm | DNF | | Arch | .pkg.tar.zst | pacman | | Void | .xbps | XBPS |

APT (Advanced Package Tool) works with .deb packages. DNF (Dandified YUM) uses RPM packages. XBPS (X Binary Package System) is known for speed. pacman fits the minimalist philosophy of Arch.

Steps: installing software with APT

These steps apply to Debian and Ubuntu (e.g., Ubuntu 24.04 LTS with APT 2.7.14).

Step 1: Update the package index

sudo apt update

This synchronizes the local package index with the repositories. Without this step, APT does not know which new versions are available.

Step 2: Search for a package

apt search firefox

This shows all packages whose name or description contains the search term.

Step 3: Show package information

apt show firefox

This shows the version number, dependencies, size and description.

Step 4: Install the package

sudo apt install firefox

APT automatically scans which dependencies are missing and installs them at the same time.

Steps: installing software with DNF

These steps apply to Fedora 40 and Rocky Linux 9 (DNF 4.14.0).

Step 1: Update the package index

sudo dnf check-update

This checks which updates are available.

Step 2: Search for a package

dnf search git

Step 3: Install the package

sudo dnf install git

DNF resolves dependencies automatically and confirms what is being added before installation.

Steps: installing software with pacman

These steps apply to Arch Linux (pacman 6.1.0).

Step 1: Synchronize the databases

sudo pacman -Sy

Step 2: Install a package

sudo pacman -S htop

Step 3: Update the entire system

sudo pacman -Syu

This combines synchronization, update and installation of new versions.

Steps: installing software with XBPS

These steps apply to Void Linux (XBPS 0.59).

Step 1: Synchronize the repositories

sudo xbps-install -S

Step 2: Install a package

sudo xbps-install vim

Step 3: Update the system

sudo xbps-update

Verification

Check whether the installation succeeded:

which firefox
git --version
htop --version
vim --version

Each command shows the path or version of the installed program.

How package management works

When you give an installation command, the system consults one or more repositories. These repositories contain a catalog of available software with metadata such as version numbers, descriptions and dependencies. The system automatically scans which dependencies are missing and installs them along with the package. This prevents "dependency hell" — a situation where software does not work because components are missing or incompatible.

Additionally, the system signs packages with cryptographic keys. Only trusted software is installed. This protects against polluted repositories or compromised mirrors.

Updates and security

Updates are a core function of package management. Instead of manually downloading new versions, you give one command:

sudo apt upgrade
sudo dnf upgrade
sudo pacman -Syu
sudo xbps-update

The system compares the current installation with the package sources and installs new versions, taking dependencies into account.

Many security vulnerabilities are fixed through software updates. Regularly updating keeps a system protected against known vulnerabilities. Automation via cron jobs or systemd timers makes this process more efficient.

Graphical tools

For less experienced users, graphical interfaces exist. Ubuntu's Software Center and KDE's Discover offer a clickable environment to search, install and remove software. In the background, they use the same systems as APT or DNF.

Package management in containers

Package management also works inside containers. Distrobox makes it possible to run Linux distributions as containers on, for example, a Chromebook. Within each container you install packages as you would on a regular system, depending on the distribution running in the container. Kontainer, a graphical tool, manages these Distrobox containers.

Package management on specific devices

The reMarkable tablet uses package management via reManager, a desktop application that uses the Vellum package manager to manage mods. It offers install, upgrade, and removal with automatic dependency resolution. This demonstrates that package management extends to niche hardware, where it is equally important for stability.

Package management in development environments

Typesetter, an editor for the Typst markup language, has a built-in package management system for Typst packages. Typst combines LaTeX and Markdown; package management makes it easy to use templates, styles, or functions from others, similar to LaTeX classes or Markdown extensions.

Package management on macOS

Homebrew offers similar functionality on macOS. Commands like `brew install wget` or `brew upgrade` manage software via the terminal. Although macOS has no built-in system like Linux distributions, Homebrew shows that the concept is universal in system administration.

Word confusion: package management in healthcare

The word "package management" has a different meaning outside IT. The National Health Care Institute (Zorginstituut Nederland) uses it for rulings on which care is or is not reimbursed from the basic health insurance package. The institute names four package criteria: effectiveness, cost-effectiveness, necessity, and feasibility. On 20 March 2023, it published the report "Package management in practice 4" on the boundaries of the care life cycle. On 20 December 2023, it presented the assessment framework "Care that must necessarily be insured". The KNMP reports that codeine was the first product to which this framework was applied.

This confusion is relevant because the same word has completely different implications. For this article, however, it is strictly about the technical meaning: managing software packages on Linux systems.

Adding package sources

Sometimes you need software that is not in the standard repositories. For APT, you add a repository:

sudo add-apt-repository ppa:deadsnakes/ppa
sudo apt update

For DNF:

sudo dnf config-manager --add-repo https://example.com/repo.repo

Always check the reliability of external repositories. An unsecured repository can deliver malicious packages.

Removing packages

Removal works with the same systems:

sudo apt remove firefox
sudo dnf remove git
sudo pacman -R htop
sudo xbps-remove vim

APT and DNF also offer options to remove unused dependencies along with them:

sudo apt autoremove
sudo dnf autoremove

Common problems

Problem: "Unable to locate package" with APT The package index is outdated or the repository is missing. Run `sudo apt update`. If the package still is not there, check whether you have added the correct repository.

Problem: "Failed to download metadata for repo" with DNF Network issue or an unreachable mirror. Check the connection and try `sudo dnf clean all` followed by `sudo dnf check-update`.

Problem: "error: failed to commit transaction (conflicting files)" with pacman A file is provided by two packages. Check which package owns the file with `pacman -Qo /path/to/file` and remove the conflicting package.

Problem: "Transaction aborted due to unresolved dependencies" with XBPS A dependency is missing or conflicts. Run `sudo xbps-install -S` to synchronize the repositories and try again.

The power of package management lies not in the individual commands, but in the consistency that the system enforces — every installation, update, and removal follows the same rules, whether you manage a server, laptop, or container.