Executive Summary

Objective: Give you a working command of APT (Advanced Package Tool): which distributions ship it by default, how to get a real APT environment when your host distro uses something else, and a full reference of the subcommands and CLI options you will actually reach for.

Target audience: Network and security practitioners who live in Linux VMs, jump boxes, containers, and lab builds, and who want the reference without the fluff.

APT is the dependency-resolving front end for dpkg, the low-level Debian package installer. dpkg installs a single .deb file. APT figures out what else that file needs, pulls it all from signed repositories, verifies it, and hands the ordered set to dpkg. That split matters later when we talk about running APT on a distro that was not built around it.

Prerequisites and Architecture

• A shell account with sudo rights. Read-only commands (search, show, list, policy) do not need root.
• Outbound HTTP/HTTPS to your mirrors. Behind a proxy, set Acquire::http::Proxy in /etc/apt/apt.conf.d/.
• Basic comfort with the Linux CLI.

The moving parts

Which Distros Default to APT

If the distro descends from Debian, it uses APT. That covers a large share of what you will meet in the field.

And the ones that do not use APT by default:

Running APT on a Distro That Does Not Use It

Option 1: Distrobox (recommended for daily use)

Goal: A Debian or Ubuntu environment with real APT that shares your home directory and can export apps to the host menu.

Action: Install Distrobox and a container engine with your native package manager, then create the box.

# Fedora / RHEL family
sudo dnf install distrobox podman

# Arch family
sudo pacman -S distrobox podman

# openSUSE
sudo zypper install distrobox podman

# Create and enter a Debian box
distrobox create --name deb --image debian:stable
distrobox enter deb

# Inside the box, APT works normally
sudo apt update
sudo apt install nmap dnsutils

To surface a tool from the box on the host, run distrobox-export --bin /usr/bin/nmap (CLI) or distrobox-export --app <name> (GUI) from inside the box.

Option 2: A throwaway container

Goal: APT for a quick test or a single tool, nothing persistent.

podman run -it --rm debian:stable bash
# or
docker run -it --rm ubuntu:24.04 bash

apt update && apt install -y curl

Option 3: debootstrap chroot

Goal: A full Debian root filesystem on disk, no container engine required. Useful on minimal servers and for building images.

# Install debootstrap with the host package manager
sudo dnf install debootstrap        # Fedora
sudo pacman -S debootstrap          # Arch
sudo zypper install debootstrap     # openSUSE

# Build a Debian stable root and enter it
sudo debootstrap stable /srv/debian http://deb.debian.org/debian
sudo systemd-nspawn -D /srv/debian
# or: sudo chroot /srv/debian /bin/bash

apt update

Option 4: Native APT packages (know the limits)

Option 5: Windows and macOS

• Windows: wsl --install -d Ubuntu from an elevated PowerShell gives you a full Ubuntu userland with APT.
• macOS: There is no APT for macOS. Use Homebrew natively (brew install), or run a Debian/Ubuntu container or VM (Docker Desktop, Podman, OrbStack, Lima, UTM) when you specifically need APT.

Command translation cheat sheet

If all you want is the equivalent command on your native manager, use this instead of installing anything.

Step-by-Step: Using APT

Step 1: Refresh the package indexes

Goal: Sync the local list of available packages with the repositories. Nothing is installed or upgraded.

sudo apt update

Verification: The last line reads either All packages are up to date. or N packages can be upgraded. Run 'apt list --upgradable' to see them.

Step 2: Upgrade what is installed

Goal: Apply available updates.

# Safe: upgrades packages, installs new dependencies, never removes anything
sudo apt upgrade

# Full: also removes packages when that is required to complete the upgrade
sudo apt full-upgrade

# See what is pending first
apt list --upgradable

full-upgrade is the same operation as apt-get dist-upgrade. Use it for kernel transitions and release upgrades, and read the removal list before you say yes.

Step 3: Find and inspect packages

apt search wireshark              # search names and descriptions
apt show tshark                   # version, size, dependencies, description
apt policy tshark                 # installed vs candidate version, and which repo wins
apt list --installed              # everything installed
apt list 'python3-*'              # glob match
apt list -a tshark                # all available versions
apt depends tshark                # what it needs
apt rdepends libpcap0.8           # what needs it

Step 4: Install

sudo apt install nmap                         # one package
sudo apt install nmap tcpdump mtr-tiny        # several
sudo apt install ./fortinet-tool_1.0_amd64.deb   # a local .deb, with dependencies resolved
sudo apt install nginx=1.24.0-2ubuntu7        # a specific version
sudo apt install nginx/noble-backports        # from a specific suite
sudo apt install --no-install-recommends vim  # skip recommended extras
sudo apt install --only-upgrade openssl       # upgrade if present, do not install if absent
sudo apt reinstall openssh-server             # put the packaged files back

Step 5: Remove and clean up

sudo apt remove nginx              # remove binaries, keep config in /etc
sudo apt purge nginx               # remove binaries and config
sudo apt autoremove                # remove orphaned dependencies
sudo apt autoremove --purge        # same, and purge their config (also: apt autopurge)
sudo apt clean                     # empty /var/cache/apt/archives
sudo apt autoclean                 # remove only cached .debs that can no longer be downloaded

Step 6: Hold a package at its current version

Goal: Stop an upgrade from touching something you have validated, such as a kernel, a database, or a VPN client.

sudo apt-mark hold linux-image-generic
apt-mark showhold
sudo apt-mark unhold linux-image-generic

# Mark a package as manually installed so autoremove leaves it alone
sudo apt-mark manual libpcap0.8
apt-mark showmanual

Step 7: Add a third-party repository the current way

Goal: Add a vendor repo with a scoped signing key. apt-key is deprecated and has been removed from current Debian releases, so do not follow guides that still use it.

# 1. Store the vendor key in its own keyring
sudo install -d -m 0755 /etc/apt/keyrings
curl -fsSL https://repo.example.com/key.gpg | \
  sudo gpg --dearmor -o /etc/apt/keyrings/example.gpg

# 2. Define the repo in deb822 format
sudo tee /etc/apt/sources.list.d/example.sources > /dev/null <<'EOF'
Types: deb
URIs: https://repo.example.com/apt
Suites: stable
Components: main
Architectures: amd64
Signed-By: /etc/apt/keyrings/example.gpg
EOF

# 3. Refresh
sudo apt update

The legacy one-line equivalent, which you will still see everywhere:

deb [arch=amd64 signed-by=/etc/apt/keyrings/example.gpg] https://repo.example.com/apt stable main

On APT 3.0 and later, sudo apt modernize-sources converts your existing .list files to deb822 .sources files and keeps backups.

Step 8: Unattended and scripted runs

Goal: No prompts, no hung pipelines. Use apt-get in scripts because its interface is stable.

export DEBIAN_FRONTEND=noninteractive
sudo -E apt-get update
sudo -E apt-get -y \
  -o Dpkg::Options::="--force-confdef" \
  -o Dpkg::Options::="--force-confold" \
  full-upgrade
sudo -E apt-get -y --no-install-recommends install nmap tcpdump

--force-confold keeps your existing config files when a package ships a new default, which is what you want on a box you have already hardened.

CLI Reference: Subcommands

apt versus apt-get versus apt-cache

Rule of thumb: apt at the keyboard, apt-get and apt-cache in anything automated. APT itself prints a warning about its unstable CLI when you pipe its output.

CLI Reference: Options and Flags

Everyday flags

Repair and resolver control

Override flags (know what you are doing)

Configuration on the command line

Useful -o examples:

# Force IPv4 when a mirror has a broken AAAA record
sudo apt -o Acquire::ForceIPv4=true update

# One-off proxy
sudo apt -o Acquire::http::Proxy="http://10.0.10.5:3128" update

# Keep existing config files during an upgrade
sudo apt-get -y -o Dpkg::Options::="--force-confold" upgrade

# Dump the entire effective configuration
apt-config dump

Verification and Validation

apt --version                 # confirm the APT release you are on
sudo apt update               # should end with no errors or warnings
sudo apt-get check            # verifies the dependency tree is consistent
apt list --upgradable         # pending updates
apt policy openssl            # confirm where a package comes from
grep -A3 "Start-Date" /var/log/apt/history.log | tail -20   # recent transactions

A healthy apt policy looks like this. The *** marks the installed version and the number is the pin priority of each source:

openssl:
  Installed: 3.0.13-0ubuntu3.5
  Candidate: 3.0.13-0ubuntu3.5
  Version table:
 *** 3.0.13-0ubuntu3.5 500
        500 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 Packages
        100 /var/lib/dpkg/status
     3.0.13-0ubuntu3 500
        500 http://archive.ubuntu.com/ubuntu noble/main amd64 Packages

Troubleshooting and Gotchas

Could not get lock /var/lib/dpkg/lock-frontend

Another APT or dpkg process is running, very often unattended-upgrades right after boot. Find it and wait for it. Do not delete lock files while the process is alive.

ps aux | grep -E 'apt|dpkg|unattended' | grep -v grep
sudo systemctl status unattended-upgrades

dpkg was interrupted, or unmet dependencies

A previous run died mid-transaction. Finish configuration first, then let APT repair the dependency tree.

sudo dpkg --configure -a
sudo apt --fix-broken install

NO_PUBKEY or repository is not signed

The repo key is missing, expired, or the Signed-By path is wrong. Re-download the vendor key into /etc/apt/keyrings/, confirm the path in the .sources or .list file matches, and confirm the key file is world readable (chmod 0644). Do not reach for --allow-unauthenticated.

Hash Sum mismatch

Stale or corrupted index files, commonly caused by a caching proxy or an inspection device in the path. Clear the lists and pull them again.

sudo rm -rf /var/lib/apt/lists/*
sudo apt update

Repository changed its Suite or Codename value

Happens when a release moves from testing to stable or a vendor renames a suite. Accept it once:

sudo apt update --allow-releaseinfo-change

The following packages have been kept back

A plain upgrade will not remove packages, and phased updates on Ubuntu can also hold things back for a few days. Check with apt list --upgradable, then use sudo apt full-upgrade if the removal list is acceptable, or install the named package directly.

apt: command not found on a non-Debian host

Expected. Go back to the section on running APT on a distro that does not use it and pick the container or chroot route.

Quick Reference

sudo apt update && sudo apt full-upgrade     # patch the box
apt search <term>                            # find
apt show <pkg>  /  apt policy <pkg>          # inspect
sudo apt install <pkg>                       # install
sudo apt install ./file.deb                  # install a local .deb
sudo apt purge <pkg> && sudo apt autopurge   # remove completely
sudo apt-mark hold <pkg>                     # freeze a version
sudo apt -s full-upgrade                     # dry run
sudo apt --fix-broken install                # repair
sudo apt clean                               # reclaim disk