Package Management: apt, snap & flatpak

On Windows you usually download an installer from a website. On Linux you install software from repositories: online collections of packages that your distribution builds, tests and signs. A package manager downloads the right package, checks its signature, installs everything it depends on, and later updates it along with the rest of the system.

This lesson teaches apt, Ubuntu's package manager, in detail, then shows the other systems you will meet: dpkg, snap, flatpak and dnf on Fedora.

Packages and repositories

A package is an archive containing a program's files plus information about it: version, description, and dependencies (other packages it needs). Debian and Ubuntu use .deb packages; Fedora and Red Hat use .rpm.

Ubuntu's repositories are split into components: main (supported by Canonical), universe (community maintained), restricted (proprietary drivers) and multiverse (software with licence restrictions). On Ubuntu 26.04 the list of repositories lives in /etc/apt/sources.list.d/ubuntu.sources, written in the newer deb822 format:

Types: deb
URIs: http://archive.ubuntu.com/ubuntu/
Suites: resolute resolute-updates resolute-backports
Components: main restricted universe multiverse
Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg

resolute is the code name of 26.04. Signed-By names the key used to check that packages really come from Ubuntu. Older systems used one-line entries in /etc/apt/sources.list; you will still see that format in old guides.

The everyday apt commands

sudo apt update
sudo apt upgrade
sudo apt install htop tree
sudo apt remove tree
sudo apt autoremove

Hit:1 http://archive.ubuntu.com/ubuntu resolute InRelease
Get:2 http://security.ubuntu.com/ubuntu resolute-security InRelease [126 kB]
Get:3 http://archive.ubuntu.com/ubuntu resolute-updates InRelease [126 kB]
Hit:4 http://archive.ubuntu.com/ubuntu resolute-backports InRelease
Fetched 252 kB in 1s (241 kB/s)
12 packages can be upgraded. Run 'apt list --upgradable' to see them.

The output above is from apt update. These five commands do different things, and mixing up the first two is the most common beginner error:

Always run apt update before installing or upgrading, so apt knows about the newest versions. Installing a package shows a summary first:

sudo apt install htop

Installing:
  htop

Summary:
  Upgrading: 0, Installing: 1, Removing: 0, Not Upgrading: 12
  Download size: 171 kB
  Space needed: 434 kB / 18.2 GB available
...

If more packages are needed, apt lists them and asks Continue? [Y/n]. Add -y to answer yes automatically in scripts.

Searching and inspecting

apt search "image viewer"
apt show nginx
apt list --installed | grep python3
apt list --upgradable

apt show prints the version, size, dependencies and a description. To find out where a package's files went, or which package owns a file, use the lower-level tool dpkg:

dpkg -L htop | head -n 3
dpkg -S /usr/bin/ssh

/.
/usr
/usr/bin
openssh-client: /usr/bin/ssh

dpkg installs and queries individual .deb files, but it does not download anything or resolve dependencies. If you download a .deb file from a vendor, install it with sudo apt install ./file.deb (the ./ tells apt it is a local file), so apt fetches any dependencies.

Adding a third-party repository

Some software, such as Docker or a newer Node.js, comes from the vendor's own repository. The modern, safe pattern has three steps: save the vendor's signing key into /etc/apt/keyrings, add a .sources file that names that key, then update.

sudo install -d -m 0755 /etc/apt/keyrings
curl -fsSL https://packages.example.com/key.gpg | sudo tee /etc/apt/keyrings/example.asc > /dev/null
sudo nano /etc/apt/sources.list.d/example.sources
sudo apt update

The .sources file contains Types, URIs, Suites, Components and Signed-By: /etc/apt/keyrings/example.asc, exactly like Ubuntu's own file. Because the key is tied to one repository, that vendor cannot sign packages that replace Ubuntu's. Always copy the exact URLs from the vendor's official documentation; adding a repository means trusting that vendor with root access to your machine.

Snap and flatpak

Snap (made by Canonical) and flatpak are "universal" package formats. An app arrives bundled with its own libraries and runs in a sandbox, so the same package works on many distributions and updates independently of the system. Ubuntu installs Firefox as a snap by default.

snap list
sudo snap install code --classic
sudo snap refresh

--classic gives the app normal access to your files instead of the strict sandbox (code editors need this). Snaps update themselves automatically in the background.

Flatpak is the format most other desktop distributions prefer, with apps from the Flathub store:

sudo apt install flatpak
flatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
flatpak install flathub org.gimp.GIMP

On servers, prefer apt packages: they are smaller, update with the rest of the system and are what documentation usually assumes.

Other distributions: dnf

Fedora, Red Hat Enterprise Linux, Rocky and AlmaLinux use .rpm packages and the dnf command. The ideas are the same:

dnf refreshes its package lists automatically, so there is no separate update step. Arch Linux uses pacman -S to install and pacman -Syu to update.

Common mistakes

• Running upgrade without update. apt only knows about old versions, so nothing new is installed.
• Using remove when you want a clean slate. Config files stay behind; use purge.
• Installing random .deb files or curl ... | sudo bash scripts from blogs. You are giving that code root. Use official repositories or the vendor's documented method.
• Interrupting an upgrade. Closing the terminal mid-upgrade can leave packages half-configured. If it happens, run sudo dpkg --configure -a.

Key points

• sudo apt update refreshes package lists; sudo apt upgrade installs newer versions.
• apt install, remove, purge and autoremove manage individual packages; apt search and apt show find and describe them.
• dpkg -L lists a package's files and dpkg -S finds which package owns a file.
• Ubuntu 26.04 uses APT 3.1: deb822 .sources files, Signed-By keys and apt history-* commands; apt-key is gone.
• Snap and flatpak bundle apps with their libraries; Fedora uses dnf with .rpm packages.

sudo apt update
apt list --upgradable
sudo apt install cowsay tree
dpkg -L cowsay | grep /usr/games
sudo apt purge cowsay
sudo apt autoremove

/usr/games
/usr/games/cowsay
/usr/games/cowthink