What a package manager is
A package manager installs, upgrades, removes, and queries software in a coordinated way. It knows what files belong to which package, what dependencies are required, and which repositories are trusted.
This is different from downloading random installers. A distribution's repositories are part of its security and stability model.
Repositories and dependencies
A repository is a signed collection of package metadata and package files. The package manager downloads metadata, resolves dependencies, checks trust, and then installs packages in the correct order.
Dependencies are other packages required for software to work. Removing a package may leave dependencies that are no longer needed; managers often provide autoremove or cleanup commands for that.
Updates, upgrades, and stability
Updating metadata is not the same as upgrading packages. On apt systems, apt update refreshes the package index; apt upgrade changes installed software. On rolling systems, partial upgrades can be dangerous because packages are expected to move together.
Stable distributions often backport security fixes without changing the upstream version number much. A package can look old but still contain security patches.
Package signatures and trust
Package signatures help confirm packages come from trusted maintainers or repositories. They do not prove software is bug-free, but they protect against many tampering and mirror-compromise scenarios.
Adding third-party repositories changes your trust model. A repository can supply updates for packages it owns and sometimes replace packages if priorities allow it.
How package formats differ
| Ecosystem | Low-level format | High-level manager | Examples |
|---|---|---|---|
| Debian family | .deb | apt | Debian, Ubuntu, Mint, Pop!_OS |
| RPM family | .rpm | dnf or zypper | Fedora, Rocky Linux, openSUSE |
| Arch family | .pkg.tar.zst | pacman | Arch, Manjaro |
| Alpine | .apk | apk | Alpine Linux |
apt/dpkg, dnf/rpm, pacman, zypper, and apk
High-level tools handle repositories and dependencies. Low-level tools inspect or install package files directly. Beginners should normally use the high-level tool for installation and the low-level tool for investigation.
| Manager | Distribution family | Common commands |
|---|---|---|
| apt / dpkg | Debian and Ubuntu | apt update, apt install, dpkg -L, dpkg -S |
| dnf / rpm | Fedora and RHEL-like | dnf upgrade, dnf install, rpm -ql, rpm -qf |
| pacman | Arch | pacman -Syu, pacman -S, pacman -Qs |
| zypper / rpm | openSUSE | zypper refresh, zypper update, zypper install |
| apk | Alpine | apk update, apk add, apk del, apk search |
Searching, removing safely, and cleaning caches
- Search before installing when you do not know the exact package name.
- Review removals before confirming; dependency removals can be surprising.
- Use autoremove-style cleanup only after reading what will be removed.
- Do not mix repositories from different distribution releases unless documentation explicitly supports it.
apt search nginx
sudo apt install nginxdnf info podman
sudo dnf install podmansudo pacman -Syu