apt vs dnf cheat sheet

Everyday

Task	Debian / Ubuntu	RHEL / Rocky / Fedora
Refresh metadata	`apt update`	`dnf makecache`
Upgrade everything	`apt upgrade`	`dnf upgrade`
Upgrade, allowing removals	`apt full-upgrade`	`dnf upgrade --allowerasing`
Install	`apt install nginx`	`dnf install nginx`
Install a local file	`apt install ./app.deb`	`dnf install ./app.rpm`
Remove	`apt remove nginx`	`dnf remove nginx`
Remove with config	`apt purge nginx`	`dnf remove nginx` (configs saved as `.rpmsave`)
Remove unused deps	`apt autoremove`	`dnf autoremove`
Remove unused deps and their config	`apt autopurge`	`dnf autoremove` (configs saved as `.rpmsave`)
Reinstall	`apt reinstall nginx`	`dnf reinstall nginx`

Update one-liners

Three levels, from most to least change. Run them as root or with sudo in front of each command.

Goal	Debian / Ubuntu	RHEL / Rocky / Fedora
Full update and cleanup	`apt update && apt full-upgrade -y && apt autopurge -y`	`dnf upgrade --refresh -y && dnf autoremove -y`
Safe: nothing removed	`apt update && apt upgrade -y`	`dnf upgrade --refresh -y`
Safest: security fixes only	`apt update && unattended-upgrade -v`	`dnf upgrade-minimal --security --refresh -y`

bash

# Debian / Ubuntu: full update, removes packages that are no longer needed
sudo apt update && sudo apt full-upgrade -y && sudo apt autopurge -y

# safe: upgrades and installs new dependencies, never removes anything
sudo apt update && sudo apt upgrade -y

# safest: only what unattended-upgrades is configured for (security, by default)
sudo apt update && sudo unattended-upgrade --dry-run -v   # see what it would do
sudo apt update && sudo unattended-upgrade -v

# RHEL family
sudo dnf upgrade --refresh -y && sudo dnf autoremove -y
sudo dnf upgrade --refresh -y
sudo dnf updateinfo list --security     # what security fixes are pending
sudo dnf upgrade-minimal --security --refresh -y

Command	Installs new packages	Removes packages	Upgrades
`apt-get upgrade`	No	No	Only what needs nothing new; holds back the rest
`apt upgrade`	Yes, new dependencies	No	Most packages
`apt full-upgrade`	Yes	Yes, when needed to resolve conflicts	Everything
`apt autopurge`	No	Unused dependencies, with their config files	Nothing
`dnf upgrade`	Yes	Only packages that are obsoleted	Everything
`dnf upgrade --security`	Yes	Same	Packages with security advisories, to their latest version
`dnf upgrade-minimal --security`	Yes	Same	Only to the lowest version that fixes each advisory

unattended-upgrade comes from the unattended-upgrades package; its origins are set in /etc/apt/apt.conf.d/50unattended-upgrades, and by default it only allows security updates (plus ESM on Ubuntu Pro). dnf --security needs advisory metadata in the repositories: RHEL, Rocky, Alma and Fedora updates publish it; CentOS Stream and many third-party repos don’t, so there it finds nothing.

Find packages

Task	Debian / Ubuntu	RHEL / Rocky / Fedora
Search	`apt search nginx`	`dnf search nginx`
Details	`apt show nginx`	`dnf info nginx`
Available versions	`apt list -a nginx` / `apt policy nginx`	`dnf list --showduplicates nginx`
Installed packages	`apt list --installed`	`dnf list --installed`
Pending upgrades	`apt list --upgradable`	`dnf check-update`
Which package has a file (installed)	`dpkg -S /usr/sbin/nginx`	`rpm -qf /usr/sbin/nginx`
Which package provides a file (any)	`apt-file search bin/dig`	`dnf provides '*/bin/dig'`
Files in a package	`dpkg -L nginx`	`rpm -ql nginx`
Dependencies	`apt depends nginx`	`dnf repoquery --requires nginx`
What needs it	`apt rdepends nginx`	`dnf repoquery --whatrequires nginx`

Versions

Task	Debian / Ubuntu	RHEL / Rocky / Fedora
Install a version	`apt install nginx=1.24.0-2`	`dnf install nginx-1.24.0`
Hold a version	`apt-mark hold nginx`	`dnf versionlock add nginx`
Release it	`apt-mark unhold nginx`	`dnf versionlock delete nginx`
List holds	`apt-mark showhold`	`dnf versionlock list`
Downgrade	`apt install nginx=<older>`	`dnf downgrade nginx`

History

Task	Debian / Ubuntu	RHEL / Rocky / Fedora
What changed	`/var/log/apt/history.log`, `/var/log/dpkg.log`	`dnf history list`
Details of one transaction	`zgrep -A5 'Start-Date' /var/log/apt/history.log*`	`dnf history info 42`
Undo a transaction	not built in	`dnf history undo 42`

Repositories

Task	Debian / Ubuntu	RHEL / Rocky / Fedora
Repo files	`/etc/apt/sources.list.d/*.sources`	`/etc/yum.repos.d/*.repo`
List enabled repos	`apt-cache policy`	`dnf repolist`
Keys	`/etc/apt/keyrings/`, `Signed-By:`	`rpm --import`, `gpgkey=`
Enable a repo for one command	n/a	`dnf --enablerepo=crb install pkg`
Extra packages	universe / backports	EPEL: `dnf install epel-release`
Module streams	n/a	`dnf module list nodejs` (RHEL 8–9)

Verify and clean

Task	Debian / Ubuntu	RHEL / Rocky / Fedora
Check installed files	`debsums -c`	`rpm -Va`
Fix a broken install	`apt -f install`, `dpkg --configure -a`	`dnf distro-sync`
Clear the cache	`apt clean`	`dnf clean all`
Security updates only	`unattended-upgrade`	`dnf upgrade --security`
Reboot needed?	`[ -f /var/run/reboot-required ]`	`dnf needs-restarting -r` (exit code 1 means yes)

dnf4 and dnf5

Fedora 41 and newer use dnf5; RHEL, Rocky and Alma 8 and 9 use dnf4. The commands in this sheet work on both, with these differences:

Command	dnf4 (RHEL family)	dnf5 (Fedora 41+)
`dnf history`	Lists transactions	Needs a subcommand: `dnf history list` (works on both)
`dnf versionlock`	Needs `python3-dnf-plugin-versionlock`	Built in; new config file format
`dnf needs-restarting -r`	Needs `dnf-plugins-core`	Built in; `-r` is the default and kept for compatibility
`dnf check-update`	Native	Alias for `dnf check-upgrade`
`dnf updateinfo`	Native	Alias for `dnf advisory`
`dnf upgrade-minimal`	Native	Alias for `dnf upgrade --minimal`
`dnf repolist`	Native	Alias for `dnf repo list`
`dnf makecache`	Always refreshes	Skips the download when metadata is fresh; add `--refresh` to force it

Keep in mind

In scripts, use apt-get and apt-cache: plain apt warns that its output may change. dnf is fine in scripts.
apt upgrade never removes packages; full-upgrade and autopurge may. Read the list before you answer yes, or drop -y the first time on a server.
After a kernel or libc update, check whether a reboot is needed (see the table above) before you call the update done.
On RHEL 9 and Fedora, yum is an alias for dnf.