Packages and Updates

apt essentials

sudo apt update                 # refresh the package lists
apt list --upgradable           # what would change
sudo apt upgrade -y             # install updates
sudo apt full-upgrade -y        # also handles changed dependencies
sudo apt install nginx postgresql
sudo apt remove nginx           # keep config files
sudo apt purge nginx            # remove config too
sudo apt autoremove             # clean unused dependencies
apt show nginx                  # details and version
dpkg -L nginx                   # files a package installed

Automatic security updates

sudo apt install unattended-upgrades
sudo dpkg-reconfigure --priority=low unattended-upgrades

Security patches then install daily. Check /var/run/reboot-required: kernel updates need a reboot to take effect. Schedule reboots in a quiet window.

Adding a vendor repository

Some software (newer PostgreSQL, Docker, Node.js) comes from the vendor's own repository. The modern, safe pattern stores the signing key separately and scopes it to that repository only:

sudo install -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
echo "deb [signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(. /etc/os-release; echo $VERSION_CODENAME) stable" | sudo tee /etc/apt/sources.list.d/docker.list
sudo apt update

Only add repositories from vendors you trust: packages run as root during install.

Pinning and holding

sudo apt-mark hold postgresql-16   # never upgrade automatically
sudo apt-mark unhold postgresql-16

Hold databases and other stateful software so major upgrades happen when you plan them, after a backup.

Language packages are different

Do not install Python libraries with sudo pip. It can break system tools that depend on Python. Use a virtual environment per application:

python3 -m venv /srv/pandadev/.venv
/srv/pandadev/.venv/bin/pip install -r requirements.txt

Check yourself

• What is the difference between apt remove and apt purge?
• How do you know a reboot is needed after updates?
• Why should you never sudo pip install on a server?