zypper, dnf and apt compared: a package cheat sheet

The cheat sheet

Every row does the same job in all three columns. Replace pkg with a package name. Commands that change the system need sudo; searching and listing do not. Fedora 41 and newer ship dnf5, which accepts the commands below; the output looks different from the older dnf.

On older Fedora releases with dnf4, versionlock needs the versionlock plugin package. References: zypper usage, dnf5 documentation and apt(8).

Two rows of the table, run for real. Owner lookups work without sudo. On Debian the dpkg database still records the old /bin paths, so ask for /bin/bash, not /usr/bin/bash:

$ rpm -qf /usr/bin/ssh /usr/bin/zypper
openssh-clients-10.5p1-1.1.x86_64
zypper-1.14.98-1.3.x86_64

$ dpkg -S /usr/bin/bash; dpkg -S /bin/bash
dpkg-query: no path found matching pattern /usr/bin/bash
bash: /bin/bash

$ zypper --no-refresh info podman
Information for package podman:
-------------------------------
Repository     : Main Repository (OSS)
Name           : podman
Version        : 6.0.2-1.1
Arch           : x86_64
Vendor         : openSUSE
Installed Size : 55.1 MiB
Installed      : Yes
Status         : up-to-date
Source package : podman-6.0.2-1.1.src
Upstream URL   : https://github.com/containers/podman
Summary        : Daemon-less container engine for managing containers, pods and images

Upgrading: dup, up and patch

openSUSE has three update commands, and which one is right depends on the distribution:

• zypper dup (dist-upgrade) makes the system match the repositories: it upgrades, downgrades, removes and replaces packages as needed. This is the update command on Tumbleweed, because every snapshot can rename or drop packages.
• zypper up (update) installs newer versions of installed packages and nothing else. Right for Leap, wrong for Tumbleweed.
• zypper patch installs only official patches, the security and bug fixes the Leap maintainers released. It is the most conservative choice for a Leap server.

After an update, zypper ps -s lists running programs that still use deleted files, which tells you which services to restart, and zypper needs-rebooting tells you whether the kernel or another core library changed. Moving Leap to its next minor or major release is a separate, planned step; follow the release notes of the new version.

Try before you change anything

All three can show what they would do without doing it. Use this before a big update or when a removal suggests taking half the system with it:

sudo zypper dup --dry-run      # openSUSE: short form -D
sudo dnf upgrade --assumeno    # Fedora: resolves, prints the plan, answers no
apt -s upgrade                 # Debian/Ubuntu: -s simulates, no sudo needed

The simulation really needs no sudo; as a normal user on Debian 12:

$ apt -s upgrade 2>/dev/null | tail -4
Building dependency tree...
Reading state information...
Calculating upgrade...
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.

zypper is stricter: zypper dup --dry-run as a normal user on Tumbleweed answered Root privileges are required to run this command., so run its dry run with sudo.

Read the list of packages to be removed first. That is where surprises live. If a flag in a long command is unclear, the shell command explainer breaks it down.

Flatpak and immutable systems

Desktop apps such as a browser or an office suite are often easier as Flatpaks: the same command works on every distribution, flatpak install flathub org.mozilla.firefox, and updates come with flatpak update. For server software, containers play the same role; the quadlet examples show how to run them with podman and systemd.

Immutable variants (openSUSE Aeon and MicroOS, Fedora Silverblue and CoreOS) do not change the running system at all. On the openSUSE ones, sudo transactional-update dup prepares a new snapshot and the update takes effect at the next reboot. Fedora's atomic variants use rpm-ostree instead.

Common mistakes

Frequently asked questions