Step 21. Package Management — apt, Linux’s App Store

Level 0 — Understanding Computer Operation and Structure | Difficulty ★★☆☆☆ | Estimated time: 2 hours

Prerequisites: Step 20 complete. Work in the Ubuntu terminal inside your virtual machine (or WSL). An internet connection is required (the VM’s network must be on).

• What you need: an Ubuntu terminal, an internet connection.
• Caution: today you will actually install and remove programs — this is the first appearance of commands that change the system. Be sure to work in a practice Ubuntu (virtual machine or WSL).
• Caution: sudo makes its first appearance. When you type the password, not even asterisks appear on screen — that’s not a malfunction but a security design (explained in Section 2-4).

Think about how you install programs on Windows. Search → find the site → download → run the installer → next, next, next. And the dangers you learned in Step 16 — fake sites and repackaged installers — follow you around. Linux uses a completely different approach — there’s one official marketplace, and you fetch things with a single command. Today you learn its protagonist, apt.

In this chapter, read-only commands (apt list, apt show, etc.) were run and verified directly on Ubuntu 24.04, while the outputs of system-changing commands (install/remove) are marked as "output examples." The numbers and versions in the examples may differ from your environment.

1. Learning Objectives

By the end of this chapter, you will be able to:

• Explain the three concepts of package, repository, and dependency
• Query what’s installed and what’s available with apt list, apt search, and apt show
• Explain that sudo apt update is not "installing" but "refreshing the list," and use it as a pre-install habit
• Install and remove programs with sudo apt install / remove, and read dependencies on the install screen
• Explain what sudo means and why the password is invisible on screen

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

2-1. Packages — The Shipping Unit of Programs

A package is "a program + installation info + a list of accessories" wrapped into one. Think of a delivery box: the goods (the program), the invoice (version and maker info), and even an instruction sheet saying "for this item to work, you also need that one."

Its role is similar to Windows installers (.exe, .msi), but Linux packages differ in "where they come from." The repository in the next section is the heart of that difference.

2-2. Repositories — The Official Marketplace

A repository is an official server where packages are displayed. The marketplace run by Ubuntu holds tens of thousands of packages, each reviewed by the Ubuntu team. Your computer stores a copy of this marketplace’s catalog, and apt works from that catalog.

How big a difference is this from a security perspective: the Windows way is "wandering from shop to shop buying things" — the risk of a fake shop always follows. The marketplace way is "buying only from a managed official market" — the source is guaranteed. Of course, attacks targeting the marketplace itself (repository poisoning, uploading fake packages) exist, so "official marketplace = 100% safe" isn’t true either. But it’s a world with a far safer default. Section 7 revisits this topic.

2-3. Dependencies — A Chain of Accessories

Some programs don’t work alone. A graphics program needs "a component that opens image files," and that component needs yet another component. This relationship is called a dependency.

Ever seen an error on Windows like "this program requires .NET"? Linux’s apt solves this problem automatically. It reads a package’s accessory list, adds whatever is missing to the cart, and installs everything at once. In Section 3-4 you’ll watch that process with your own eyes.

2-4. sudo — A Temporary Administrator Card

sudo means "superuser do" — "run just this command as the administrator." Unlike Step 12, where you opened an entire administrator PowerShell, Linux stamps the administrator card on each individual command. Here, "administrator" means Linux’s supreme admin account, root (covered in depth in Step 24).

Why does installation need administrator privileges? Because programs go into shared system areas (/usr and the like). Changing public spaces — as opposed to your own home (home directory) — is something only the administrator can do. Thanks to this structure, regular users can’t carelessly change the system, whether by mistake or malice — separation of privileges, a fundamental security design.

Why the password is invisible: when sudo asks for your password, nothing at all appears on screen — not even asterisks. It’s a half-century-old Linux security tradition that hides even the character count from anyone watching over your shoulder. Your input is being registered — just type and press Enter.

3. Follow Along

3-1. What’s Installed Right Now — apt list

Before learning to install, let’s look at what’s on your computer right now. It’s a read-only command, so no sudo needed:

apt list --installed 2>/dev/null | head -8

Listing...
adduser/noble,now 3.137ubuntu1 all [installed,automatic]
adwaita-icon-theme/noble,now 46.0-1 all [installed,automatic]
apparmor/now 4.0.1really4.0.1-0ubuntu0.24.04.5 amd64 [installed,upgradable to: 4.0.1really4.0.1-0ubuntu0.24.04.7]
apport-core-dump-handler/noble-security,now 2.28.1-0ubuntu3.8 all [installed,upgradable to: 2.28.3-0ubuntu0.1]
apport-symptoms/noble,now 0.25 all [installed,automatic]
apport/noble-security,now 2.28.1-0ubuntu3.8 all [installed,upgradable to: 2.28.3-0ubuntu0.1]
appstream/noble,now 1.0.2-1build6 amd64 [installed,automatic]

(Verified 2026-09-09 on Ubuntu 24.04. The list and versions will differ in your environment.)

How to read the output: each line is one package, in the order name/release version architecture [status]. [installed,automatic] means "I was installed automatically as someone’s accessory" — a trace left by Section 2-3’s dependencies. [upgradable to: ...] is a signal that "a newer version is up on the marketplace."

Let’s count how many there are in total:

apt list --installed 2>/dev/null | wc -l

652

(Verified 2026-09-09. Your environment will differ.)

Even a brand-new Ubuntu you’ve installed nothing on already holds hundreds of packages — because the operating system itself is a combination of packages. For reference, the wc -l at the end is the "count lines" command, and 2>/dev/null is a device that hides the notice text (warning output) apt displays.

3-2. Search and Details — apt search / apt show

Before installing, let’s see what the marketplace has. Today’s install target is htop — a popular tool that shows the process world you tracked by command in Step 13 as a slick real-time display:

apt search --names-only "^htop$"

Sorting...
Full Text Search...
htop/noble 3.3.0-4build1 amd64
  interactive processes viewer

(Verified 2026-09-09.)

How to read it: the marketplace has htop, and its one-line description is "interactive processes viewer." --names-only "^htop$" is an option that finds only the one whose name is exactly htop. You can just type apt search htop, but you’ll get dozens of entries with htop somewhere in the name.

Now that we know the name, let’s see the details:

apt show htop

Package: htop
Version: 3.3.0-4build1
Priority: optional
Section: utils
Origin: Ubuntu
Maintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>
Original-Maintainer: Daniel Lange <DLange@debian.org>
Bugs: https://bugs.launchpad.net/ubuntu/+filebug
Installed-Size: 434 kB
Depends: libc6 (>= 2.38), libncursesw6 (>= 6), libnl-3-200 (>= 3.2.7), libnl-genl-3-200 (>= 3.2.7), libtinfo6 (>= 6)
Suggests: lm-sensors, lsof, strace
Homepage: https://htop.dev/

(Verified 2026-09-09.)

Hold on — look at the Depends line. It’s the accessory list: "for htop to work, it needs libc6, libncursesw6, libnl-3-200 …" This is Section 2-1’s "instruction sheet in the delivery box" and Section 2-3’s dependencies made real. When installing, apt reads this line and automatically adds any missing accessories to the cart. Origin: Ubuntu means "an official Ubuntu marketplace product."

3-3. Refreshing the Marketplace Catalog — apt update

The standard pre-install routine:

sudo apt update

Hit:1 http://kr.archive.ubuntu.com/ubuntu noble InRelease
Get:2 http://security.ubuntu.com/ubuntu noble-security InRelease
...
Reading package lists... Done

(Output example — since this command refreshes list files, it was not run in this chapter’s verification environment; we show the standard output form. Server addresses differ by environment.)

How to read the output: each line is a conversation with a repository (marketplace) server. It means "the list was freshly fetched" — nothing was installed. You’ve only picked up the store’s latest flyer. If this is your first sudo, it asks for your password, and nothing appearing on screen is normal (Section 2-4).

Why do it first: if the flyer is old, you’ll get "no such product" or receive a stale version. That’s why pre-install update is such a standard routine for Linux users that it’s memorized as a set: sudo apt update && sudo apt install program.

3-4. Installing — Watching Dependencies in the Flesh

sudo apt install htop

Reading package lists... Done
Building dependency tree... Done
The following NEW packages will be installed:
  htop libncursesw6
0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.
After this operation, 1500 kB of additional disk space will be used.
Do you want to continue? [Y/n]

(Output example — since installation changes the system, it was not verified in this chapter. The kind and number of accessories installed together differ by environment.)

Read the output closely:

• Building dependency tree — computing the dependency tree. The one from Section 2-3
• NEW packages ... htop libncursesw6 — you asked for one thing, htop, but it added an accessory. It’s libncursesw6 (the screen-drawing component) from Section 3-2’s Depends line. Automatic dependency resolution in the flesh!
• Do you want to continue? — a final confirmation. It shows you what and how much will be installed, then asks

Press Y (or just Enter) and the download and installation proceed automatically.

Why this matters for security: the habit of reading this screen — "it shows what’s being installed and asks for confirmation" — matters. If something odd is piggybacking on your request, this is where you catch it. And apt automatically verifies behind the scenes that packages are genuine (signature verification) — the "signing" concept from Step 9 is at work here too.

3-5. If You Forget sudo — A Friendly Error

Try it if you’re curious. It’s practice Ubuntu, after all:

apt install htop

E: Could not open lock file /var/lib/dpkg/lock-frontend - open (13: Permission denied)
E: Unable to acquire the dpkg frontend lock (/var/lib/dpkg/lock-frontend), are you root?

(Output example.)

The lesson in the error message: "Permission denied," and "are you root?" — Linux tells you exactly what’s wrong. When you meet this error, don’t panic — read it. Linux error messages mostly carry their own answers. "Permission denied means a permission problem → did I forget sudo?" Once this association circuit forms, half of Linux’s walls disappear.

3-6. Running It — Processes at a Glance

htop

A full screen of processes moves in real time. Up top, graphs of CPU and memory usage. The world you tracked by number in Step 13 now appears as a living dashboard.

Look around: select processes with ↑↓, and change the sort criterion with F6 (most CPU-hungry first, etc.). Quit with q.

Why do it: practitioners often fire up htop first thing when they connect to a server — it’s the at-a-glance summary of "what is this computer doing right now." The tool you installed today will serve you throughout your lab life.

3-7. Removal and Disk Check

⚠️ remove deletes a program from the system. Verify the exact name of what you’re removing before running it. Today we remove only the practice target we just installed (htop).

sudo apt remove htop

(Output example — it proceeds as a mirror image of installation, and after the confirmation question, htop is deleted. Type htop afterward and "command not found" confirms the removal.)

Note: remove deletes the program but leaves its configuration files; purge deletes the configuration too. For now, just remember "there are two levels."

Here’s how to see installation and removal’s effect on the disk:

df -h /

Filesystem      Size  Used Avail Use% Mounted on
/dev/sdd       1007G  2.6G  954G   1% /

(Verified 2026-09-09. Capacities differ completely by environment.)

How to read it: df is the command for checking disk headroom; -h is the option for "human-readable units." The order is Size (total), Used (in use), Avail (remaining), Use% (usage rate). When a virtual machine’s disk starts filling up, it leads to installation errors — you’ll meet this command again in Wall 5.

Make a prediction: if you reinstall the htop you just removed, will it be faster or slower than the first time? (Answer: generally faster. The downloaded package files are temporarily stored (cached) on your computer, so they don’t need to be fetched again. Install it yourself and feel the difference. htop is useful, so leave it installed this time.)

4. Missions & Exercises

Mission — Stocking Your Toolbox

Install three basic tools useful for security study on your own:

1. First check that tree (draws directories as tree diagrams), curl (a universal tool for talking to the internet), and git (a version control tool) are in the marketplace, like apt search --names-only "^tree$"
2. Install all three at once: sudo apt install tree curl git (multiple in one line works)
3. Run each one: tree ~ (a tree diagram of your home), curl --version, git --version
4. Confirm the three tools are registered in the installed list, like apt list --installed 2>/dev/null | grep tree

The answer isn’t written here — verify it in Section 5.

Exercises

Question 1. Explain the difference between apt update and apt upgrade using the "marketplace flyer" analogy. Why does update always come first?

Question 2. The output of sudo apt install htop said libncursesw6 would be installed along with htop. What is it, and where did apt learn about it?

Question 3. Why does installing a program require sudo? Explain how "what structure of Linux" keeps regular users from carelessly changing the system.

Question 4. State why the repository (official marketplace) approach is safer than the download-site approach, and name one risk that still remains.

apt search --names-only "^tree$"
sudo apt update && sudo apt install tree curl git
tree ~
curl --version | head -1
git --version
apt list --installed 2>/dev/null | grep -E "^(tree|curl|git)/"

6. Common Pitfalls & Fixes

Wall 1. I type the sudo password and nothing appears

Symptom: the password field looks frozen.
Cause: not a malfunction — a security design (Section 2-4). Even while you’re typing, the screen stays silent.
Fix: just type and press Enter. If it’s wrong, it asks again, so no worries.

Wall 2. "Package not found" errors

Symptom: something like E: Unable to locate package ....
Possible causes: ① a typo in the name ② a stale marketplace list ③ no package by that name.
Fix: ① find the exact name first with apt search, and ② run sudo apt update and try again. These two solve most cases.

Wall 3. apt says it’s locked

Symptom: Could not get lock, "used by another process," and the like.
Cause: two install operations are running at once — common when a background automatic update is running.
Fix: wait a few minutes and try again; it usually clears. Also check whether you’re running apt in several terminal windows simultaneously.

Wall 4. Errors saying there’s no internet

Symptom: can’t connect to the repository, something like Temporary failure in name resolution.
Cause: a VM network problem. The host is offline or there’s a VM network settings issue.
Fix: check from inside the VM with ping -c 3 8.8.8.8 (Linux ping! -c 3 means only three times). If that fails, check that the VM settings’ network is enabled as NAT.

Wall 5. Not-enough-space errors

Symptom: a low disk space message.
Cause: the virtual disk is starting to fill up — happens as installations accumulate.
Fix: check with Section 3-7’s df -h, and free space with sudo apt clean (cleans the downloaded package cache). Too many snapshots also eat space, so tidy up old ones.

7. Summary

Today’s Concepts

Today’s Commands

More Important Than Commands: The Instinct

Safety of the installation path — the official marketplace approach structurally reduces the classic trap of fake download sites. And sudo — hands-on training in the principle of least privilege: "privileges only for the commands that need them." Every security tool you’ll meet from now on arrives in your hands through this one line (sudo apt install).

Remember two more things. First, today’s apt belongs to the Ubuntu family; other Linuxes have cousins like dnf and pacman, and Windows’ winget and language-specific tools (pip, npm) are all the same idea — learn apt once and they all look like relatives. Second, the marketplace approach’s only weakness is "if the marketplace is poisoned, everyone is poisoned." Supply chain attacks that plant malicious code in famous packages have actually happened, and the signature verification apt quietly performed today is exactly that line of defense. "When you meet an unfamiliar tool, apt search first; before installing, update first; after installing, verify by running it first" — with these three moves, you’ll almost never get stuck over a tool in Linux.

Once every box is checked, Step 21 is complete.