dnf and rpm — RHEL-family package management · Linux

dnf is the high-level interface to the RPM package system on modern RHEL-family distributions. rpm is the low-level tool. RHEL 8 deprecated yum in favour of dnf; on RHEL 9 and later, dnf is the only high-level tool.

The day-to-day commands

Configuration changednf update + upgrade— dnf check-update lists available updates without installing them, and exits 100 when there are some — which is what you script against, not the text output. It is the long-standing yum-compatible spelling; dnf5 introduced check-upgrade as the newer name, so check-upgrade is the more modern command, not the older one. Add --security to restrict the list to security advisories. dnf upgrade then upgrades every installed package: read the output carefully — note packages being held back, packages being removed, and any GPG key warnings.

$ sudo dnf check-update; sudo dnf upgrade -y

...

Illustrative output

Read-only / Safednf search / info— dnf search <pattern> finds packages by name or description. dnf info <package> shows metadata: version, dependencies, size, description, maintainer. Use info before installing to confirm the package is what you expect.

$ dnf search web-server | head; dnf info nginx

...

Illustrative output

Configuration changednf install / remove— dnf install adds the package and its dependencies. dnf remove removes the package. dnf has no purge equivalent, and rpm -e is not one either: the rpm-spec manual states that a modified %config file is backed up with a .rpmsave suffix on erase, so removing the package deliberately LEAVES your edited configuration on disk. To actually clear it, list the config files with rpm -qc <package> BEFORE the removal, remove the package, then delete those paths and any .rpmsave files left beside them. Modern dnf includes automatic removal of unused dependencies.

$ sudo dnf install nginx; sudo dnf remove nginx

...

Illustrative output

Module streams

RHEL-family packages use modules for multiple versions:

Configuration changednf modules— dnf module list shows available module streams (e.g., nodejs 16, 18, 20). dnf module enable NAME:VERSION switches to that stream. Install with @NAME:VERSION syntax. Modules let the distribution ship multiple major versions without conflicts.

$ dnf module list; dnf module enable nodejs:18; sudo dnf install @nodejs:18

...

Illustrative output

Querying installed packages

Read-only / Saferpm queries— rpm -qa PATTERN lists installed packages matching the pattern. rpm -ql PACKAGE lists files installed by the package. rpm -qf PATH identifies the package owning the file. Three queries cover most production needs.

$ rpm -qa 'nginx*'; rpm -ql nginx; rpm -qf /etc/nginx/nginx.conf

...

Illustrative output

Read-only / Saferpm -V— rpm -V compares the installed files against the metadata in the rpm database: size, file digest, ownership, permissions, modification time, capabilities. Any deviation is reported. S = size differs, M = mode differs, 5 = digest differs, D = device differs, L = symlink path differs, U = owner differs, G = group differs, T = mtime differs, P = capabilities differ. A dot means that check passed; a ? means it could not be performed. The c prefix marks the file as a config file. Note that man 8 rpm words position 5 as 'digest (formerly MD5 sum)' — current RPM uses SHA-256 file digests, so reading a 5 as an MD5 collision risk is a decade out of date.

$ rpm -V nginx 2>&1 | head

S.5....T.  c /etc/nginx/nginx.conf\n..?

Illustrative output

Configuring repositories

Read-only / Safeyum.repos.d— Each repository is defined in /etc/yum.repos.d/<name>.repo with the [name], baseurl, gpgkey, enabled, and gpgcheck directives. RHEL-family distributions ship vendor-specific files; admins add custom files for local mirrors.

$ ls /etc/yum.repos.d/; cat /etc/yum.repos.d/rocky.repo 2>/dev/null | head -20

...

Illustrative output

A typical local-mirror.repo file has the following structure. The bracketed section name is the repository identifier, the baseurl points to the package source, enabled activates the repository, gpgcheck enforces signature verification, and gpgkey references the GPG key file or URL. The optional priority field (covered earlier in this lesson) controls preference.

dnf history and rollback

Configuration changednf history— dnf history list shows every dnf transaction: ID, command, date, package count, and result. dnf history undo <id> rolls back a transaction — useful when an upgrade introduced a regression. Note: not all transactions are reversible; RPM does not always keep the old package available.

$ dnf history list; sudo dnf history undo <id>

...

Illustrative output

Module streams and version pinning

Read-only / Safemodule stream info— Modules group related packages by major version. dnf module info NAME:STREAM shows the packages in that stream. To pin a host to a specific stream: dnf module enable NAME:STREAM (and use dnf install @NAME:STREAM).

$ dnf module list nginx; dnf module info nginx:1.24

...

Illustrative output

The day-to-day commands

Module streams

Querying installed packages

Configuring repositories

dnf history and rollback

Module streams and version pinning

Knowledge check