Package cache, cleanup, and rollback · Linux

The package cache — every .deb or .rpm ever downloaded — is one of the largest consumers of disk on a host. The discipline is to keep what you need for rollback, evict what you do not.

The cache directories

Read-only / Safecache size— /var/cache/apt/archives/ holds every .deb apt has downloaded. /var/cache/dnf/ holds the equivalent for dnf. Both can grow to many GB; both should be cleaned periodically.

$ du -sh /var/cache/apt/archives/ /var/cache/dnf/

...

Illustrative output

apt cache management

Configuration changeapt clean / autoclean— apt clean removes every .deb from /var/cache/apt/archives/. apt autoclean removes only packages that can no longer be downloaded (older versions, deprecated). Use autoclean for production — keeps the current version available for reinstall, evicts old ones.

$ sudo apt clean; sudo apt autoclean

...

Illustrative output

dnf cache management

Configuration changednf clean— dnf clean all removes the metadata cache and downloaded packages. /etc/dnf/dnf.conf may have keepcache=1 — by default dnf deletes downloaded packages after install. To keep them for rollback: keepcache=1.

$ sudo dnf clean all; ls /etc/dnf/dnf.conf | xargs grep -E 'keepcache|metadata'

...

Illustrative output

Removing unused dependencies

Always simulate first and read the list:

Read-only / Safeautoremove (dry run)— Simulate the removal without touching anything. apt-get -s and dnf --assumeno both print the full list and exit. Read every line before you go any further; this is the step that catches a kernel package or a shared library another team depends on.

$ apt-get -s autoremove; dnf autoremove --assumeno

...

Illustrative output

Protect anything on that list you still need, then remove:

Data-loss riskautoremove (after review)— autoremove removes packages currently flagged auto-installed with no remaining reverse dependency. The flag records how a package was installed, not whether you now rely on it, so apt-mark manual is how you correct that record. Run under change control, never with -y in a cron job or playbook.

$ sudo apt-mark manual <pkg>; sudo apt autoremove

...

Illustrative output

autoremove is not safe to automate

man 8 apt says it plainly: “You should check that the list does not include applications you have grown to like even though they were once installed just as a dependency of another package.”

The auto-installed flag is a record of history, not of need. A package pulled in years ago as a dependency of a metapackage that has since been removed is still flagged auto-installed, and autoremove will happily take it - along with everything that depended only on it. Kernel packages turn up on the list routinely.

An unattended apt autoremove -y on a production host can therefore remove the companion packages of the running kernel, or a library another team’s service links against, with no change record and no health gate. On an air-gapped or version-pinned host you may not be able to put it back.

The rule: dry-run, read the list, apt-mark manual anything you still want, then remove - under change control, one wave of hosts at a time.

Rolling back an upgrade

Data-loss riskrollback— dnf history undo rolls back a transaction if the old package is still available in the cache or repository. If dnf history undo fails, the rollback path is via filesystem snapshot or backup. apt does not have a built-in rollback — use a snapshot or backup for rollbacks.

$ dnf history list openssh-server; sudo dnf history undo <id>

...

Illustrative output

Old kernels

Read-only / Safeinstalled kernels— List the installed kernels. Production hosts typically keep the current kernel and one previous version (for fallback); older versions can be removed to free space. unattended-upgrade on Debian-family removes unused kernels by default (Remove-Unused-Kernel-Packages true).

$ dpkg -l linux-image-* 2>/dev/null | grep ^ii; rpm -q kernel

...

Illustrative output

The cache directories

apt cache management

dnf cache management

Removing unused dependencies

Rolling back an upgrade

Old kernels

Knowledge check