Ubuntu Update: apt update and apt upgrade Do Two Different Jobs

On Ubuntu, updating is two commands, not one. sudo apt update refreshes the local list of what versions are available - it downloads nothing but the catalog. sudo apt upgrade then installs the newer versions of packages you already have. Run them together: sudo apt update && sudo apt upgrade. The single most common mistake is running only upgrade and wondering why nothing new appears - because without a fresh update, apt is upgrading against a stale catalog and believes everything is current.

Table of contents

• update refreshes the list, upgrade installs
• upgrade versus full-upgrade
• Cleaning up afterwards
• Upgrading to a new Ubuntu release
• Unattended upgrades for security patches
• How this fits the rest of the stack
• FAQ

update refreshes the list, upgrade installs

The two verbs are easy to blur, so hold them apart:

sudo apt update     # refresh the package index - what versions exist
sudo apt upgrade    # install newer versions of installed packages

apt update contacts the repositories and updates the local database of available packages and versions. It changes nothing that is installed; it just learns what is out there. After it runs, apt may tell you N packages can be upgraded.

apt upgrade reads that database and installs the newer versions. If the database is stale because you skipped update, upgrade has nothing new to do. This is why the canonical incantation chains them:

sudo apt update && sudo apt upgrade -y

The && runs upgrade only if update succeeded, and -y answers yes to the confirmation. That one line is the whole routine for keeping a box current.

upgrade versus full-upgrade

There are two upgrade modes, and the difference is about removal:

sudo apt upgrade         # never removes packages
sudo apt full-upgrade    # will remove packages if needed to complete upgrades

Plain upgrade is conservative: it will install new versions but never remove an installed package to do it. If an upgrade would require removing something - a common situation when dependencies change between versions - it holds that package back and tells you it was kept back.

full-upgrade (the old name was dist-upgrade) is allowed to remove packages to satisfy the new dependency graph. You need it when packages are being held back and you actually want the newer versions. It is safe for routine use on a normal desktop or server, but read what it proposes to remove before confirming - the removal list is the whole point of the distinction.

Cleaning up afterwards

Upgrades leave debris - old kernels, orphaned dependencies, cached .deb files. Two commands keep the disk tidy:

sudo apt autoremove      # remove packages nothing needs anymore
sudo apt autoclean       # remove cached package files no longer downloadable

autoremove is the important one. Kernel upgrades in particular pile up - Ubuntu keeps old kernels so you can boot a previous one, but over months they fill /boot, and a full /boot makes the next upgrade fail. Running autoremove after upgrades clears the ones you no longer need.

A complete routine, then, is:

sudo apt update && sudo apt upgrade -y && sudo apt autoremove -y

That refreshes, upgrades, and cleans in one line. It is worth putting in your notes for every new server.

Upgrading to a new Ubuntu release

Everything above updates packages within your current Ubuntu version. Moving from, say, 22.04 to 24.04 is a different, bigger operation:

sudo apt update && sudo apt upgrade -y   # get fully current first
sudo do-release-upgrade

do-release-upgrade is the tool for a version jump. It replaces your repositories with the new release’s, downloads a large set of packages, and walks you through prompts about changed config files. Do it over a wired connection or a screen session, not over an SSH link that might drop - a dropped connection mid-upgrade can leave the system half-migrated.

For a server you care about, snapshot or back up first. Release upgrades usually go fine, but this is the one apt operation where having a rollback is worth the few minutes it costs.

Unattended upgrades for security patches

On a server, you do not want security patches waiting for you to remember. Ubuntu ships unattended-upgrades to apply them automatically:

sudo apt install unattended-upgrades
sudo dpkg-reconfigure --priority=low unattended-upgrades

By default it applies security updates only, which is the conservative and correct choice for most servers - you get patched against known vulnerabilities without surprise feature changes. Configuration lives in /etc/apt/apt.conf.d/50unattended-upgrades, where you can control whether it reboots for kernel updates and when.

The trade-off is honest: automatic security updates mean you are patched promptly but occasionally a service restarts under you. For internet-facing machines, prompt patching is almost always the right call - the risk of an unpatched known vulnerability outweighs the risk of an automated restart.

How this fits the rest of the stack

Keeping a box patched is table stakes, and the less time you spend hand-running apt on servers you manage, the better. That is part of the appeal of a managed runtime: the base image and its security patches are handled for you, so the update discipline lives at the platform layer instead of in your muscle memory. The RunxBuild hosting calculator lays out the service, database, storage, and bandwidth as separate line items, and the RunxBuild dashboard is where the team watches deploys, logs, and restarts as they happen.

Useful related references:

• Docker Setup on Ubuntu: apt repo, daemon, post-install
• Install MySQL on Ubuntu: apt, mysql_secure_installation, and 8.0 Setup
• Ubuntu Install GNOME Desktop: tasksel, apt, and the Right Path
• Services on RunxBuild

FAQ

What is the difference between apt update and apt upgrade?

apt update refreshes the local list of available package versions and installs nothing. apt upgrade installs newer versions of packages you already have. Run them together as sudo apt update && sudo apt upgrade, because upgrading against a stale list finds nothing new.

How do I update Ubuntu from the terminal?

Run sudo apt update && sudo apt upgrade -y. Add sudo apt autoremove -y to clear packages nothing needs anymore. This keeps your current Ubuntu version fully patched; moving to a new release version uses sudo do-release-upgrade instead.

What is the difference between apt upgrade and full-upgrade?

apt upgrade never removes an installed package, so it holds back upgrades that would require a removal. apt full-upgrade is allowed to remove packages to satisfy new dependencies. Use full-upgrade when packages are being kept back and you want the newer versions - after reading the removal list.

How do I upgrade to a new Ubuntu version?

First run sudo apt update && sudo apt upgrade to get fully current, then run sudo do-release-upgrade. Do it over a wired connection or a screen session rather than a droppable SSH link, and back up a server you care about first, since a version jump is a large operation.

Should I enable automatic updates on an Ubuntu server?

For internet-facing servers, enabling unattended-upgrades for security patches only is usually the right call - prompt patching against known vulnerabilities outweighs the occasional automated service restart. Install it with sudo apt install unattended-upgrades and tune /etc/apt/apt.conf.d/50unattended-upgrades.