Updated: 9 October 2026 · Applies to: Ubuntu 26.04 (apt 3.2.0, apt-mirror 0.5.4, apt-cacher-ng 3.7.5); the same steps on Ubuntu 24.04 and Debian 13

To update the Ubuntu repositories, run:

sudo apt update

This downloads the latest package lists from every repository your server uses. It installs nothing; sudo apt upgrade then installs the updates it found. If you run many Ubuntu servers, a local cache or mirror lets them all update from one machine and saves bandwidth; both are covered below.

What apt update shows

$ sudo apt update
Get:1 http://security.ubuntu.com/ubuntu resolute-security InRelease [137 kB]
Get:2 http://archive.ubuntu.com/ubuntu resolute InRelease [136 kB]
Get:3 http://archive.ubuntu.com/ubuntu resolute-updates InRelease [137 kB]
Get:8 http://archive.ubuntu.com/ubuntu resolute/universe amd64 Packages [20.1 MB]
...
2 packages can be upgraded. Run 'apt list --upgradable' to see them.

(Shortened, Ubuntu 26.04.) Get means a new list was downloaded, Hit that it had not changed, and Err or W: lines name a repository that failed. Fixes for key and Release file errors are in how to add, enable and remove repositories on Ubuntu.

Where the repository list is

Since Ubuntu 24.04 the main list is /etc/apt/sources.list.d/ubuntu.sources; /etc/apt/sources.list only holds a comment pointing there. On Ubuntu 26.04 it contains:

Types: deb
URIs: http://archive.ubuntu.com/ubuntu/
Suites: resolute resolute-updates resolute-backports
Components: main universe restricted multiverse
Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg

Types: deb
URIs: http://security.ubuntu.com/ubuntu/
Suites: resolute-security
Components: main universe restricted multiverse
Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg

Ubuntu 24.04 has the same file with noble instead of resolute. Do not change the release name by hand to move to a new Ubuntu version: Ubuntu recommends sudo do-release-upgrade for that.

Change the repository mirror

  1. Back up the file: sudo cp /etc/apt/sources.list.d/ubuntu.sources /root/ubuntu.sources.bak
  2. Replace the archive address, for example with the Indian country mirror: 
    sudo sed -i 's|http://archive.ubuntu.com/ubuntu/|http://in.archive.ubuntu.com/ubuntu/|' /etc/apt/sources.list.d/ubuntu.sources
  3. Run sudo apt update. The lines now show the new mirror (Get:2 http://in.archive.ubuntu.com/ubuntu resolute InRelease), while security updates still come from security.ubuntu.com.

To undo it, copy the backup back and run sudo apt update again.

Save bandwidth: cache or full mirror?

  • apt-cacher-ng is a caching proxy. Each package is downloaded from the internet once, the first time any of your servers asks for it, and later requests are served from disk. It only stores the package lists and the packages your servers really download, so for most groups of servers it is the better choice.
  • apt-mirror copies whole repositories in advance. You need it only when servers must update without internet access. It is large: when we added up the package sizes in the Ubuntu 24.04 indexes (release, updates, security and backports, amd64 only), all four components came to about 491 GB, main and universe about 281 GB, and main alone about 96 GB.

Option 1: a cache with apt-cacher-ng

  1. On the server that will hold the cache: sudo apt install apt-cacher-ng. It runs as a service on port 3142 and, according to its configuration file, listens on all interfaces by default. Allow port 3142 only from your own servers in the firewall (see how to set up UFW), or anyone could download packages through your cache and bandwidth.
  2. On each client, point APT at it (use the cache server's address) and update: 
    echo 'Acquire::http::Proxy "http://192.0.2.10:3142";' | sudo tee /etc/apt/apt.conf.d/00aptproxy
sudo apt update
  3. Check that it works. In our test the first download of jq and its two libraries came from the internet and the second from the cache: 
    Fetched 393 kB in 2s (219 kB/s)
Fetched 393 kB in 0s (3875 kB/s)
    The log /var/log/apt-cacher-ng/apt-cacher.log marks each file with I when it was fetched from the internet and O when it was sent to a client. Statistics are at http://192.0.2.10:3142/acng-report.html.

HTTPS repositories (Docker, nginx.org and other vendors) cannot be cached, and by default the proxy refuses them. With the nginx.org repository added, apt update on the client failed with:

W: Failed to fetch https://nginx.org/packages/ubuntu/dists/resolute/InRelease  Invalid response from proxy: HTTP/1.0 403 CONNECT denied (ask the admin to allow HTTPS tunnels)

Both of these fixed it in our test. Either let clients reach HTTPS repositories directly by adding a second line to /etc/apt/apt.conf.d/00aptproxy:

Acquire::https::Proxy "DIRECT";

or allow HTTPS tunnels on the cache server by adding this line to /etc/apt-cacher-ng/acng.conf and restarting the service with sudo systemctl restart apt-cacher-ng:

PassThroughPattern: ^(.*):443$

Option 2: a full mirror with apt-mirror

  1. Install it and create a folder on a disk with enough space: sudo apt install apt-mirror and sudo mkdir -p /srv/apt-mirror
  2. Edit /etc/apt/mirror.list. This example mirrors Ubuntu 26.04 for amd64 without source packages (the default file also has deb-src lines, which add the sources): 
    set base_path    /srv/apt-mirror
set defaultarch  amd64
set nthreads     20
set _tilde 0
deb http://archive.ubuntu.com/ubuntu resolute main restricted universe multiverse
deb http://archive.ubuntu.com/ubuntu resolute-updates main restricted universe multiverse
deb http://archive.ubuntu.com/ubuntu resolute-security main restricted universe multiverse
clean http://archive.ubuntu.com/ubuntu
    Drop components you do not need to save space.
  3. Run sudo apt-mirror (inside screen or tmux, because the first run can take hours). It first prints how much it will fetch. Our small test mirror of one suite printed: 
    24.5 MiB will be downloaded into archive.
Downloading 10 archive files using 4 threads...
...
0 bytes in 0 files and 0 directories can be freed.
Run /srv/apt-mirror/var/clean.sh for this purpose.
    A line saying that postmirror.sh does not exist is harmless; apt-mirror still finished with exit code 0.
  4. Keep it current: /etc/cron.d/apt-mirror contains a daily job at 04:00 that is commented out; remove the # to enable it. The job runs as the apt-mirror user, so if you changed the base path give it the folder: sudo chown -R apt-mirror:apt-mirror /srv/apt-mirror. Run clean.sh now and then to delete packages that left the repository.
  5. Publish the folder with a web server, for example sudo apt install nginx and sudo ln -s /srv/apt-mirror/mirror/archive.ubuntu.com/ubuntu /var/www/html/ubuntu.
  6. On each client, change both URIs: lines in ubuntu.sources to http://192.0.2.10/ubuntu/ and run sudo apt update.

The mirror keeps Ubuntu's signed Release files, so clients still check signatures with the normal Ubuntu key. We tested a mirrored suite with a file: address in a .sources file, which uses the same folder layout, and apt update accepted it without warnings.

For keeping servers patched once the repositories work, see how to update all packages on Linux safely and how to list available packages and hold packages with APT.

Official documentation: apt-cacher-ng on the Debian wiki, APT proxy options and Ubuntu: upgrade your release.

Ucartz services for this topic

Was this answer helpful? 0 Users Found This Useful (0 Votes)