Alpine apk

ID

apk

Home page

https://gitlab.alpinelinux.org/alpine/apk-tools

Version requirement

>= 2.10

Platforms

🐧 Linux

Operations

installed · outdated · search · install · upgrade · upgrade_all · remove · sync · cleanup

purl types

pkg:apk

CLI name

apk

Every call

apk --no-progress <command>

Issues and PRs

📦 manager: apk

Source

meta_package_manager/managers/apk.py

Alpine Package Keeper (apk) used by Alpine Linux.

Documentation: Alpine Package Keeper.

Note

installed and outdated both parse the list applet, so the version floor is 2.10.0: the release that introduced it. Progress output is disabled on every call to keep the parsed lines stable.

Caution

outdated reads the local repository cache rather than the remote, so sync must run first for an accurate upgrade list.

What mpm adds to apk

Through mpm, apk gains --exact search, to narrow results to exact names.

Bigger still, mpm reaches across every manager at once: mpm installed and mpm outdated cover apk alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your apk commands, in mpm

You already know apk: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…

With apk

With mpm

List what’s installed

apk list --installed

mpm --apk installed

List outdated packages

apk list --upgradable

mpm --apk outdated

Search for a package

apk search --verbose firefox

mpm --apk search firefox

Install a package

sudo apk add firefox

mpm install pkg:apk/firefox

Upgrade one package

sudo apk upgrade firefox

mpm --apk upgrade firefox

Upgrade everything

sudo apk upgrade

mpm --apk upgrade --all

Remove a package

sudo apk del firefox

mpm remove pkg:apk/firefox

Clear caches

sudo apk cache clean

mpm --apk cleanup --cache

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations

Operation

Supported

Notes

installed

✓

outdated

✓

orphans

search

✓

exact search backfilled by mpm

install

✓

upgrade

✓

upgrade_all

✓

remove

✓

sync

✓

cleanup

✓

doctor

Selecting and configuring apk

Deselect apk for a single run with --no-apk, or persist the choice in your configuration:

[mpm]
apk = false

The arguments and environment variables listed in the box atop this page are forced on every apk call, so runs stay quiet, non-interactive and reproducible: the defaults you would set in CI anyway.

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.apk]
timeout = 900

mpm config-template apk prints every overridable attribute as a ready-to-paste block.

Recipes

A few jobs you would otherwise script around apk, one mpm command each:

  • Snapshot and clone a machine: mpm --apk dump apk.toml, then mpm restore apk.toml on the next one.

  • Export a compliance SBOM: mpm --apk sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation

System-wide manager: mpm wraps its privileged operations in sudo out of the box. Instead of letting the tool prompt mid-run, mpm primes the credential cache up-front, with a single branded password prompt at most. Turn escalation off for rootless setups with --no-sudo or the per-manager sudo override.

See privilege escalation for the full policy.

Cooldown

State of Alpine apk’s release-age gating, from the cooldown support table:

Status: ❌ None

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

  • Registry: Distro binary archives (pkg:deb, pkg:rpm, pkg:alpm, pkg:apk)

  • Retraction: Index revert: removal is an archive operation and the mirror is rebuilt without the package. Debian, for one, requires filing an RM: bug against ftp.debian.org (developers-reference)

  • Publish date: ❌ the version string is the distro maintainer’s build, carrying no upstream publication date

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --allow-unsupported-managers opts back in.

Version probe

The version is probed by running:

$ apk --version
apk-tools 2.14.10, compiled for x86_64.

and extracted with:

r"apk-tools\s+(?P<version>[^\s,]+)"

Reference traces

Raw native outputs captured in the manager source: the reference mpm’s parsers were written against. If you know Alpine apk well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ apk --no-progress list --installed
acl-2.2.53-r0 x86_64 {acl} (LGPL-2.1-or-later AND GPL-2.0-or-later) [installed]
alpine-baselayout-3.4.3-r1 x86_64 {alpine-baselayout} (GPL-2.0-only) [installed]
apk-tools-2.14.0-r5 x86_64 {apk-tools} (GPL-2.0-only) [installed]
busybox-1.36.1-r5 x86_64 {busybox} (GPL-2.0-only) [installed]
python3-3.11.6-r0 x86_64 {python3} (PSF-2.0) [installed]

$ apk --no-progress list --upgradable
acl-2.3.1-r0 x86_64 {acl} (LGPL-2.1-or-later) [upgradable from: acl-2.2.53-r0]
python3-3.11.7-r0 x86_64 {python3} (PSF-2.0) [upgradable from: python3-3.11.6-r0]

Feed any of these through mpm and the raw output becomes one uniform table, the same shape for every manager: filter it, project columns, or export it (mpm --apk installed --output json, or csv, toml, yaml), each package carrying a purl and a version comparable across managers.

Changelog

  • 6.4.0 (2026-04-27)

    • Add Alpine Linux’s apk package manager with installed, outdated, search, install, upgrade, remove, sync, and cleanup support.