Alpine apk¶

ID: apk
Home page: https://gitlab.alpinelinux.org/alpine/apk-tools
Upstream stars: ⭐ 42
Last commit: 2026-08-31
Version requirement: >= 2.10
Platforms: 🐧 Linux
Operations: installed · outdated · search · install · upgrade · upgrade_all · remove · sync · cleanup
purl types: pkg:apk
CLI name: apk
Every call: apk --no-progress <command>
Issues and PRs: 📦 manager: apk
Source: meta_package_manager/managers/apk.py

Alpine Package Keeper (apk) used by Alpine Linux.

Note

The version floor is 2.10.0, the release introducing the list applet that outdated() parses and installed() falls back on. Where query_requirement is met, installed reads the structured query applet instead. Progress output is disabled on every call to keep the parsed lines stable.

Caution

outdated reads the local repository cache rather than the remote, so sync must run first for an accurate upgrade list.

Warning

orphans is deliberately not implemented, and apk query --orphaned must not be mapped onto it. The two words name different sets: mpm’s orphan is a package installed as a dependency that nothing requires any more, where apk’s is one no configured repository provides any more. Measured on Alpine 3.24.1 with apk-tools 3.0.8: pointing apk at no repository (--repositories-file /dev/null) reports all 86 installed packages as orphaned, and the stock repositories report none, while a package dropped from apk-world(5) and required by nothing is never reported at all. Wiring that selector to cleanup --orphans would delete a working system whenever its mirrors were unreachable.

What `mpm` adds to `apk`¶

Through mpm, apk gains --exact search, to narrow results to exact names.

Bigger still, mpm reaches across every manager at once: mpm installed and mpm outdated cover apk alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your `apk` commands, in `mpm`¶

You already know apk: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With `apk`	With `mpm`
List what’s installed	`apk query --installed --fields name,version --format json '*'`	`mpm --apk installed`
List outdated packages	`apk list --upgradable`	`mpm --apk outdated`
Search for a package	`apk search --verbose firefox`	`mpm --apk search firefox`
Install a package	`sudo apk add firefox`	`mpm install pkg:apk/firefox`
Upgrade one package	`sudo apk upgrade firefox`	`mpm --apk upgrade firefox`
Upgrade everything	`sudo apk upgrade`	`mpm --apk upgrade --all`
Remove a package	`sudo apk del firefox`	`mpm remove pkg:apk/firefox`
Clear caches	`sudo apk cache clean`	`mpm --apk cleanup --cache`

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations¶

Operation	Supported	Notes
`installed`	✓
`outdated`	✓
`orphans`
`search`	✓	exact search backfilled by `mpm`
`install`	✓
`upgrade`	✓
`upgrade_all`	✓
`remove`	✓
`sync`	✓
`cleanup`	✓
`doctor`

Selecting and configuring `apk`¶

Deselect apk for a single run with --no-apk, or persist the choice in your configuration:

[mpm]
apk = false

The arguments and environment variables listed in the box atop this page are forced on every apk call, so runs stay quiet, non-interactive and reproducible: the defaults you would set in CI anyway.

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.overrides.apk]
timeout = 900

mpm config-template apk prints every overridable attribute as a ready-to-paste block.

Recipes¶

A few jobs you would otherwise script around apk, one mpm command each:

Snapshot and clone a machine: mpm --apk dump apk.toml, then mpm restore apk.toml on the next one.
Export a compliance SBOM: mpm --apk sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation¶

System-wide manager: mpm wraps its privileged operations in sudo out of the box. Instead of letting the tool prompt mid-run, mpm primes the credential cache up-front, with a single branded password prompt at most. Turn escalation off for rootless setups with --no-sudo or the per-manager sudo override.

See privilege escalation for the full policy.

Cooldown¶

State of Alpine apk’s release-age gating, from the cooldown support table:

Status: ❌ None

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

Registry: Distro binary archives (pkg:deb, pkg:rpm, pkg:alpm, pkg:apk)
Retraction: Index revert: removal is an archive operation and the mirror is rebuilt without the package. Debian, for one, requires filing an RM: bug against ftp.debian.org (developers-reference)
Publish date: ❌ the version string is the distro maintainer’s build, carrying no upstream publication date

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --cooldown best-effort opts back in.

Version probe¶

The version is probed by running:

$ apk --version
apk-tools 2.14.10, compiled for x86_64.

and extracted with:

r"apk-tools\s+(?P<version>[^\s,]+)"

Reference traces¶

Raw native outputs captured in the manager source: the reference mpm’s parsers were written against. If you know Alpine apk well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ apk --no-progress query --installed --fields name,version --format json '*'
[
  {
    "name": "alpine-base",
    "version": "3.24.1-r0"
  }, {
    "name": "apk-tools",
    "version": "3.0.8-r0"
  }, {
    "name": "busybox",
    "version": "1.37.0-r31"
  }
]

$ apk --no-progress list --installed
acl-2.2.53-r0 x86_64 {acl} (LGPL-2.1-or-later AND GPL-2.0-or-later) [installed]
alpine-baselayout-3.4.3-r1 x86_64 {alpine-baselayout} (GPL-2.0-only) [installed]
apk-tools-2.14.0-r5 x86_64 {apk-tools} (GPL-2.0-only) [installed]
busybox-1.36.1-r5 x86_64 {busybox} (GPL-2.0-only) [installed]
python3-3.11.6-r0 x86_64 {python3} (PSF-2.0) [installed]

$ apk --no-progress list --upgradable
acl-2.3.1-r0 x86_64 {acl} (LGPL-2.1-or-later) [upgradable from: acl-2.2.53-r0]
python3-3.11.7-r0 x86_64 {python3} (PSF-2.0) [upgradable from: python3-3.11.6-r0]

Feed any of these through mpm and the raw output becomes one uniform table, the same shape for every manager: filter it, project columns, or export it (mpm --apk installed --output json, or csv, toml, yaml), each package carrying a purl and a version comparable across managers.

Upstream project¶

Metrics	`alpine/apk-tools`
Activity
Popularity
Metadata

Changelog¶

8.0.0.dev0 (unreleased)
- Read the installed inventory from the structured apk query applet on apk-tools 3, keeping the apk list parser for apk-tools 2.
- Parse the search output of apk-tools 3, which appends each package’s description where version 2 printed the bare name and version. Every result was dropped on Alpine edge.
6.4.0 (2026-04-27)
- Add Alpine Linux’s apk package manager with installed, outdated, search, install, upgrade, remove, sync, and cleanup support.