A provisioning run on Ubuntu logs the line "WARNING: apt does not have a stable CLI interface. Use with caution in scripts." after `apt install -y nginx`. What is that warning telling you, and what should the script use instead?

## What `apt` actually is `apt` arrived as a front end over the same libapt machinery that `apt-get` and `apt-cache` use. It is not a new package manager; it is a curated subset of the two older commands with better ergonomics: `apt install`, `apt remove`, `apt update`, `apt upgrade`, `apt full-upgrade`, plus `apt search`, `apt show` and `apt list` lifted from `apt-cache`, and extras such as `apt edit-sources`. With the ergonomics come things a script must not rely on: a progress bar, coloured and column-aligned output whose width depends on the terminal, and listing formats that have been adjusted more than once between releases. Its own man page states that the command line is intended for interactive use and may change between versions, and recommends the older commands where backward compatibility matters. ## Why the warning appears where it does apt prints the warning when its standard output is not a terminal. That is a good proxy for "a program is reading this", which is why you see it in CI logs, configuration-management output and anything under `bash -c "… | tee"`, and never when you type the command yourself. It is not an error, the install still proceeds, and the exit status is unaffected — it is a maintainer telling you that your parser is built on sand. ## The scripting substitutes ```bash apt-get update apt-get install -y --no-install-recommends nginx apt-cache policy nginx dpkg-query -W -f='${Version}\n' nginx ``` * `apt-get` for state-changing operations, with `-y` to assume yes and `-q` to quieten the progress output. * `apt-cache policy` and `apt-cache madison` for querying what is available and from where. * `dpkg-query -W -f='…'` when you need a machine-readable fact about an installed package. Its format string is a stable contract, unlike the human-oriented output of `apt list --installed`. * `apt-get -s` to simulate a transaction and inspect the plan before committing to it. Two further flags belong in unattended runs. `--no-install-recommends` stops apt from pulling in the Recommends of each package, which on a server routinely means dragging in a documentation or desktop-adjacent stack nobody asked for. And `-o Dpkg::Options::="--force-confold"` decides in advance what happens when a package ships a changed configuration file that you have also edited locally — without it, an unattended run can stall on that prompt. ## Behaviour really does differ The warning is about interface stability, but the defaults differ too, and that is the trap that bites teams who assume the commands are aliases: * `apt upgrade` installs new packages when an upgrade needs them; `apt-get upgrade` does not, and holds them back instead. A patch job silently changes meaning if someone "modernises" the command. * `apt` shows different information at the end of a transaction and manages the terminal differently, so log output between the two is not comparable. If you deliberately want the apt behaviour in a script, express it on the stable command — `apt-get upgrade --with-new-pkgs` — rather than switching front ends. ## Where aptitude fits `aptitude` is a third front end, with an interactive text UI and a different dependency resolver that can offer several candidate solutions to a conflict and let you step through them. It is genuinely useful on Debian for untangling a messy dependency situation by hand, and it tracks automatically-installed state in its own way. It is not installed by default on modern servers and its resolver's choices differ from apt's, so it is a debugging tool to reach for consciously — not the command your fleet automation should standardise on. ## Exit status Apt-family commands return 0 on success and a non-zero status (100 for most errors) on failure, so a script with `set -e` will stop as expected. What you must not do is decide success by grepping the human-readable output — that is precisely the surface the warning says can change.