Administering SUSE Linux with zypper: refresh, patch versus update versus dup, and non-interactive runs

Goal

Operate zypper on SUSE Linux Enterprise Server 15 SP6 or openSUSE Leap safely from a script: refresh metadata, choose the right kind of upgrade, run without prompts, find what still holds deleted files after a change, and pin a package version.

Prerequisites

Root or sudo access; on SLES, the system should already be registered (see the SUSEConnect step below) so repositories resolve.

Steps

1. Refresh repository metadata: sudo zypper refresh. It fetches repository changes and installs nothing; several commands also refresh automatically.
2. Choose the right upgrade command for the goal:
   • sudo zypper patch installs all officially released patches; SUSE's documentation calls this "the most reliable way to install new versions of installed packages" because it respects patch metadata (CVE fixes, reboot flags, package supersession).
   • sudo zypper update updates installed packages to newer versions in enabled repositories, independent of patch metadata; SUSE notes it silently skips problematic packages (a locked one, for example), whereas zypper patch reports a conflict.
   • sudo zypper dist-upgrade (zypper dup) applies the full state of the configured repositories: it can upgrade, downgrade or remove packages. On openSUSE Leap it performs release upgrades (with --releasever), on Tumbleweed it is the routine update command; on SLES, service pack migration normally uses zypper migration, and dup is not a patching tool.
3. For unattended runs, put the global option before the command: sudo zypper --non-interactive patch, which applies the default answers without asking. In this mode zypper patch skips interactive patches (reboot-needed, message, or license confirmation) unless --with-interactive is given; add --auto-agree-with-licenses where license prompts are expected. Check the exit code: 103 means a patch updated the package manager itself and zypper patch must be run again; on current zypper, zypper needs-rebooting returns 102 when a reboot is suggested.
4. After any patch or removal, check for processes still holding deleted files: zypper ps -s. The zypper manual page describes ps as listing all processes using deleted files, together with the file and a service-name hint, which tells you which daemons need a restart. -s produces a short table without the deleted-file list.
5. To keep a package at its current version through future patch/update/dup runs, add a lock: sudo zypper addlock <package> (short: al). The manual describes addlock as adding a package lock, and locked packages cannot be removed or changed by later zypper operations. List active locks with zypper locks, and remove one with sudo zypper removelock <package> (rl).
6. Register or inspect module/extension repositories with SUSEConnect, documented in man 8 SUSEConnect; a local RMT/SMT server is used with a --url argument instead of the default SUSE Customer Center.

Expected result

zypper refresh exits 0; zypper ps -s returns an empty table once all services affected by an update have been restarted; zypper locks lists any package you pinned.

Limits and test basis

zypper dist-upgrade can remove packages that are no longer in the repositories, which is destructive if run against the wrong repository set — review its plan (zypper dup --dry-run) before running it for real. Locks block automatic patching of the locked package, including security patches, so remove them once the reason for pinning no longer applies.