Updated: September 26, 2025
Reading the title of this guide, your initial thought might be, dude, why this piece? After all, there are official instructions on how to do this, there's no need for yet another tutorial. Ah. Well. As it turns out, at the time of writing, the official VirtualBox howto does not take into account the third-party apt repo sources change introduced in Ubuntu 24.04 onwards. Indeed, if there's one thing Linux does well, it's to break backward compatibility.
Case in point, additional repo sources in the latest LTS aren't managed like before. Previously, you would simply add lines to the /etc/apt/sources.list file. Now, these have moved to the /etc/apt./sources.list.d/ directory, with each source its own file. Cleaner perhaps? Yes. Compatible with the old methods? Of course not. Furthermore, there's no automatic conversion from old to new. Hence, if you seek to install VirtualBox in your Ubuntu and family, you will need to manually manipulate the apt files. Let me show you.
Old format
So, what VirtualBox (and many other sites) offers is the following format:
deb [arch=amd64 signed-by=/usr/share/keyrings/oracle-virtualbox-2016.gpg] https://download.virtualbox.org/virtualbox/debian <mydist> contrib
This no longer works. You won't see any new VirtualBox versions. Even with the correct mydist entry there.
New format
We need to translate the one liner into the following:
Types: deb
URIs: [repo path]
Suites: [distro name]
Components: [component]
Architectures: [architecture]
Signed-By: [key]
Basically:
- Types specifies the package format. It is deb, but it could theoretically be other things, too.
- URIs specifies the (online) path where the packages ought to be found.
- Suites specifies the targeted distro family (for Debian and Ubuntu). Something like noble.
- Components specifies the branch where the required packages ought to be found, like main, contrib, etc.
- Architectures specifies which CPU families are supported. For the common desktop, it's amd64 only.
- Signed-By: specifies the path to the signing key.
More specifically, in our VirtualBox example:
Types: deb
URIs: https://download.virtualbox.org/virtualbox/debian
Suites: noble
Components: contrib
Architectures: amd64
Signed-By: /usr/share/keyrings/oracle-virtualbox-2016.gpg
And that's it. Save this into a file called virtualbox.list under /etc/apt/sources.list.d/, and there you go. Once you refresh your apt database, you will now see the supported and available versions of VirtualBox and be able to install them.
To be fair, the new format is nicer, easier to read. But. In a typical nerdy fashion that's the Linux world, this breaks old stuff. As I outlined in my Slimbook Executive report 10, where I upgrade the system from Kubuntu 22.04 to Kubuntu 24.04, this change broke my WINE repo, and as it turns out, it also broke the VirtualBox repo. So if you're upgrading, and even if you use the allow-third-party option, you effectively end up with one or more broken sources. This is an implementation failure. And also, there was that 32-bit repo warning both for Chrome and Edge. So two failures really.
Conclusion
I fail to understand why anyone felt a dire need to mess with apt, and make these breaking changes. If anything, why not present the user with an option to port the sources, review the sources, or even briefly introduce the new format. Nope. Just nerdy background noise. As it happens, the new format ruined my system, as two repos were completely gone, and two were now spouting error messages. Silly. Sad.
But we solved what we needed. You now have the VirtualBox repo configured correctly. The Oracle instructions should also change, and I'm actually surprised that they haven't, as it's been some 18 months since 24.04 was released. This makes me think that few people use the repos, or if they do, they don't care, and/or they fixed the problems for themselves and moved on. Whatever the case, we can move on to other problems. And there be a few, as I shall shortly demonstrate. Stay tuned.
Cheers.