<p>I'm not sure that this qualifies as an "easier" way, but you could host the specific packages on a server (e.g., <a href="https://jfrog.com/artifactory/" rel="nofollow noreferrer">Artifactory</a>, <a href="https://docs.docker.com/registry/storage-drivers/s3/" rel="nofollow noreferrer">S3</a>).  You would then have the Dockerfile connect to this location and use the packages from there.</p>

<p>This would allow you to avoid creating a custom base image and you would not have to manually download the packages.</p>

CC BY-SA 4.0
2019-12-30T14:51:04.757Z
2019-12-30T14:51:04.757Z
Wesley Rolnick
<p><strong>Scenario</strong></p>

<p>For obvious reasons I believe that every package installed in a Docker image should have their version nailed down.
That's why in our <code>Dockerfile</code> we always enforce the OS package manager to install a specific version of a package.
For example:</p>

<pre><code>FROM node:6.10.0

RUN apt-get update \
      &amp;&amp; apt-get -y install nginx=1.6.2-5+deb8u6 \
      &amp;&amp; apt-get -y install supervisor=3.0r1-1+deb8u1
</code></pre>

<p><strong>Problem</strong></p>

<p>The upstream repository has changed and the <code>nginx=1.6.2-5+deb8u6</code> package is now invalid. </p>

<p>I'm not sure what brings about this change but I think it has something to do with distros going out of their support-cycle or that old packages are removed/moved somewhere else. </p>

<p><strong>Question</strong></p>

<p>How do I nail the exact version of OS-leveled packages without running into this problem?</p>

<p><em>Note</em>: I know these 2 options will work but I want to know if there's an easier way out:</p>

<ol>
<li>Make a custom base image</li>
<li>Download the binaries and <code>COPY</code> them into the Docker image</li>
</ol>

CC BY-SA 4.0
2021-11-17T03:59:11.537Z
Any new ideas here?  Looking for the same thing.
MikeSchem
<docker><dockerfile>
How to pin OS package versions in Docker image
Tran Triet
# How to pin OS package versions in Docker image

(Asked by: username_0 on 2019-12-29)

Scenario
For obvious reasons I believe that every package installed in a Docker image should have their version nailed down.
That's why in our Dockerfile we always enforce the OS package manager to install a specific version of a package.
For example:
FROM node:6.10.0

RUN apt-get update \
      && apt-get -y install nginx=1.6.2-5+deb8u6 \
      && apt-get -y install supervisor=3.0r1-1+deb8u1

Problem
The upstream repository has changed and the nginx=1.6.2-5+deb8u6 package is now invalid. 
I'm not sure what brings about this change but I think it has something to do with distros going out of their support-cycle or that old packages are removed/moved somewhere else. 
Question
How do I nail the exact version of OS-leveled packages without running into this problem?
Note: I know these 2 options will work but I want to know if there's an easier way out:

Make a custom base image
Download the binaries and COPY them into the Docker image

**Tags:** docker, dockerfile

> **Comments:**
> **username_1**: Any new ideas here?  Looking for the same thing.  

---

## 1 answers

### Answer by username_2 on 2019-12-30. Score: 2

I'm not sure that this qualifies as an "easier" way, but you could host the specific packages on a server (e.g., [Artifactory](https://jfrog.com/artifactory/), [S3](https://docs.docker.com/registry/storage-drivers/s3/)). You would then have the Dockerfile connect to this location and use the packages from there.

This would allow you to avoid creating a custom base image and you would not have to manually download the packages.


---

