Answers: <p>I'm not sure that this qualifies as an "easier" way, but you could host the specific packages on a server (e.g., <a href="https://jfrog.com/artifactory/" rel="nofollow noreferrer">Artifactory</a>, <a href="https://docs.docker.com/registry/storage-drivers/s3/" rel="nofollow noreferrer">S3</a>).  You would then have the Dockerfile connect to this location and use the packages from there.</p>
  
  <p>This would allow you to avoid creating a custom base image and you would not have to manually download the packages.</p>
  
Answers: CC BY-SA 4.0
Answers: 2019-12-30T14:51:04.757Z
Answers: 2019-12-30T14:51:04.757Z
Answers: Wesley Rolnick
Body: <p><strong>Scenario</strong></p>
  
  <p>For obvious reasons I believe that every package installed in a Docker image should have their version nailed down.
  That's why in our <code>Dockerfile</code> we always enforce the OS package manager to install a specific version of a package.
  For example:</p>
  
  <pre><code>FROM node:6.10.0
  
  RUN apt-get update \
        &amp;&amp; apt-get -y install nginx=1.6.2-5+deb8u6 \
        &amp;&amp; apt-get -y install supervisor=3.0r1-1+deb8u1
  </code></pre>
  
  <p><strong>Problem</strong></p>
  
  <p>The upstream repository has changed and the <code>nginx=1.6.2-5+deb8u6</code> package is now invalid. </p>
  
  <p>I'm not sure what brings about this change but I think it has something to do with distros going out of their support-cycle or that old packages are removed/moved somewhere else. </p>
  
  <p><strong>Question</strong></p>
  
  <p>How do I nail the exact version of OS-leveled packages without running into this problem?</p>
  
  <p><em>Note</em>: I know these 2 options will work but I want to know if there's an easier way out:</p>
  
  <ol>
  <li>Make a custom base image</li>
  <li>Download the binaries and <code>COPY</code> them into the Docker image</li>
  </ol>
  
Comments: CC BY-SA 4.0
Comments: 2021-11-17T03:59:11.537Z
Comments: Any new ideas here?  Looking for the same thing.
Comments: MikeSchem
Tags: <docker><dockerfile>
Title: How to pin OS package versions in Docker image
UserDisplayName: Tran Triet
ThreadText: # How to pin OS package versions in Docker image
  
  (Asked by: username_0 on 2019-12-29)
  
  **Scenario**
  
  For obvious reasons I believe that every package installed in a Docker image should have their version nailed down.
  That's why in our `Dockerfile` we always enforce the OS package manager to install a specific version of a package.
  For example:
  
  ```
  FROM node:6.10.0
  
  RUN apt-get update \
        && apt-get -y install nginx=1.6.2-5+deb8u6 \
        && apt-get -y install supervisor=3.0r1-1+deb8u1
  
  ```
  
  **Problem**
  
  The upstream repository has changed and the `nginx=1.6.2-5+deb8u6` package is now invalid.
  
  I'm not sure what brings about this change but I think it has something to do with distros going out of their support-cycle or that old packages are removed/moved somewhere else.
  
  **Question**
  
  How do I nail the exact version of OS-leveled packages without running into this problem?
  
  *Note*: I know these 2 options will work but I want to know if there's an easier way out:
  
  1. Make a custom base image
  2. Download the binaries and `COPY` them into the Docker image
  
  **Tags:** docker, dockerfile
  
  > **Comments:**
  > **username_1**: Any new ideas here?  Looking for the same thing.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2019-12-30. Score: 2
  
  I'm not sure that this qualifies as an "easier" way, but you could host the specific packages on a server (e.g., [Artifactory](https://jfrog.com/artifactory/), [S3](https://docs.docker.com/registry/storage-drivers/s3/)). You would then have the Dockerfile connect to this location and use the packages from there.
  
  This would allow you to avoid creating a custom base image and you would not have to manually download the packages.
  
  
  ---
  
  