Package Priority and Pinning

Control package versioning by applying pin files to override default distribution repository priorities.

In this lesson, you will learn how to exert surgical control over your package manager by using pinning to override default repository priorities.

By default, Debian-based systems use the APT priority system to decide which version of a package to install when multiple repositories offer the same package. Usually, the highest version number wins. However, in production environments, you often need to lock specific packages to a stable version or force the system to prefer a specific source (like a backports repo) over the primary one.

The Mechanics of Pinning

APT evaluates package source priorities using three primary files in /etc/apt/preferences.d/. Each "pin" entry consists of three fields: Package, Pin, and Pin-Priority.

Package: The target package name or a glob pattern (e.g., *).
Pin: Defines the criteria for the match, such as version, release, or origin.
Pin-Priority: A numeric value that dictates how the package manager treats the candidate.

Practical Example

Suppose you want to ensure the nginx package never upgrades automatically, effectively locking it at the currently installed version regardless of what the repository metadata suggests. You would create a file like /etc/apt/preferences.d/nginx-lock:

Package: nginx
Pin: version 1.18.0-0ubuntu1
Pin-Priority: 1001

In this context, a Pin-Priority of 1001 is a special value. It instructs APT to allow the version to be upgraded to this specific version even if it were a downgrade, essentially pinning it firmly in place.

Other important priority tiers include:

P > 1000: Forces the version to be installed, even if it is a downgrade.
990 <= P <= 1000: The package will be installed if it is not the current version.
500 <= P < 990: The package will be installed unless a newer version is available.
P < 0: Prevents the package from ever being installed.

By manipulating these priorities, you create deterministic boundaries for your infrastructure, preventing unexpected configuration drift caused by "invisible" package updates during routine maintenance.

Key Takeaway: Pinning allows you to override default repository version selection by assigning specific numeric priorities to packages, enabling precise control over version stability and source selection.