apt-mark: Hold, Unhold, and Auto Flags
apt-mark hold pins a package so apt-get upgrade will not change it, and apt-mark auto/manual controls autoremove behavior.
When one package must stay at a fixed version across upgrades, apt-mark hold locks it. It is the counterpart to version pinning in the install line.
What it does
apt-mark records package flags in the dpkg database. hold prevents a package from being upgraded, removed, or installed until unheld. auto marks a package as automatically installed (eligible for autoremove); manual marks it as explicitly wanted.
Common usage
apt-mark hold docker-ce
apt-mark showhold # list held packages
apt-mark unhold docker-ce
# keep a manually installed dep from being autoremoved
apt-mark manual libfoo1Options
| Subcommand | What it does |
|---|---|
| hold <pkg> | Prevent the package from being changed |
| unhold <pkg> | Release a previously held package |
| showhold | List all currently held packages |
| auto <pkg> | Mark as automatically installed |
| manual <pkg> | Mark as manually installed |
| showmanual | List packages marked manual |
In CI
apt-mark hold is useful when a base image must keep a specific docker or kernel package version while still running apt-get upgrade for security patches. Combine hold with a version pin in the install line for a fully reproducible toolchain.
Common errors in CI
A held package silently skipped during upgrade is expected behavior, not an error; run apt-mark showhold to confirm. "E: Unable to locate package" from apt-mark means the name is wrong or the package is not known to apt. Holding a package then pinning a different version in install can conflict.