Debian stable is stable because package versions are frozen at release. Sometimes you need a newer version of one program: a newer kernel, or a tool with a feature you need. Backports provide selected newer packages, rebuilt for the current stable release, without upgrading the whole system to testing.

What backports are

  • Packages taken from Debian testing, recompiled for stable (for example bookworm-backports for Debian 12).
  • Not used automatically: APT gives backports a low priority, so nothing gets upgraded unless you ask for it.
  • Once you install a package from backports, its updates also come from backports.

Enable backports

One-line format:

echo "deb http://deb.debian.org/debian bookworm-backports main contrib non-free non-free-firmware" | \
  sudo tee /etc/apt/sources.list.d/backports.list
sudo apt update

Or add bookworm-backports to the Suites: line in your debian.sources file. See Debian sources.list explained.

Install a package from backports

apt policy podman                       # compare versions available
sudo apt install -t bookworm-backports podman

-t bookworm-backports tells APT to prefer backports for this install, including dependencies that need newer versions. Other packages stay on stable.

List what you’ve installed from backports:

apt list --installed 2>/dev/null | grep backports

Newer kernel

A common use: a newer kernel for hardware support or features:

sudo apt install -t bookworm-backports linux-image-amd64
sudo reboot
uname -r

On a VPS, the stable kernel is usually fine. Only use a backports kernel if you need a specific feature, and test it first. See upgrade the Linux kernel.

Security support

Backports are not covered by Debian’s security team in the same way as stable. Fixes arrive when the backports maintainer uploads a newer version from testing, which can be slower. Guidelines:

  • Use backports only for packages you really need newer.
  • Keep unattended-upgrades configured. Note that by default it only installs security updates from the main stable repositories. Update backported packages regularly by hand, or add backports to its origins carefully. See automatic security updates.

Pinning (optional)

To make sure one package always follows backports, or that nothing else ever does, use APT pinning in /etc/apt/preferences.d/. See package pinning.

Alternatives

Option When
Backports The package exists there; you want Debian-quality packaging
Vendor repositories (Docker, PostgreSQL PGDG, Nginx, NodeSource) Latest versions straight from upstream, with their own security updates
Containers Run newer software in Docker without touching the host’s packages
Upgrade to the next Debian release When many packages are too old. See upgrade Debian

Avoid mixing testing or unstable repositories into a stable server’s sources: that creates “FrankenDebian” systems that break during upgrades.

Removing a backported package

To go back to the stable version, install it explicitly with the version from stable (check with apt policy), for example sudo apt install podman=<stable-version>, then remove the backports line if you no longer need it. Downgrades can fail if configuration or data formats changed between versions, so back up the application’s data first.

Quick reference

Task Command
Enable add bookworm-backports suite, then apt update
Compare versions apt policy <pkg>
Install from backports apt install -t bookworm-backports <pkg>
List installed from backports apt list --installed | grep backports
Newer kernel apt install -t bookworm-backports linux-image-amd64

Related: Debian VPS and apt commands.

  • Debian
  • APT
  • Linux