pkg and the Ports Collection on FreeBSD

FreeBSD has two parallel ways to install software: pkg (precompiled binaries, fast) and the ports collection (build from source, configurable). Most sites use pkg for everything; ports remain useful when you need a non-default build option.

Prerequisites

• FreeBSD 13 or 14 with sudo or root.
• Outbound HTTPS to pkg.freebsd.org.

Step 1: Bootstrap pkg if it is not there

pkg bootstrap -y

Step 2: Daily pkg commands

pkg update                 # refresh catalog
pkg upgrade                # upgrade installed packages
pkg search redis           # search names + descriptions
pkg install nginx          # install one
pkg install nginx-prod-1.24
pkg info nginx             # what is installed
pkg info -l nginx | head   # files owned by nginx
pkg delete nginx
pkg autoremove
pkg clean                  # purge package cache

pkg is conceptually the same as apt/dnf — just spelled differently.

Step 3: Lock a package version

When you want production stability:

pkg lock nginx
pkg lock -l                # list locks
pkg unlock nginx

Step 4: Ports collection — when you need a custom build

Fetch the ports tree:

sudo portsnap fetch
sudo portsnap extract       # first time
sudo portsnap update        # subsequent

Or git-clone:

sudo git clone --depth 1 https://git.FreeBSD.org/ports.git /usr/ports

Build a port:

cd /usr/ports/www/nginx
sudo make config            # interactive options menu
sudo make install clean

make config is the difference vs pkg: you choose compile-time options (modules, optimisations) before the build.

Step 5: portmaster — manage ports updates

sudo pkg install -y portmaster
sudo portmaster -a          # update everything
sudo portmaster -d www/nginx

For a single port refresh portmaster <category>/<port>. The -d flag deletes leftover files after.

Step 6: Mix and match — keep them in sync

You can mix pkg-installed and ports-built software on the same host. Tell pkg which packages you build from ports so it does not try to overwrite them:

pkg lock nginx              # if nginx came from ports

Cross-check what came from where:

pkg query -e '%a = 1' '%n-%v %?L'

Verify

pkg info | wc -l
pkg version -v               # show updates available
freshports-style:
pkg audit -F                 # security advisories

Conclusion

For 95 percent of FreeBSD sites, pkg does the job. Reach for ports only when you need a non-default option (Postgres with a non-default WITH_LLVM, for example). Lock production versions and audit weekly.

Next steps

• Install the OS first via Install FreeBSD 14.
• Front network services with pf firewall.
• For a Linux equivalent see Install Debian 12.