With conda 26.5 or later, run conda export with a file name ending in conda-lock.yaml to write a lockfile of exact packages, versions, builds and channels. Add one platform flag per target to cover Linux, macOS and Windows. Commit the file next to your code.
Why a lockfile and not just environment.yml
An environment.yml usually lists loose requirements. Solving it next year can give different versions, so the same file produces a different environment. A lockfile records the fully resolved state, and conda's documentation notes that because of this it can skip the solver step and go directly to downloading and installing.
conda's guide describes two ways to build identical environments: explicit specification files and lockfiles. Explicit files are usually limited to a single platform, while lockfiles can support several.
Commands
The docs state that lockfile support is available in conda 26.5 and later. Update first if needed.
conda install --name base "conda>=26.5"
conda export --name my-env --file conda-lock.yaml
conda create --name my-env --file conda-lock.yaml
To write one lockfile for several platforms:
conda export --name my-env --file conda-lock.yaml \
--platform linux-64 --platform osx-64 --platform win-64
conda supports conda-lock.yaml and pixi.lock natively. Support depends on package availability on each platform, so a package that only exists for one operating system cannot be locked for the others.
What to commit and record
- The lockfile itself, at the repository root.
- A short README line saying which conda version produced it.
- The date you generated it, since resolved state depends on what the channels offered.
- A separate record of the base operating system or container if your analysis relies on system libraries.
| Approach | Platforms | Best for |
|---|---|---|
| environment.yml | Any, but loose | Documenting intent |
| Explicit spec file | One platform | Exact copy on the same OS |
| Lockfile | Several platforms | Sharing across a team or cluster |
Security side effects
A lockfile makes updates deliberate. That is good for reproducibility and neutral for security, since a pinned vulnerable version stays vulnerable until you change it. Scan the lockfile, decide which updates matter, regenerate, and rerun your tests. See pin versions without freezing vulnerabilities.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how exact versions turn into an inventory you can check against advisories.
Quick check
Which conda version do I need?
The conda documentation says lockfile support is available in conda 26.5 and later.
Will the lockfile always install on every platform?
Only when the packages exist for that platform. The documentation notes recreation works on Windows, Linux and macOS depending on package availability.
Safeguard's SBOM and dependency scanning reads dependency files, and a free scan is available.
Sources
Last reviewed: 19 October 2026.
