Micromamba¶

ID: micromamba
Home page: https://mamba.readthedocs.io/en/latest/user_guide/micromamba.html
Version requirement: >= 2
Platforms: 🐧 Linux · 🍎 macOS · 🪟 Windows
Operations: installed · outdated · search · install · upgrade · upgrade_all · remove · cleanup
purl types: pkg:micromamba
CLI name: micromamba
Issues and PRs: 📦 manager: conda-based
Source: meta_package_manager/managers/mamba.py

mamba’s statically linked build, shipped as a single self-contained binary.

The same program as mamba, built the other way: upstream’s build declares “mamba is a dynamic build of micromamba” and compiles both executables from one source list. Every operation, parser and forced argument is therefore inherited unchanged.

Note

The two are separate managers rather than one manager naming both binaries, because they resolve different root prefixes: mamba takes the conda installation it ships inside, while micromamba takes ~/micromamba or its XDG data directory. mpm resolves a manager to the first of its CLI names found while walking the search path, so a host carrying both would silently report whichever came first on PATH and hide the other’s packages entirely.

Note

Their command sets differ by exactly one entry: micromamba adds self-update, which the dynamic build rejects. It maps to no mpm operation, so nothing here uses it.

What `mpm` adds to `micromamba`¶

Through mpm, micromamba gains --extended search, to match against package descriptions.

Bigger still, mpm reaches across every manager at once: mpm installed and mpm outdated cover micromamba alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your `micromamba` commands, in `mpm`¶

You already know micromamba: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With `micromamba`	With `mpm`
List what’s installed	`mamba list --json`	`mpm --micromamba installed`
List outdated packages	`mamba update --all --dry-run --json`	`mpm --micromamba outdated`
Search for a package	`mamba search "zstd" --json`	`mpm --micromamba search <pkg>`
Install a package	`mamba install --yes zstd`	`mpm install pkg:micromamba/zstd`
Upgrade one package	`mamba update --yes zstd`	`mpm --micromamba upgrade zstd`
Upgrade everything	`mamba update --all --yes`	`mpm --micromamba upgrade --all`
Remove a package	`mamba remove --yes zstd`	`mpm remove pkg:micromamba/zstd`
Clear caches	`mamba clean --all --yes`	`mpm --micromamba cleanup --cache`

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations¶

Operation	Supported	Notes
`installed`	✓
`outdated`	✓
`orphans`
`search`	✓	extended search backfilled by `mpm`
`install`	✓
`upgrade`	✓
`upgrade_all`	✓
`remove`	✓
`sync`
`cleanup`	✓
`doctor`

Selecting and configuring `micromamba`¶

Deselect micromamba for a single run with --no-micromamba, or persist the choice in your configuration:

[mpm]
micromamba = false

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.micromamba]
timeout = 900

mpm config-template micromamba prints every overridable attribute as a ready-to-paste block.

Recipes¶

A few jobs you would otherwise script around micromamba, one mpm command each:

Snapshot and clone a machine: mpm --micromamba dump micromamba.toml, then mpm restore micromamba.toml on the next one.
Export a compliance SBOM: mpm --micromamba sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation¶

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

See privilege escalation for the full policy.

Concurrency¶

mpm never runs micromamba at the same time as conda or mamba: they act on one environment prefix and one package cache, and conda honors none of the locks mamba takes on them. Each mutating operation waits for the previous one, even with a higher --jobs, while managers outside this group keep running in parallel.

Only mutations are held back. The read-only queries (installed, outdated, search) take no backend lock and stay fully concurrent.

Cooldown¶

State of Micromamba’s release-age gating, from the cooldown support table:

Status: 🚧 Same as mamba (inherits)

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

Registry: anaconda.org / conda-forge (pkg:conda)
Retraction: Relabel: “we do not allow edits or the deletion of packages on conda-forge” (immutability); a bad artifact is labelled broken and “Users will no longer be able to install them by default” (procedure)
Publish date: ✅ upload_time, with the broken label carried in labels (API)

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --allow-unsupported-managers opts back in.

Version probe¶

The version is extracted from the output of micromamba --version with:

r"^(?P<version>\d+\.\d+\.\d+\S*)$"

Changelog¶

7.7.0.dev0 (unreleased)
- Implement mamba and micromamba, the C++ reimplementation of conda and its statically linked twin. Both read the inventory from list --json, accepting the array both bare and inside the envelope 2.9.0 introduced, and synthesize outdated from the dry-run transaction the way the conda wrapper does. Search matches package names exactly without falling back to mpm’s own refiltering.
- Stop running conda, mamba and micromamba concurrently. They act on one environment prefix and one package cache, and conda honors none of the locks mamba takes on them.