restic
shoyu.restic
A Docker Compose file for restic alone, generated from the catalog and checked by the safety inspector. No account needed.
Backup tool producing encrypted, deduplicated, content-addressed snapshots to local, SFTP, S3 and other backends, with fast restores and repository integrity checking.
restic splits files into content-defined chunks, stores each unique chunk once, and encrypts and authenticates everything client-side, so a repository holds no readable data and no plaintext filenames regardless of where it sits. Snapshots are immutable and independent: any one restores completely, and removing an old snapshot only frees the chunks nothing else references. A single static binary with no dependencies covers backup, restore, mounting a snapshot as a filesystem for browsing, and integrity verification that re-reads and checks stored data. A first deployment initialises a repository, takes one snapshot and restores a file from it.
You know it worked when
- The binary reports its version and initialises a repository.
- A snapshot completes and appears in the snapshot listing.
- A second snapshot of unchanged data adds almost nothing to the repository.
- A check pass reports no errors, including when reading a sample of the stored data.
- A file restored from a snapshot matches the original.
Known sharp edges
- The repository password is the only key, and there is no recovery path if it is lost — the backups become permanently unreadable.
- Pruning rewrites repository structure and is the one operation where an interruption can leave a repository needing repair, so it should not be run against a flaky link.
- Backup memory use scales with the number of files rather than their size, so a repository with many millions of small files needs more headroom than expected.
- It is a command-line binary rather than a service, so scheduling, retention and monitoring have to be supplied around it.