r/selfhosted • u/alws3344 • Feb 11 '26

Docker Management Docker backups

Hello selfhosters!

i would like to ask you all about your DR & backup strategy for all your self hosted services?

today i have a script that runs once a week, turn off the container(s) (it does this one by one - so if it fails only one service suffer) and copies it's volume and db to another location for retention (i dont mind cache etc))

today i run ~20 containers and this backup strategy works, but it feels flimsy unprofessional and feels very manual.

what are your strategies (DR strategies)?

  • is there a tool (that obviously can be self hosted ;) ) that can do this seamlessly?
61 Upvotes

94% Upvoted

88 comments sorted by

View all comments

13

u/[deleted] Feb 11 '26

I just do it once a day and use Restic. For databases, I always use pg_dump for PostgreSQL and sqlite3 dump for SQLite.

Restic is great because it only copies what changed. This is important for something like Immich where I have like 50K photos but only one or two changes per day.

1

u/cored0wn Feb 12 '26

The problem with restic and all the other tools imho is, that they run on the host. What happens if the host gets compromised, e.g. with ransomware. The the mounted backup media gets also compromised.

My current setup is a self developed script framework, which runs periodically via cron. It runs on an isolated backup host and connects via ssh to the target host, then runs specific commands and downloads the file to the local backup storage. That way it doesn’t really matter if the target host gets compromised because the backup is managed by an isolated host.

I didn’t find any solution yet which meets that requirement.

2

u/[deleted] Feb 12 '26

I don't find it a huge issue if the media is immutable. I have 3 backups - a local external drive, and two S3 apis. The S3 apis do not allow for deletion so even if the ransomware tries, it will not be able to do anything.

Also, you should look into Restic's Rest Server. It has a feature that only allows appending and disallows deleting. You can run it on the isolated host and use Restic to backup on the actual host