Linux Labs
Where to start First steps track · 15 stages
Linux Labs
EN

restic — deduplicated backups

4 min restic 0.16

Incremental encrypted backups with snapshots; without the password the repository cannot be decrypted at all.

Cheat sheet

7 commands Printable version
  • restic init create the repository, once
  • restic backup /path --tag daily take a snapshot
  • restic snapshots list snapshots
  • restic restore latest --target /restore restore the latest snapshot
  • restic forget --keep-daily 7 --keep-weekly 4 --prune apply the retention policy
  • restic check check repository integrity
  • restic unlock remove a stuck lock

Overview

restic makes incremental backups with deduplication and encryption. Unlike rsync/tar, it keeps a history of snapshots and never duplicates identical blocks. Backends: a local directory, SFTP (over SSH), S3, and others.

bash 
export RESTIC_REPOSITORY=/backup/repo
export RESTIC_PASSWORD='secret'   # without it, nothing can be decrypted — DO NOT LOSE IT!
restic init                       # create the repository (once)

Backend selected through the repository URL: sftp:user@host:/backup, s3:https://....

Options

7

--prune on forget is not cosmetic: without it, forgotten snapshots stop being listed, but the disk blocks they used stay put and no space is freed. --tag on backup, and the --tag filter on snapshots/forget, keep separate backup schedules (daily/weekly) apart within one repository.

Option What it does Example
--tag TAG Tag the snapshot; filter by it later in snapshots/forget. restic backup /data --tag daily
--keep-daily N How many recent daily snapshots to keep during forget. restic forget --keep-daily 7
--prune Actually delete the data of forgotten snapshots, not just unmark them. dangerous restic forget --keep-daily 7 --prune
--target DIR Where to restore files during restore. restic restore latest --target /restore
--exclude-file FILE A file listing paths and patterns to exclude from the snapshot. restic backup /data --exclude-file=excl.txt
--read-data During check, re-read all data, not only metadata — slow but thorough. restic check --read-data
--one-file-system Do not cross into other mounted file systems. restic backup / --one-file-system

Nothing found. Try a shorter query.

Recipes

2

Backup and restore

bash 
restic backup /etc /var/www                    # take a snapshot
restic backup /data --exclude-file=excl.txt --tag weekly --one-file-system
restic snapshots                               # list (ID, date, host, paths, tags)
restic snapshots --tag weekly --host web1      # filter
restic restore latest --target /restore        # restore the latest
restic restore <ID> --target /restore --include /etc/nginx   # partial restore
restic mount /mnt/backup                        # mount and browse files (FUSE)
restic diff <ID1> <ID2>                         # what changed between snapshots
restic ls latest /etc                           # list files inside a snapshot

Maintenance and scheduling

bash 
restic check                      # integrity (metadata)
restic check --read-data          # + re-read all data (slow, but thorough)
restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune   # retention + cleanup
restic stats                      # size / deduplication
restic unlock                     # remove a stuck lock

In cron or a systemd timer — backup plus forget --prune on a schedule. Keep credentials in --password-file/RESTIC_PASSWORD_FILE rather than in plain text.

Troubleshooting

5

Forgot RESTIC_PASSWORD

The repository is encrypted — without the password the data cannot be restored. Store the password separately and reliably (the most common way backups fail). A second key can be added: restic key add.

The first backup is slow/large

The first snapshot is full, later ones only carry changes (deduplication). This is normal.

The repository has bloated

restic forget --keep-* --prune applies the retention policy and actually deletes unused blocks (--prune). Without --prune, snapshots are only "forgotten" but space isn't freed.

locked repository

An interrupted operation left a lock behind: restic unlock (make sure no concurrent backup is running).

Verifying a backup

restic check (plus --read-data periodically) and a test restore — a backup without a verified restore is not a backup.

Danger zone

forget --prune irreversibly deletes the data of snapshots that fall outside the retention policy — without --prune, snapshots are only hidden from the list. Check your --keep-* conditions first (restic forget --keep-daily 7 --dry-run without --prune shows what would be forgotten). Losing RESTIC_PASSWORD is equivalent to losing the whole repository: the data cannot be decrypted without it, even with full access to the files on disk.

See also

  • rsync — Efficient copying and backup — only changes, over the network and locally.
  • tar — Creating and extracting tar/gz/xz archives; backing up directories.
  • cron — Running tasks on a schedule — classic cron and modern systemd timers.

Found an inaccuracy? Report an error in the article

Lessons on this topic

Topics
Loading…