Skip to main content

Database Backup

Open-source project by Gauthier Painteaux

One container to back up every database on a server. A YAML file describes the jobs, and the built-in Go scheduler produces compressed, encrypted dumps and prunes old ones according to your retention policy.

  • Go
  • Docker
  • PostgreSQL
  • MongoDB
View on GitHub(opens in a new tab)
Version
v2.3.1
Stars
1
License
MIT
Updated
# backups.yml
defaults:
  retention_days: 14

encryption:
  method: age
  recipients:
    - age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p

jobs:
  - name: app-db
    type: postgres
    host: app-db
    database: app
    user: backup
    password_file: /run/secrets/app_db_password
    schedule: "0 2 * * *"

  - name: shop-db
    type: mariadb
    host: shop-db
    database: shop
    user: backup
    password_file: /run/secrets/shop_db_password
    schedule: "@daily"

  - name: vault
    type: sqlite
    path: /sources/vault/db.sqlite3
    schedule: "0 3 * * *"
engines: PostgreSQL, MariaDB/MySQL, MongoDB, SQLite
4
image size, with no client preinstalled
~126 MB
published architectures: amd64 and arm64
2
checks for a new Debian base image
4×/day

How Database Backup works

  1. 1

    Validation

    backups.yml is validated at startup.

  2. 2

    Clients

    Only the clients you need are installed.

  3. 3

    Scheduling

    Each job runs on its own cron.

  4. 4

    Dump

    Compressed on the fly, encrypted if needed.

  5. 5

    Rotation

    Old backups are deleted.

Database Backup highlights

  • Four engines

    PostgreSQL (any client version from the PGDG repository), MariaDB/MySQL, MongoDB and SQLite, with a consistent snapshot even during writes.

  • Built-in scheduler

    Cron expressions or shortcuts like @daily, no external cron daemon, with per-job retention.

  • Encryption at rest

    Symmetric GPG or age, with a passphrase or a public key: the container never needs the private key.

  • Non-root, hidden credentials

    Runs as non-root and never exposes credentials on the command line. The healthcheck uses native drivers.

Database Backup tech stack

Go
A single statically compiled binary that embeds the scheduler and the healthcheck’s native drivers.
Debian slim
A lightweight base where each engine’s clients are installed on demand, in the version you want.
GPG and age
Two standard encryption formats you can decrypt without this tool, one of them public-key based.
GitHub Actions
Tests, multi-architecture images and an automatic rebuild when the Debian image changes.

Install Database Backup

  1. 1

    Describe the jobs in backups.yml (here, a SQLite database backed up nightly) and chmod it to 600.

  2. 2

    Mount backups.yml, the backup folder and the source data into the container.

  3. 3

    Run docker compose up -d: compressed dumps land in ./backups.

Full documentation for Greite/database-backup(opens in a new tab)
backups.yml
jobs:
  - name: app
    type: sqlite
    path: /sources/app/app.db
    schedule: "0 3 * * *"
    retention_days: 7
compose.yml
services:
  db-backup:
    image: ghcr.io/greite/database-backup:latest
    restart: unless-stopped
    volumes:
      - ./backups:/backups
      - ./backups.yml:/config/backups.yml:ro
      - ./data:/sources/app:ro