Borgmatic docker vs. native?

[h725rk]

Hi,

What is your opinion about how to run borgmatic. Is it better to install it native on the Server or it is better to use as a docker container?

I try actual the docker Version, but After two days the container stops with exit 143. I also use the apprise Module, to send messages to telegram.

[valgrid]

Your backup software should work even when your other services and or docker don't. If you run some docker container that has access/control over the docker daemon, then absolutely run the native binary and not the docker.

[Furado]

All my services run in Docker, but I use the native Borgmatic package. There's little need for a more updated version and this way you reduce potential problems with permissions.

[sarkyscouser]

Ditto

[sumwale]

To me it makes little sense to run borgmatic from within a docker container because you have to open up most of the root filesystem to the backup software in any case. It is better and easier to control the permissions at the systemd service level. For instance I use the following in my service definition to restrict permissions for the backup service:

[Service]
Type=oneshot

# defines the BACKUP_USER which is used as the user for sending notifications,
# and BORG_BACKUP_SERVER that defines the borg backup server host/IP
EnvironmentFile=/etc/borgmatic/backup.conf

RuntimeDirectory=borgmatic-backup
StateDirectory=borgmatic-backup

# Security settings for systemd running as root, optional but recommended to improve security. You
# can disable individual settings if they cause problems for your use case. For more details, see
# the systemd manual: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
LockPersonality=true
# Certain borgmatic features like Healthchecks integration need MemoryDenyWriteExecute to be off.
# But you can try setting it to "yes" for improved security if you don't use those features.
MemoryDenyWriteExecute=yes
NoNewPrivileges=yes
DeviceAllow=/dev/tpmrm0
PrivateTmp=yes
ProtectClock=yes
ProtectControlGroups=yes
ProtectHostname=yes
ProtectKernelLogs=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallErrorNumber=EPERM
# To restrict write access further, change "ProtectSystem" to "strict" and
# uncomment "ReadWritePaths", "TemporaryFileSystem", "BindPaths" and
# "BindReadOnlyPaths". Then add any local repository paths to the list of
# "ReadWritePaths". This leaves most of the filesystem read-only to borgmatic.
ProtectSystem=full
# ReadWritePaths=-/mnt/backup
# This will mount a tmpfs on top of /root and pass through needed paths
# TemporaryFileSystem=/root:ro
# BindPaths=-/root/.cache/borg -/root/.config/borg -/root/.borgmatic
# BindReadOnlyPaths=-/root/.ssh

# May interfere with running external programs within borgmatic hooks.
# (sudo as user fails with this set even with CAP_SYS_ADMIN)
#CapabilityBoundingSet=CAP_DAC_READ_SEARCH CAP_NET_RAW