--- search: exclude: true --- # Borg Backups ![]() In this tutorial we will look at how we can use borgbackup which is a fantastic alternative to the rsync utility we previously covered: ## **Local Backups** Let's look at a basic usage of borgbackup: root@debian-nginx1:~# apt search borgbackup Sorting... Done Full Text Search... Done backupninja/stable 1.1.0-2.1 all lightweight, extensible meta-backup system borgbackup/stable 1.1.9-2+deb10u1 amd64 deduplicating and compressing backup program borgbackup-doc/stable 1.1.9-2+deb10u1 all deduplicating and compressing backup program (documentation) borgmatic/stable 1.2.11-1 amd64 automatically create, prune and verify backups with borgbackup root@debian-nginx1:~# apt install borgbackup Reading package lists... Done Building dependency tree Reading state information... Done The following additional packages will be installed: fuse libb2-1 libfuse2 libgomp1 python3-llfuse python3-msgpack Suggested packages: borgbackup-doc python-llfuse-doc The following NEW packages will be installed: borgbackup fuse libb2-1 libfuse2 libgomp1 python3-llfuse python3-msgpack 0 upgraded, 7 newly installed, 0 to remove and 0 not upgraded. Need to get 1267 kB of archives. After this operation, 4612 kB of additional disk space will be used. Do you want to continue? [Y/n] y Now that borg has been installed, we will use the 'borg' executable: root@debian-nginx1:~# which borg /usr/bin/borg root@debian-nginx1:~# borg -V borg 1.1.9 We can always get some help from borg itself: root@debian-nginx1:~# borg help usage: borg [-V] [-h] [--critical] [--error] [--warning] [--info] [--debug] [--debug-topic TOPIC] [-p] [--log-json] [--lock-wait SECONDS] [--show-version] [--show-rc] [--umask M] [--remote-path PATH] [--remote-ratelimit RATE] [--consider-part-files] [--debug-profile FILE] [--rsh RSH] <****command> ... required arguments: <****command> mount mount repository serve start repository server process init initialize empty repository check verify repository key manage repository key change-passphrase change repository passphrase create create backup extract extract archive contents export-tar create tarball from archive diff find differences in archive contents rename rename archive delete delete archive list list archive or repository contents umount umount repository info show repository or archive information break-lock break repository and cache locks prune prune archives upgrade upgrade repository format recreate Re-create archives with-lock run user command with lock held config get and set configuration values debug debugging command (not intended for normal use) benchmark benchmark command Now let's first create a directory we want to put our backups into, and let's choose where our important data is: ![](0.png) root@debian-nginx1:~# cd /media/ root@debian-nginx1:/media# mkdir myimportantfiles/ root@debian-nginx1:/media# cd myimportantfiles/ root@debian-nginx1:/media/myimportantfiles# cat /dev/urandom > importantfile1.raw ^C root@debian-nginx1:/media/myimportantfiles# cat /dev/urandom > importantfile2.raw ^C root@debian-nginx1:/media/myimportantfiles# cat /dev/urandom > importantfile3.raw ^C root@debian-nginx1:/media/myimportantfiles# cat /dev/urandom > importantfile4.raw ^C root@debian-nginx1:/media/myimportantfiles# cat /dev/urandom > importantfile5.raw ^C root@debian-nginx1:/media/myimportantfiles# ls -lash total 437M 4.0K drwxr-xr-x 2 root root 4.0K Apr 2 09:05 . 4.0K drwxr-xr-x 3 root root 4.0K Apr 2 09:04 .. 41M -rw-r--r-- 1 root root 41M Apr 2 09:04 importantfile1.raw 44M -rw-r--r-- 1 root root 44M Apr 2 09:04 importantfile2.raw 120M -rw-r--r-- 1 root root 120M Apr 2 09:04 importantfile3.raw 103M -rw-r--r-- 1 root root 103M Apr 2 09:04 importantfile4.raw 130M -rw-r--r-- 1 root root 130M Apr 2 09:05 importantfile5.raw So right now we have some important files totalling 437 Mb in **/media/importantfiles/** and we want to make a backup of it in **/media/backups/** : root@debian-nginx1:/media/myimportantfiles# cd .. root@debian-nginx1:/media# mkdir backups root@debian-nginx1:/media# ls -l total 8 drwxr-xr-x 2 root root 4096 Apr 2 09:07 backups drwxr-xr-x 2 root root 4096 Apr 2 09:05 myimportantfiles So we now init a borg repo with a passphrase root@debian-nginx1:/media# borg init --encryption=repokey /media/backups/borgtest Enter new passphrase: Enter same passphrase again: Do you want your passphrase to be displayed for verification? [yN]: n By default repositories initialized with this version will produce security errors if written to with an older version (up to and including Borg 1.0.8). If you want to use these older versions, you can disable the check by running: borg upgrade --disable-tam /media/backups/borgtest See https://borgbackup.readthedocs.io/en/stable/changes.html#pre-1-0-9-manifest-spoofing-vulnerability for details about the security implications. IMPORTANT: you will need both KEY AND PASSPHRASE to access this repo! Use "borg key export" to export the key, optionally in printable format. Write down the passphrase. Store both at safe place(s). root@debian-nginx1:/media# ls -lash backups/ total 12K 4.0K drwxr-xr-x 3 root root 4.0K Apr 2 09:11 . 4.0K drwxr-xr-x 4 root root 4.0K Apr 2 09:07 .. 4.0K drwx------ 3 root root 4.0K Apr 2 09:11 borgtest Now that's been initialized we will create our first compressed backup: root@debian-nginx1:/media# borg create --stats --progress --compression lz4 /media/backups/borgtest::backup1 /media/myimportantfiles/ Enter passphrase for key /media/backups/borgtest: ------------------------------------------------------------------------------ Archive name: backup1 Archive fingerprint: 471fe9af1851ad679484fe12eef99afa5eb9f73be3272d57d866af12f2185b9e Time (start): Fri, 2021-04-02 09:17:39 Time (end): Fri, 2021-04-02 09:17:48 Duration: 9.39 seconds Number of files: 5 Utilization of max. archive size: 0% ------------------------------------------------------------------------------ Original size Compressed size Deduplicated size This archive: 457.35 MB 459.15 MB 459.15 MB All archives: 457.35 MB 459.15 MB 459.15 MB Unique chunks Total chunks Chunk index: 189 189 ------------------------------------------------------------------------------ And here we have a basic backup of our important files, however let's check out what happens when we add in a new file: root@debian-nginx1:/media# cat /dev/urandom > /media/myimportantfiles/VERYIMPORTANTFILE.RAW ^C root@debian-nginx1:/media# ls -lash myimportantfiles/ total 481M 4.0K drwxr-xr-x 2 root root 4.0K Apr 2 09:22 . 4.0K drwxr-xr-x 4 root root 4.0K Apr 2 09:07 .. 45M -rw-r--r-- 1 root root 45M Apr 2 09:22 VERYIMPORTANTFILE.RAW 41M -rw-r--r-- 1 root root 41M Apr 2 09:04 importantfile1.raw 44M -rw-r--r-- 1 root root 44M Apr 2 09:04 importantfile2.raw 120M -rw-r--r-- 1 root root 120M Apr 2 09:04 importantfile3.raw 103M -rw-r--r-- 1 root root 103M Apr 2 09:04 importantfile4.raw 130M -rw-r--r-- 1 root root 130M Apr 2 09:05 importantfile5.raw Now we create a second backup of it and check out the Duration: root@debian-nginx1:/media# borg create --stats --progress --compression lz4 /media/backups/borgtest::backup2 /media/myimportantfiles/ Enter passphrase for key /media/backups/borgtest: ------------------------------------------------------------------------------ Archive name: backup2 Archive fingerprint: a522d92d01e078f30a2b331dfe595926fc9e33400236a6def931d06fe2136704 Time (start): Fri, 2021-04-02 09:23:47 Time (end): Fri, 2021-04-02 09:23:51 Duration: 4.07 seconds Number of files: 6 Utilization of max. archive size: 0% ------------------------------------------------------------------------------ Original size Compressed size Deduplicated size This archive: 504.31 MB 506.29 MB 47.15 MB All archives: 961.66 MB 965.44 MB 506.30 MB Unique chunks Total chunks Chunk index: 214 401 ------------------------------------------------------------------------------ Basically what happened here was that borg noticed that most files didn't change, and deduplicated them.i This is also true if you move/rename directories, borg will still recognize the files recursively and deduplicate them accordingly. Now let's take a look at our borg repo: root@debian-nginx1:/media# borg list /media/backups/borgtest/ README config data/ hints.8 index.8 integrity.8 nonce root@debian-nginx1:/media# borg list /media/backups/borgtest/ Enter passphrase for key /media/backups/borgtest: backup1 Fri, 2021-04-02 09:17:39 [471fe9af1851ad679484fe12eef99afa5eb9f73be3272d57d866af12f2185b9e] backup2 Fri, 2021-04-02 09:23:47 [a522d92d01e078f30a2b331dfe595926fc9e33400236a6def931d06fe2136704] Here we see our 2 backups, but let's use the same command to look at what is INSIDE of our backups: root@debian-nginx1:/media# borg list /media/backups/borgtest/::backup1 Enter passphrase for key /media/backups/borgtest: drwxr-xr-x root root 0 Fri, 2021-04-02 09:05:28 media/myimportantfiles -rw-r--r-- root root 42889216 Fri, 2021-04-02 09:04:45 media/myimportantfiles/importantfile1.raw -rw-r--r-- root root 46006272 Fri, 2021-04-02 09:04:48 media/myimportantfiles/importantfile2.raw -rw-r--r-- root root 125173760 Fri, 2021-04-02 09:04:51 media/myimportantfiles/importantfile3.raw -rw-r--r-- root root 107610112 Fri, 2021-04-02 09:04:59 media/myimportantfiles/importantfile4.raw -rw-r--r-- root root 135659520 Fri, 2021-04-02 09:05:02 media/myimportantfiles/importantfile5.raw root@debian-nginx1:/media# borg list /media/backups/borgtest/::backup2 Enter passphrase for key /media/backups/borgtest: drwxr-xr-x root root 0 Fri, 2021-04-02 09:22:21 media/myimportantfiles -rw-r--r-- root root 42889216 Fri, 2021-04-02 09:04:45 media/myimportantfiles/importantfile1.raw -rw-r--r-- root root 46006272 Fri, 2021-04-02 09:04:48 media/myimportantfiles/importantfile2.raw -rw-r--r-- root root 125173760 Fri, 2021-04-02 09:04:51 media/myimportantfiles/importantfile3.raw -rw-r--r-- root root 107610112 Fri, 2021-04-02 09:04:59 media/myimportantfiles/importantfile4.raw -rw-r--r-- root root 135659520 Fri, 2021-04-02 09:05:02 media/myimportantfiles/importantfile5.raw -rw-r--r-- root root 46956544 Fri, 2021-04-02 09:22:22 media/myimportantfiles/VERYIMPORTANTFILE.RAW And here we visually see the difference, our second backup contains our new important file. Now let's change the name of our importantfile, and then use borg to export our importantfile and then compare the 2: root@debian-nginx1:/media/myimportantfiles# mv VERYIMPORTANTFILE.RAW VERYIMPORTANTFILE_COPY.RAW root@debian-nginx1:/media/myimportantfiles# cd .. root@debian-nginx1:/media# borg extract /media/backups/borgtest/::backup2 media/myimportantfiles/VERYIMPORTANTFILE.RAW Enter passphrase for key /media/backups/borgtest: root@debian-nginx1:/media# ls backups media myimportantfiles root@debian-nginx1:/media# ls -lash myimportantfiles/ total 481M 4.0K drwxr-xr-x 2 root root 4.0K Apr 2 09:32 . 4.0K drwxr-xr-x 5 root root 4.0K Apr 2 09:35 .. 45M -rw-r--r-- 1 root root 45M Apr 2 09:22 VERYIMPORTANTFILE_COPY.RAW 41M -rw-r--r-- 1 root root 41M Apr 2 09:04 importantfile1.raw 44M -rw-r--r-- 1 root root 44M Apr 2 09:04 importantfile2.raw 120M -rw-r--r-- 1 root root 120M Apr 2 09:04 importantfile3.raw 103M -rw-r--r-- 1 root root 103M Apr 2 09:04 importantfile4.raw 130M -rw-r--r-- 1 root root 130M Apr 2 09:05 importantfile5.raw root@debian-nginx1:/media# md5sum media/myimportantfiles/VERYIMPORTANTFILE.RAW myimportantfiles/VERYIMPORTANTFILE_COPY.RAW 9223c91edef81e0118082e077066ea1e media/myimportantfiles/VERYIMPORTANTFILE.RAW 9223c91edef81e0118082e077066ea1e myimportantfiles/VERYIMPORTANTFILE_COPY.RAW And here we see that our backup'd very important file got exported out, and it is the same as our copy. Now what if we want to create backups but remotely ? ![]() ## **Remote Borg backups via SSH** As the title implies, we want to have a working SSH connection to make our backups regularly: root@debian-nginx1:/media# apt install openssh-server Reading package lists... Done Building dependency tree Reading state information... Done openssh-server is already the newest version (1:7.9p1-10+deb10u2). 0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. rm /etc/ssh/sshd_config wget https://raw.githubusercontent.com/ech1/serverside/master/ssh/sshd_config -O /etc/ssh/sshd_config systemctl restart sshd Here my config will basically enable root login and allow the ssh client to use the ssh key to login. root@debian-nginx1:~# cd ~/.ssh root@debian-nginx1:~/.ssh# ssh-keygen -t ed25519 Generating public/private ed25519 key pair. Enter file in which to save the key (/root/.ssh/id_ed25519): id2_ed25519 Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in id2_ed25519. Your public key has been saved in id2_ed25519.pub. The key fingerprint is: SHA256:YDvJ5BcAxWdVrAJaOez4k97x8c42OO9wtyl4PsmN5Lc root@debian-nginx1 The key's randomart image is: +--[ED25519 256]--+ | .=o. ..o. | | B.o . | | =+=. . | | o=.+... | | .*.S. | | +o. . . | | . o o.O.+. | | . . =+%.oo | | O*=E. | +----[SHA256]-----+ Now the idea here is to move the private ssh key called 'id2_ed25519' to the ssh client's ~/.ssh directory: ![](1.png) Now that we're able to login via ssh, we can do our remote backups from debian2 to debian1: ![](2.png) Last login: Fri Apr 2 09:43:34 2021 from 192.168.0.99 root@debian-nginx1:~# exit logout Connection to 192.168.0.150 closed. root@debian-nginx2:~/.ssh# apt install borgbackup -y Reading package lists... Done Building dependency tree Reading state information... Done The following additional packages will be installed: fuse libb2-1 libfuse2 libgomp1 python3-llfuse python3-msgpack Suggested packages: borgbackup-doc python-llfuse-doc The following NEW packages will be installed: borgbackup fuse libb2-1 libfuse2 libgomp1 python3-llfuse python3-msgpack 0 upgraded, 7 newly installed, 0 to remove and 0 not upgraded. root@debian-nginx2:~/.ssh# borg -V borg 1.1.9 Now we create our remote borg backup repository on our remote host (debian1) into /media/backups/ root@debian-nginx2:~/.ssh# borg init --encryption=repokey root@192.168.0.150:/media/backups/remoteborgtest Enter new passphrase: Enter same passphrase again: Do you want your passphrase to be displayed for verification? [yN]: n By default repositories initialized with this version will produce security errors if written to with an older version (up to and including Borg 1.0.8). If you want to use these older versions, you can disable the check by running: borg upgrade --disable-tam ssh://root@192.168.0.150/media/backups/remoteborgtest See https://borgbackup.readthedocs.io/en/stable/changes.html#pre-1-0-9-manifest-spoofing-vulnerability for details about the security implications. IMPORTANT: you will need both KEY AND PASSPHRASE to access this repo! Use "borg key export" to export the key, optionally in printable format. Write down the passphrase. Store both at safe place(s). Now with this we created our remote borg backup repository remotely through our previously setup SSH connection. So let's actually make a few backups root@debian-nginx2:~# borg create --stats --progress --compression lz4 root@192.168.0.150:/media/backups/remoteborgtest::backup1 /root/ Enter passphrase for key ssh://root@192.168.0.150/media/backups/remoteborgtest: ------------------------------------------------------------------------------ Archive name: backup1 Archive fingerprint: 0e46814dc791d5b0ab7755680288528bfb4a46bce8b6d4e0d9cd2b2b26a5d1ab Time (start): Fri, 2021-04-02 10:30:31 Time (end): Fri, 2021-04-02 10:30:31 Duration: 0.21 seconds Number of files: 16 Utilization of max. archive size: 0% ------------------------------------------------------------------------------ Original size Compressed size Deduplicated size This archive: 501.56 kB 223.19 kB 223.19 kB All archives: 501.56 kB 223.19 kB 223.19 kB Unique chunks Total chunks Chunk index: 17 17 ------------------------------------------------------------------------------ root@debian-nginx2:~# borg list root@192.168.0.150:/media/backups/remoteborgtest Enter passphrase for key ssh://root@192.168.0.150/media/backups/remoteborgtest: backup1 Fri, 2021-04-02 10:30:31 [0e46814dc791d5b0ab7755680288528bfb4a46bce8b6d4e0d9cd2b2b26a5d1ab] root@debian-nginx2:~# borg list root@192.168.0.150:/media/backups/remoteborgtest::backup1 Enter passphrase for key ssh://root@192.168.0.150/media/backups/remoteborgtest: drwx------ root root 0 Fri, 2021-04-02 10:27:01 root -rw-r--r-- root root 570 Sun, 2010-01-31 11:52:26 root/.bashrc -rw-r--r-- root root 148 Mon, 2015-08-17 15:30:33 root/.profile -rw------- root root 9584 Fri, 2021-04-02 09:56:15 root/.viminfo -rw------- root root 2900 Fri, 2021-04-02 09:43:31 root/.bash_history -rwxr-xr-x root root 344 Fri, 2021-04-02 08:10:31 root/backup.sh -rw------- root root 1944 Sat, 2021-03-20 12:46:21 root/.mysql_history -rw-r--r-- root root 480150 Sat, 2021-03-20 10:29:39 root/masterdump.sql drwx------ root root 0 Fri, 2021-04-02 10:27:00 root/.config drwx------ root root 0 Fri, 2021-04-02 10:27:00 root/.config/borg drwx------ root root 0 Fri, 2021-04-02 10:27:00 root/.config/borg/security drwx------ root root 0 Fri, 2021-04-02 10:30:31 root/.config/borg/security/3d40bd9e90f347db8e1d23cbaa37afc4a6ce1f0e3fa8d1599e80b64d55ef0b42 -rw------- root root 0 Fri, 2021-04-02 10:27:01 root/.config/borg/security/3d40bd9e90f347db8e1d23cbaa37afc4a6ce1f0e3fa8d1599e80b64d55ef0b42/tam_required -rw------- root root 1 Fri, 2021-04-02 10:27:01 root/.config/borg/security/3d40bd9e90f347db8e1d23cbaa37afc4a6ce1f0e3fa8d1599e80b64d55ef0b42/key-type -rw------- root root 26 Fri, 2021-04-02 10:27:01 root/.config/borg/security/3d40bd9e90f347db8e1d23cbaa37afc4a6ce1f0e3fa8d1599e80b64d55ef0b42/manifest-timestamp -rw------- root root 53 Fri, 2021-04-02 10:27:01 root/.config/borg/security/3d40bd9e90f347db8e1d23cbaa37afc4a6ce1f0e3fa8d1599e80b64d55ef0b42/location -rw------- root root 16 Fri, 2021-04-02 10:30:31 root/.config/borg/security/3d40bd9e90f347db8e1d23cbaa37afc4a6ce1f0e3fa8d1599e80b64d55ef0b42/nonce drwx------ root root 0 Fri, 2021-04-02 10:27:01 root/.cache drwxr-xr-x root root 0 Fri, 2021-04-02 10:08:55 root/.ssh -rw------- root root 411 Fri, 2021-04-02 07:20:42 root/.ssh/id_ed25519 -rw-r--r-- root root 222 Fri, 2021-04-02 07:27:57 root/.ssh/known_hosts -rw------- root root 411 Fri, 2021-04-02 09:45:10 root/.ssh/id2_ed25519 drwxr-xr-x root root 0 Fri, 2021-04-02 07:42:13 root/myveryimportantdirectory -rw-r--r-- root root 21 Fri, 2021-04-02 07:42:13 root/myveryimportantdirectory/myveryimportanttext.txt And that's it! we have been able to create remote backups thanks to our SSH Connection ## **Advanced Borg usage:** First of all we can setup environnement variables for borg, as well as use name placeholders in the backup name: root@debian-nginx1:/media/backups# export BORG_REPO='/media/backups/borgtest' root@debian-nginx1:/media/backups# export BORG_PASSPHRASE='myverysecretpassword' root@debian-nginx1:/media/backups# borg create --stats --progress --compression lz4 ::{user}-{now} /tmp/ Enter passphrase for key /media/backups/borgtest: ------------------------------------------------------------------------------ Archive name: root-2021-04-02T14:32:42 Archive fingerprint: 7e0547c76922aab5429d3114a41ed355fd068884fefcbcd068e9cfd134979a5b Time (start): Fri, 2021-04-02 14:32:45 Time (end): Fri, 2021-04-02 14:32:45 Duration: 0.09 seconds Number of files: 0 Utilization of max. archive size: 0% ------------------------------------------------------------------------------ Original size Compressed size Deduplicated size This archive: 1.09 kB 699 B 699 B All archives: 961.66 MB 965.44 MB 506.30 MB Unique chunks Total chunks Chunk index: 216 403 ------------------------------------------------------------------------------ Here you can see the backup name **root-2021-04-02T14:32:42** so this means that our placeholders got replaced correctly. Another cool usecase is that we can even backup an entire device (/dev/sda for example) via stdin thanks to the dd binary: root@debian-nginx1:/media/backups# dd if=/dev/sda1 bs=10M | borg create --progress --stats ::sda1-backup2 - dd: failed to open '/dev/sda1': No such file or directory Enter passphrase for key /media/backups/borgtest: ------------------------------------------------------------------------------ Archive name: sda1-backup2 Archive fingerprint: 7e2381b63ec212a5d94fab07206f88e438593fb44cbfcfaa8564d2c0cf9cc3b0 Time (start): Fri, 2021-04-02 14:39:57 Time (end): Fri, 2021-04-02 14:39:57 Duration: 0.02 seconds Number of files: 1 Utilization of max. archive size: 0% ------------------------------------------------------------------------------ Original size Compressed size Deduplicated size This archive: 553 B 598 B 598 B All archives: 961.66 MB 965.44 MB 506.30 MB Unique chunks Total chunks Chunk index: 220 407 ------------------------------------------------------------------------------ we can also display the last backup info: root@debian-nginx1:/media/backups# borg info :: --last 1 Enter passphrase for key /media/backups/borgtest: Archive name: sda1-backup2 Archive fingerprint: 7e2381b63ec212a5d94fab07206f88e438593fb44cbfcfaa8564d2c0cf9cc3b0 Comment: Hostname: debian-nginx1 Username: root Time (start): Fri, 2021-04-02 14:39:57 Time (end): Fri, 2021-04-02 14:39:57 Duration: 0.02 seconds Number of files: 1 Command line: /usr/bin/borg create --progress --stats ::sda1-backup2 - Utilization of maximum supported archive size: 0% ------------------------------------------------------------------------------ Original size Compressed size Deduplicated size This archive: 0 B 0 B 598 B All archives: 961.66 MB 965.44 MB 506.30 MB Unique chunks Total chunks Chunk index: 220 407 We can rename our last backup like so: root@debian-nginx1:/media/backups# borg rename ::sda1-backup2 backup-sda1 Enter passphrase for key /media/backups/borgtest: root@debian-nginx1:/media/backups# borg list Enter passphrase for key /media/backups/borgtest: backup1 Fri, 2021-04-02 09:17:39 [471fe9af1851ad679484fe12eef99afa5eb9f73be3272d57d866af12f2185b9e] backup2 Fri, 2021-04-02 09:23:47 [a522d92d01e078f30a2b331dfe595926fc9e33400236a6def931d06fe2136704] root-2021-04-02T14:32:42 Fri, 2021-04-02 14:32:45 [7e0547c76922aab5429d3114a41ed355fd068884fefcbcd068e9cfd134979a5b] sda1-backup Fri, 2021-04-02 14:39:01 [77b606adbc7e922837c9221239889c51ad65cbc8a6d5bb02849779061e0c27c9] **backup-sda1 Fri, 2021-04-02 14:39:57 [6dcee1382b20b3dffeaa28c6cb5dfd9a84da47b0489342755564fdadc6ad8cfc]** And as you can see, our backup got renamed. If you choose keyfile mode (where the keyfile is only saved locally) you can export your keyfile like so: root@debian-nginx1:/media/backups# borg key export :: --paper To restore key use borg key import --paper /path/to/repo BORG PAPER KEY v1 id: 20 / a7f01e 1ca46b a824f6 / d17fc3 81f204 - fe 1: 86a961 6c676f 726974 686da6 736861 323536 - 14 2: a46461 7461da 00de49 e8ea93 465aab 15b198 - d2 3: 65c814 5d7578 e0b139 a0eba9 a410e2 ac836a - 2c 4: 221068 e8133b a34960 f83c08 f9ef43 b8093a - 16 5: b09b12 603e82 0ecb19 283cf4 fbb27b 33b697 - ab 6: ba3abe a85324 131410 16bc73 e7213f 978eb4 - 9a 7: 33f39f 24b0e8 bade94 ec5466 c11ce0 8f55d8 - 65 8: 9b7b70 27b88d f42a4b 445106 016499 a19166 - ab 9: d4a49a 03c2e9 b9fd89 be6f08 d87ff0 8d9a6e - 3f 10: 7030aa 578b3d db42f3 30f69b 259729 a943e7 - fb 11: 28595b 8e49dd 7bb9ef 5a42a6 6e9def 8d2e35 - 07 12: a3a387 d39140 7232a1 a56d1f 20e31a 54e579 - 3e 13: 2b2adc 1048cf d2508b 760fe3 8828a0 2d5d2a - ea 14: eda9bc 8de122 406245 51590f 11faa4 686173 - db 15: 68da00 20093b 541707 0374c7 7d5d41 1453e0 - 93 16: 3151b0 081588 c4fe9c 763c99 6b7b8b 2e08d1 - e5 17: aa6974 657261 74696f 6e73ce 000186 a0a473 - 15 18: 616c74 da0020 e3859c ea8c8b a59485 cea65f - c7 19: 36ad5b df0ba0 8d4584 85c535 4b71f3 43e8ad - 38 20: 5ffaa7 766572 73696f 6e01 - c6 With this you can do a manual input only backup. If you want to check if your backups are fine, use the following: root@debian-nginx1:/media/backups# borg check -v :: Starting repository check Starting repository index check Completed repository check, no problems found. Starting archive consistency check... Enter passphrase for key /media/backups/borgtest: Analyzing archive backup1 (1/5) Analyzing archive backup2 (2/5) Analyzing archive root-2021-04-02T14:32:42 (3/5) Analyzing archive sda1-backup (4/5) Analyzing archive backup-sda1 (5/5) Archive consistency check complete, no problems found. Here you can also check the difference between 2 backups, what got added or deleted: root@debian-nginx1:/media/backups# borg list Enter passphrase for key /media/backups/borgtest: backup1 Fri, 2021-04-02 09:17:39 [471fe9af1851ad679484fe12eef99afa5eb9f73be3272d57d866af12f2185b9e] backup2 Fri, 2021-04-02 09:23:47 [a522d92d01e078f30a2b331dfe595926fc9e33400236a6def931d06fe2136704] root-2021-04-02T14:32:42 Fri, 2021-04-02 14:32:45 [7e0547c76922aab5429d3114a41ed355fd068884fefcbcd068e9cfd134979a5b] sda1-backup Fri, 2021-04-02 14:39:01 [77b606adbc7e922837c9221239889c51ad65cbc8a6d5bb02849779061e0c27c9] backup-sda1 Fri, 2021-04-02 14:39:57 [6dcee1382b20b3dffeaa28c6cb5dfd9a84da47b0489342755564fdadc6ad8cfc] root@debian-nginx1:/media/backups# borg diff ::backup-sda1 sda1-backup Enter passphrase for key /media/backups/borgtest: root@debian-nginx1:/media/backups# borg diff ::backup1 backup2 Enter passphrase for key /media/backups/borgtest: added 46.96 MB media/myimportantfiles/VERYIMPORTANTFILE.RAW Here we see that the **backup-sda1** and **sda1-backup** backups are the same, however **backup1** and **backup2** have our veryimportantfile.raw file that got added as the difference. You can either export the data from a backup as a whole or you can also just export it as a tar file like so: root@debian-nginx1:/media/backups# borg export-tar --progress ::backup2 backup.tar.gz Enter passphrase for key /media/backups/borgtest: root@debian-nginx1:/media/backups# ls -lash total 482M 4.0K drwxr-xr-x 4 root root 4.0K Apr 2 15:05 . 4.0K drwxr-xr-x 5 root root 4.0K Apr 2 09:35 .. 482M -rw------- 1 root root 482M Apr 2 15:06 backup.tar.gz 4.0K drwx------ 3 root root 4.0K Apr 2 15:06 borgtest 4.0K drwx------ 3 root root 4.0K Apr 2 10:31 remoteborgtest Now from there you can also mount a backup or even the whole repository: root@debian-nginx1:/media/backups# mkdir /tmp/mount root@debian-nginx1:/media/backups# borg mount :: /tmp/mount root@debian-nginx1:/media/backups# borg umount /tmp/mount To do that however you need access to the host OS, a LXC container isn't going to do it. For more information, check out borgbackup's [documentation](https://borgbackup.readthedocs.io/en/stable/).