Borg and Restic Automate Your Linux Backups Before rm -rf Strikes

An rm -rf / executes in under two seconds. An rm -rf /home in a fraction of one. The only thing standing between your data and permanence is a backup that ran last night. As of June 2026, two open-source tools dominate serious Linux backup: BorgBackup 1.4.4 — released on March 19, 2026 — and Restic 0.18.1 — stable since September 2025, with 0.19.0 scheduled for June 9, 2026.

Borg is the precision instrument: content-defined chunking deduplication, zstd compression, AES-256 encryption, and an append-only mode that makes the repository immutable against ransomware. Restic is the Swiss Army knife: same cryptographic guarantees, but with the ability to push snapshots directly to S3, Backblaze B2, Azure, SFTP, or Google Cloud with no intermediary. A local backup is good. An off-site backup that survives a disk failure or human error is the difference between an incident and a catastrophe.

BorgBackup: the deduplication sniper

BorgBackup splits every file into variable-size chunks based on content — not position. Move a file from one directory to another, and Borg stores nothing new. Change 10 GB of database where only 200 MB actually changed: only 200 MB of new chunks land in the repository. This content-defined chunking deduplication is why a Borg repository with six months of daily snapshots often weighs less than twice the original data size.

The repository is initialized with a single command, using either repokey encryption (the key lives in the repo, protected by the passphrase) or keyfile (the key is an external file). Borg supports four compression algorithms — lz4 (ultra-fast), zstd (balanced), zlib, lzma (high compression) — and an --compression auto,lzma,9 flag for data that compresses poorly, like media files.

# Initialize a Borg repository
borg init -e repokey-blake2 /mnt/backup/borg-repo

# First full backup
borg create --stats --compression zstd,3 \
  /mnt/backup/borg-repo::$(date +%Y-%m-%d_%H:%M) \
  /home /etc /var/lib/docker/volumes

Append-only mode is the anti-ransomware shield. Activated server-side (borg serve --append-only), it prevents any deletion or modification of existing archives — even with the passphrase. An attacker who compromises the client can neither delete snapshots nor corrupt the repository. Retention is managed client-side via borg prune, which applies configurable policies: keep the last 7 days, the last 4 Sundays, the last 12 month-start snapshots.

# Pruning: keep 7 daily + 4 weekly + 12 monthly
borg prune --list \
  --keep-daily=7 --keep-weekly=4 --keep-monthly=12 \
  /mnt/backup/borg-repo

A Borg repository is FUSE-mountable (borg mount), turning your snapshots into a browsable filesystem. Restoring a deleted file becomes a plain cp rather than an arcane command invocation.

Restic: the backup that speaks every cloud

Where Borg requires a local or SSH-accessible repository, Restic speaks natively to over a dozen cloud backends. The same Go binary — 27 MB, zero dependencies — can write to Amazon S3, Backblaze B2, Microsoft Azure Blob, Google Cloud Storage, SFTP, or any rclone-compatible service. This portability is the killer argument for distributed environments: a Hetzner VPS, a Synology NAS, and a Wasabi bucket all share the same workflow.

# Local backup
restic -r /mnt/backup/restic-repo init
restic -r /mnt/backup/restic-repo backup /home /etc

# Backup to Backblaze B2
export B2_ACCOUNT_ID=xxx B2_ACCOUNT_KEY=yyy
restic -r b2:bucket-name:/restic init
restic -r b2:bucket-name:/restic backup /home /etc

# Backup to S3
export AWS_ACCESS_KEY_ID=xxx AWS_SECRET_ACCESS_KEY=yyy
restic -r s3:s3.amazonaws.com/bucket/restic init
restic -r s3:s3.amazonaws.com/bucket/restic backup /home /etc

Restic’s retention policy is more granular than Borg’s. The forget command accepts filters by tags, host, or path, and applies precise rules: --keep-daily 7 --keep-weekly 5 --keep-monthly 12 --keep-yearly 3. prune then cleans up orphaned blobs.

# Restic retention: 7 daily + 5 weekly + 12 monthly + 3 yearly
restic forget --keep-daily 7 --keep-weekly 5 \
  --keep-monthly 12 --keep-yearly 3 --prune

Restic encrypts everything with AES-256-CTR and Poly1305 authentication, just like Borg. The cryptographic surface area difference is marginal: both use battle-tested primitives, both are audited, both support password changes without re-encrypting the entire repository. Restic 0.18.1 benefits from additional pre-upload integrity verification, introduced in 0.17.1, protecting against silent hardware corruption.

Borg vs Restic: the comparison table

Restic has three times the GitHub stars, more active surface-level development (35.2k vs 13.6k stars, more frequent releases), and most importantly, cloud-native portability that Borg lacks. Borg, on the other hand, leads on deduplication maturity and offers an append-only mode that doesn’t depend on backend features — it’s an architectural choice.

The cron script that saves your nights (and days)

A backup that isn’t automated doesn’t exist. Here’s the reference script for Borg, to place in /etc/cron.d/borg-backup or the root crontab (crontab -e). It includes weekly integrity checks and monthly pruning.

#!/bin/bash
# /usr/local/bin/borg-backup.sh
# Run daily at 2 AM
# 0 2 * * * root /usr/local/bin/borg-backup.sh

export BORG_REPO="/mnt/backup/borg-repo"
export BORG_PASSPHRASE="your-long-unique-passphrase"
export BORG_RSH="ssh -i /root/.ssh/borg_key"

borg create --stats --compression zstd,3 \
  --exclude '/home/*/.cache' \
  --exclude '*.tmp' \
  "${BORG_REPO}::$(hostname)-$(date +%Y-%m-%d_%H:%M)" \
  /home /etc /var/lib/docker/volumes /srv 2>&1 | tee -a /var/log/borg-backup.log

# Prune on the first of the month
if [ "$(date +%d)" = "01" ]; then
  borg prune --keep-daily 7 --keep-weekly 4 --keep-monthly 12 "${BORG_REPO}"
fi

# Integrity check on Sunday
if [ "$(date +%u)" = "7" ]; then
  borg check "${BORG_REPO}" 2>&1 | tee -a /var/log/borg-check.log
fi

For Restic, the same principle, but with the flexibility to push to multiple backends simultaneously. This script performs a local backup and a remote copy to Backblaze B2 in two calls. Retention is handled by forget --prune in a single command.

#!/bin/bash
# /usr/local/bin/restic-backup.sh
# 0 3 * * * root /usr/local/bin/restic-backup.sh

export RESTIC_PASSWORD="your-long-unique-passphrase"
export RESTIC_REPOSITORY="/mnt/backup/restic-repo"
export B2_ACCOUNT_ID="xxx"
export B2_ACCOUNT_KEY="yyy"

# Local backup
restic backup --exclude='/home/*/.cache' --exclude='*.tmp' \
  /home /etc /var/lib/docker/volumes /srv 2>&1 | tee -a /var/log/restic-backup.log

# Copy to Backblaze B2 (daily)
restic -r b2:bucket-name:/restic copy --from-repo "${RESTIC_REPOSITORY}"

# Daily retention
restic forget --keep-daily 7 --keep-weekly 5 \
  --keep-monthly 12 --keep-yearly 3 --prune

# Integrity check on Sunday
if [ "$(date +%u)" = "7" ]; then
  restic check --read-data 2>&1 | tee -a /var/log/restic-check.log
fi

Logging is essential. A silent backup that’s been failing for three weeks is worse than no backup — it provides an illusion of safety. The tee -a redirection ensures you see output both in system logs and in the dedicated file. For proactive alerting, add a curl call to a Discord/Slack webhook or Healthchecks.io at the end of the script, conditional on the exit code.

The verdict

If you manage a single server with a local backup disk or a mounted NFS volume, BorgBackup is the best investment of your time. Its deduplication is more aggressive, its built-in append-only mode provides native ransomware protection, and borg mount turns restoration into a trivial operation. The borg-linux-glibc235 fat binary (30 MB) installs with a single cp — no Python, no pip, no virtual environment.

If you have multiple machines spread across different hosting providers, or if your strategy includes mandatory off-site backup (and it should), Restic is the rational choice. Its ability to write directly to S3, B2, or Azure eliminates the intermediate layer of sync scripts, and its single Go binary is even simpler to deploy than Borg’s. The inter-repo copy command simplifies the 3-2-1 strategy (three copies, two media, one off-site) with no additional tools.

In all cases, the worst strategy is waiting for the next rm -rf to remember you needed a backup. Two commands — one to init, one in the crontab — are enough to go from zero to protected. The time it takes to type them is less than the time you’ll spend mourning your lost data.

References

• BorgBackup 1.4.4 Release, borgbackup/borg, March 19, 2026.
• BorgBackup Documentation — Main Features, Borg 1.4.5, readthedocs.io.
• Restic 0.18.1 Changelog, restic/restic, September 21, 2025.
• Restic Documentation, restic 0.19.1, readthedocs.io.
• BorgBackup — Append-Only Mode, Borg documentation.
• Restic — Preparing a New Repository, restic documentation.
• Restic — Scheduling Backups, restic documentation.
• Restic 0.19.0 Release (next version), restic/restic, June 9, 2026.