Live data from Hacker News

BorgBackup 2 has no server-side append-only anymore

github.com

61–70 of 119 posts

Re: BorgBackup 2 has no server-side append-only anymore

#61

I've been using Borg for a while, I've been thinking about looking at the backup utility space again to see what is out there. What backup utilities do you all use and recommend?

restic

Single binary, well supported, dedup, compression, excellent snapshots, can mount a backup to restore a single file easily etc etc.

It's made my backups go from being a chore to being a joy.

Re: BorgBackup 2 has no server-side append-only anymore

#62
post #17

Borg vs Restic vs Kopia ? They are so similar in features. How do they compare? Which to choose?

I use Borg since eight years and it has never let me down. Including a full 8TB disaster restore. It's super resilient to crashes.

When I tested Restic (eight years ago) it was super slow.

No opinion about Kopia, never heard of it.

Re: BorgBackup 2 has no server-side append-only anymore

#63
post #56

Earlier quoted context omitted.

I use rsyncs --link-dest abridged example: rsync --archive --link-dest 2025-06-06 backup_role@backup_host:backup_path/ 2025-06-07/ Actual invocation is this huge hairy furball of an rsync command that appears to use every single feature of rsync as I worked on my backup script over the years. rsync_cmd = [ '/usr/bin/rsync', '--archive', '--numeric-ids', '--owner', '--delete', '--delete-excluded', '--no-specials', '--…

This is cool. Do you always --link-dest to the last directory, and that traverses links all the way back as far as needed?

Yes, this adds a couple of nice features, it is easy to go back to any version using only normal filesysem access and because they are hard links it only uses space for changed files and you can cull old versions without worrying about loosing the backing store for the diff.

I think it sort of works like apples time-machine but I have never used that product so... (shrugs)

Note that it is not, in the strictest sense, a very good "backup" mainly because it is too "online", to solve that I have a set of removable drives that I rotate through, so with three drives, each ends up with every third day.

Re: BorgBackup 2 has no server-side append-only anymore

#64
post #58

Earlier quoted context omitted.

Isn't this "no-delete permission" just a made-up mode for testing the borg storage layer while simulating a lack of permissions for deleting and overwriting? In actual deployment, whatever backing store is used must have the access control primitives to implement such a restriction. I don't know how to do this on a posix filesystem, for example. Gemini gave me a convoluted solution that requires the client to change…

Currently, you can either provide the `BORG_REPO_PERMISSIONS` env var to borg [0] or `--permissions` flag to `borg serve` [1]. You can then enforce this as part of your `authorized_keys` command, for example. [0] https://github.com/borgbackup/borg/blob/3cf8d7cf2f36246ded75... [1] https://github.com/borgbackup/borg/blob/3cf8d7cf2f36246ded75...

Ah, I was searching borgstore for no-delete, but it gets exploded into itemized permissions in borg. Documentation seems to be non-existent, as the only mention seems to be the changelog where it suggests this only exists for testing. But I suppose it's not released yet.

Re: BorgBackup 2 has no server-side append-only anymore

#65

I've been using Borg for a while, I've been thinking about looking at the backup utility space again to see what is out there. What backup utilities do you all use and recommend?

restic Single binary, well supported, dedup, compression, excellent snapshots, can mount a backup to restore a single file easily etc etc. It's made my backups go from being a chore to being a joy.

... also you can point restic at any old SFTP server ...

Re: BorgBackup 2 has no server-side append-only anymore

#66
post #11

It seems the suggested solution is to use server credentials that lack delete permissions (and use credentials that have delete for compacting the repo), but does that protect against a compromised client simply overriding files without deleting them?

no-delete disallows any kind of deleting information, that includes object deletion and object overwriting.

Re: BorgBackup 2 has no server-side append-only anymore

#67
post #5

Borg2 has been in beta testing for a very long time. Anyone knows when will it come out of beta?

The usual answer: "when it is ready".

For low-latency storage (like file: and maybe ssh:) it already works quite nicely, but there might be a lot to do still for high-latency storage (like cloud stuff).

Re: BorgBackup 2 has no server-side append-only anymore

#68
post #58

Earlier quoted context omitted.

This comment needs to be pinned, alongside what the developers say [0] since the change is very misunderstood. > The "no-delete" permission disallows deleting objects as well as overwriting existing objects. [0]: https://github.com/borgbackup/borg/pull/8798#issuecomment-29...

Isn't this "no-delete permission" just a made-up mode for testing the borg storage layer while simulating a lack of permissions for deleting and overwriting? In actual deployment, whatever backing store is used must have the access control primitives to implement such a restriction. I don't know how to do this on a posix filesystem, for example. Gemini gave me a convoluted solution that requires the client to change…

at first it was implemented to easily test permission restricted storages (can't easily test on all sorts of cloud storages).

it was implemented for "file:" (which is also used for "ssh://" repos) and there are automated tests for how borg behaves on such restricted permissions repos.

after the last beta I also added cli flags to "borg serve", so it now also can be used via .ssh/authorized_keys more easily.

so it can now also be used for practical applications, not just for testing.

not for production yet though, borg2 is still in beta.

help with testing is very welcome though!

Re: BorgBackup 2 has no server-side append-only anymore

#69

I've been using Borg for a while, I've been thinking about looking at the backup utility space again to see what is out there. What backup utilities do you all use and recommend?

I still use borg for local backups but use restic for all my offsite backups. Off-hand I don’t think redtic lacks any feature borg has (although there’s probably at least one) after they added compression a few years ago.

Re: BorgBackup 2 has no server-side append-only anymore

#70
post #42

Earlier quoted context omitted.

Glacier Deep Archive is the cheapest cloud backup option at $1USD/month/TB. Google Cloud Store Archive Tier is a tiny bit more.

Both would be pretty expensive to actually restore from, though, IIRC.

Quite expensive, but it should only ever be a last resort after your local backups have all failed in some way or another. For $1/mo/TB you purchase the opportunity to pay an exorbitant amount to recover from an otherwise catastrophic situation.
Post reply on HN