Recommended Free Tools
For a Dockerized Linux VPS, the best backup is a recovery system, not a copy of one container. Back up your Compose files and secrets, every named volume and bind mount, and application-consistent database exports. Keep an encrypted copy outside the VPS, then prove that a clean host can be rebuilt from it. Restic is the strongest general default for a headless server; Borg with Borgmatic is better when declarative jobs and database hooks matter most; Duplicati fits teams that require browser-based administration and can protect its own configuration.
What a complete Docker VPS backup must contain
A container image is replaceable. The information that makes the service yours is not. A failure-resistant plan therefore covers three data layers at the same time and records enough host information to recreate them.
As an Amazon Associate I earn from qualifying purchases.
1. Deployment and reconstruction data
- Docker Compose files, override files, image tags, network definitions and restart policies.
- Environment files, TLS material, application secrets and password files required to start the stack. Store these in an encrypted backup and restrict who can read them.
- Reverse-proxy configuration, firewall rules, custom scripts, systemd units or timers, and any host-level configuration used by the backup itself.
- A short runbook describing DNS changes, package prerequisites, network creation, restore order and service-specific initialization.
Without this layer, a volume archive may contain the data but not the instructions needed to attach it to the right service. Record image versions or digests where reproducibility matters; a later image may migrate a database or change its file format.
2. Persistent Docker data
Back up every named volume and every host directory mounted into a container. Docker volumes live outside a container’s writable layer and survive container replacement, which is why they are normally used for persistent application data. A bind mount is equally important even though it is just a directory on the VPS: omitting it can remove uploads, certificates, configuration or media while leaving the container apparently healthy.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Inventory mounts from the Compose definition and from the running stack before writing the job. Include volume names, source paths, destination paths, read-only flags and ownership information. A backup that captures only /var/lib/docker/volumes can still miss bind mounts elsewhere on the filesystem.
3. Application-consistent database exports
A live database directory is not automatically a valid backup. Files can be changing while the archiver reads them, and a crash-consistent copy may require recovery that your restore process has not tested. Generate a logical export or use a controlled stop/snapshot procedure, then archive that export with the Compose files and volume data.
- PostgreSQL: use
pg_dump(and preserve the command, role information and connection details needed for import). - MySQL or MariaDB: use
mysqldumpor the database’s documented logical-export method. - SQLite: use the application’s documented export or stop the service before copying the database; a file copy while writes are active is not a reliable substitute.
Run the dump and the file backup as one workflow so the dump, uploaded Compose configuration and related files describe the same application state. Put credentials and restore commands in a protected runbook rather than in a publicly readable script.
Restic, Borg with Borgmatic, Duplicati and tar: at a glance
| Option | What it does well | Where it needs extra care | Best fit |
|---|---|---|---|
| Restic | Encrypted, deduplicated snapshots; scriptable; local repositories plus SFTP, REST, Amazon S3, S3-compatible storage, Backblaze B2, Azure Blob, Google Cloud Storage and rclone-backed targets. | Database dumps, application quiescing and retention policy need wrapper scripts or hooks. Repository password and backend credentials must be protected. | A small or medium headless VPS that needs an off-host repository and simple automation. |
| Borg + Borgmatic | Deduplicating archives with configuration-driven jobs; Borgmatic adds declarative scheduling and database-dump hooks. | Active containers and databases still require consistency controls. You must understand the repository workflow and protect the configuration. | Operators who want explicit configuration, mature repository checks and integrated dump orchestration. |
| Duplicati | Web-oriented administration and published Docker images; remote backup data can rebuild its local database. | Its persistent /data directory, encryption key and service credentials are part of the recovery plan. Losing local metadata can make normal operation and diagnostics harder. |
Teams that value browser-based management and accept the additional state that the backup service itself introduces. |
| Docker-native tar export | Simple, portable building block for copying a volume through a temporary container; useful for emergency migration. | No retention, encryption, off-site replication, scheduling, repository verification or database consistency by itself. | A one-off migration, a bootstrap copy or a component inside a larger scripted system—not a complete backup policy. |
Choose on more than deduplication ratio. The decisive axes are database hooks and consistency controls, remote destinations, encryption and credential handling, scheduling and alerting, restore speed, portability, operational complexity and whether a web interface is essential.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Restic: the practical default for a headless VPS
Why it is a strong default
Restic creates encrypted, deduplicated snapshots and can write them to a local repository or to several off-host backends. SFTP is convenient when you control a separate server; S3-compatible storage and other object-storage targets are useful when the repository must be in a different failure domain. Its command-line design fits cron, systemd timers and CI-style checks without requiring a resident web service on the production host.
Restic does not know whether a database is transactionally consistent. Treat it as the repository layer and put database exports, stop/start actions and application quiescing in a wrapper.
A repeatable Restic job
- Prepare a separate repository. Set the repository address and password through protected environment variables or files. Initialize it once, preferably on storage that is not attached to the VPS’s normal failure domain.
- Create database exports. Run the PostgreSQL, MySQL/MariaDB or application-specific export into a protected staging directory. Check the command’s exit status and record the dump timestamp.
- Capture configuration and persistent paths. Include the Compose project directory, secret material required for reconstruction, all named-volume mount points and every bind-mounted directory. Exclude caches and temporary files only after confirming that the application can regenerate them.
- Run the snapshot. Use one script that fails if the dump fails, then invokes Restic with the repository and all source paths. Keep the staging directory inside the selected source set or add it explicitly.
- Apply retention deliberately. Keep daily, weekly and monthly snapshots according to the service’s recovery-point requirement, then prune only after a successful backup. A retention policy is a business decision, not a safe default supplied by the tool.
- Verify the repository. Schedule repository checks and occasionally restore a sample file. A successful upload proves transport, not that every object can be read or that the application can start.
- Clean up secrets and dumps. Remove temporary plaintext exports after the snapshot, retain logs without passwords, and ensure the backup account can perform only the operations it needs.
Restic-specific failure points
- A lost repository password can make encrypted snapshots unrecoverable even when the storage account still exists. Store the password in a separate protected recovery location.
- Backing up only
/var/lib/docker/volumesmisses bind mounts and deployment files. - Running a snapshot while a database writes can produce an unusable data directory. Use the logical dump or stop/snapshot method described above.
- Putting the only repository on the same VPS protects against accidental deletion less than it protects against hardware loss, disk corruption or a compromised host. Keep another copy off-host when the data matters.
Borg and Borgmatic: configuration-first backup orchestration
What the combination adds
Borg is a deduplicating archiver. Borgmatic supplies a declarative configuration layer, scheduling integration and hooks for database dumps. A configuration can describe the Compose project, Docker volume data, bind-mounted directories and the commands that create PostgreSQL or MySQL exports before the archive runs.
Borg’s own guidance is explicit about live workloads: “Dump databases or stop the database servers.” It also notes that a Docker-specific image operation may help in some situations, but copying active application files blindly is not a consistency strategy. Treat the archive as valid only after the application’s writes have been coordinated.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Designing a Borgmatic job
- Define the repository on separate storage and protect its passphrase and transport credentials.
- List the Compose directory, each named-volume source and each bind mount as archive sources. Do not rely on a container’s writable layer to hold irreplaceable data.
- Add pre-backup database hooks that write dumps to a known staging directory. Make the archive depend on successful hook completion.
- Include the dump directory and the reconstruction runbook in the archive, with permissions that prevent other users from reading secrets.
- Configure retention, pruning and repository checks in the same declarative file so a new host can reproduce the policy.
- Run a restore test with the same configuration, extracting into an isolated directory before touching production.
This approach is attractive when an audit trail of exactly what is backed up matters. The trade-off is a larger configuration surface: repository access, hooks, service credentials and restore commands all need documentation and testing.
Duplicati: when a web interface is worth the extra state
Duplicati publishes Docker images and presents a browser-oriented workflow. That can reduce the barrier for a team that does not want to maintain shell scripts, but the backup application becomes another service that must itself be recoverable.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallPersist Duplicati’s recovery data
Its Docker guidance stores persistent configuration and data under /data. Back up that directory along with the encryption key and the credentials used to reach the remote destination. If the service is recreated without them, the remote files may still exist while the settings needed to operate the job do not.
Duplicati documents its local database as a compact view of the remote backup data that can be rebuilt from those remote files. Preserve the local database anyway: doing so improves routine operation, browsing and diagnostics and reduces the time needed to get the service working after a host replacement.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Operational trade-offs
- Advantage: browser-based administration is useful for teams that need to inspect jobs without logging into the VPS shell.
- Cost: the web service, its
/datadirectory, encryption key and credentials add another dependency to the restore plan. - Consistency: schedule database exports or controlled application stops around the Duplicati job; a graphical interface does not make a live database copy safe.
- Security: restrict the administration interface, use strong credentials and avoid exposing it directly to the public internet when an authenticated tunnel or private network is available.
Docker’s tar export: useful building block, incomplete policy
Docker documents a volume-copy pattern that uses a temporary container, --volumes-from and tar. The temporary container mounts the source container’s volumes, streams an archive to the host or another destination, and a reverse operation extracts that archive into a newly created volume.
Typical volume-copy sequence
- Stop the application or put it into its documented maintenance mode so files are not changing during the copy.
- Start a temporary utility container with the source container’s volumes attached using
--volumes-from. - Run
tarinside the utility container and write the archive to a host-mounted backup directory. - Record the volume name, image version, Compose service and ownership details beside the archive.
- For restoration, create the destination volume, attach it to a temporary container, extract the archive, then attach the volume to the recreated service.
This method is portable and valuable for an emergency migration, but an unencrypted tar file on the same VPS is not a backup strategy. Add off-site replication, retention, integrity checks, encryption and database exports—or place the tar operation inside Restic or Borgmatic.
Database consistency: the rule that prevents plausible but broken restores
Coordinate the database and file layers
Application files and a database often refer to each other by IDs, filenames or timestamps. If the database dump comes from one point in time and uploads or configuration come from another, the restored service may start while silently losing relationships. Generate the dump, capture the associated files and archive the Compose state in one controlled run.
Choose a method per engine
- Logical dump: preferred when the database supports a reliable export command and the restore window is acceptable.
- Controlled stop: stop the database container, archive its files, and start it again. This is simple but creates downtime.
- Application export: use the documented export when the application owns important metadata outside the raw database.
- Filesystem snapshot: use only when the database and storage stack document crash-consistent snapshots and you have tested recovery.
Never assume that an archive command’s zero exit status means the database is restorable. Import a dump into an isolated database and run representative queries during the restore drill.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Where to store the repository
Use at least one destination outside the VPS. A separate server reached over SFTP, an S3-compatible bucket, or another supported object-storage backend changes the failure domain. Restic supports SFTP, REST, Amazon S3, S3-compatible storage, Backblaze B2, Azure Blob, Google Cloud Storage and rclone-backed targets; Borg repositories can likewise be hosted on separate infrastructure through the transport methods you operate.
- Use a dedicated backup identity with the minimum read/write permissions required by the job.
- Keep repository encryption keys and passwords separate from the storage credentials.
- Enable provider-side versioning or immutability only when you understand its deletion and recovery behavior.
- Monitor storage growth, failed jobs, authentication errors and repository-check results.
- Maintain a second copy for data whose loss would exceed the recovery-point objective.
Do not confuse off-site storage with an immutable backup. A compromised VPS can still use overly broad credentials to delete a remote repository, so limit permissions and consider a destination that requires a separate administrative identity for deletion.
Build a reliable backup workflow on a Linux VPS
- Inventory the stack. Export the Compose configuration, list every service, image, network, named volume and bind mount, and identify which services own databases.
- Define recovery objectives. Decide how much data you can lose (the recovery-point objective) and how long the service may be unavailable (the recovery-time objective). These choices determine schedule, retention and destination.
- Write the restore runbook first. Include a clean-host prerequisite list, Docker installation method, network creation, secret restoration, volume creation, database import and dependency order.
- Select the repository tool. Use Restic for a scriptable encrypted snapshot workflow, Borgmatic for configuration and hooks, or Duplicati when browser administration outweighs the added service state.
- Stage consistent exports. Dump each database or stop it according to its documented procedure. Fail the job if any export fails.
- Archive all required paths. Include Compose and host automation files, secrets, named volumes, bind mounts, database dumps and the runbook.
- Send the encrypted backup off-host. Use least-privilege credentials and a destination in a separate failure domain.
- Verify and alert. Run repository checks, test extraction and alert on non-zero exits, missing dumps, authentication failures or unusual archive sizes.
- Prune only after success. Apply retention after a verified snapshot, never before. Keep enough history to cover delayed discovery of corruption or accidental deletion.
- Exercise recovery. Restore to a clean host or isolated directory on a schedule and update the runbook with elapsed time and every manual action.
Restoring after a VPS failure
Perform the first drill without modifying the production repository. A disposable host or isolated directory exposes missing secrets, wrong ownership and hidden dependencies while the original service is still available.
- Prepare the host. Install the required operating-system packages and Docker components, create the administrative account, and secure SSH and firewall access.
- Retrieve the repository. Install the selected backup client, provide the repository address and password from the protected recovery location, and verify that the repository can be listed and checked.
- Restore reconstruction files. Extract the Compose project, environment and secret material, reverse-proxy configuration, scripts and systemd units into their intended paths. Preserve ownership and restrictive permissions.
- Recreate the Docker network. Use the network names and driver settings from the Compose definition before starting services that expect them.
- Create and populate volumes. Create each named volume, extract its archive into the volume, and restore bind-mounted directories to their recorded host paths. Confirm UID/GID ownership before starting applications.
- Start infrastructure first. Bring up the database and supporting services, then import the logical dumps. Do not start application containers that will write to an empty database before the import is complete.
- Start services in dependency order. Launch the database, queues and storage services, then the application and reverse proxy. Watch logs for migrations, permission errors and missing environment variables.
- Validate behavior. Test administrator and ordinary-user logins, create or read a representative record, download a stored file, exercise background jobs and confirm HTTPS termination.
- Measure the result. Record repository download time, database import time, manual steps and any data that could not be restored. Update the runbook and adjust the recovery objective if it was unrealistic.
A green scheduled job is not evidence that a service can be recovered. Only a successful restore with application-level checks demonstrates that the backup is useful.
Scheduling, observability and maintenance
Schedule around workload and recovery objectives
Run database exports often enough to meet the acceptable data-loss window, then run the file snapshot immediately afterward. A single daily job may be adequate for a low-change site; a busy service may need more frequent logical dumps while retaining less frequent full snapshots. Avoid overlapping jobs that compete for disk, CPU or database locks.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Make failures visible
- Return a non-zero status when a dump, archive, upload, prune or repository check fails.
- Log start and end times, snapshot identifiers, source paths and byte counts without logging passwords or secret contents.
- Alert when the newest successful snapshot is older than the recovery-point objective.
- Alert on sudden size changes, because an empty dump or omitted mount can produce an unusually small archive.
- Review storage consumption and retention after application upgrades, media growth or database migrations.
Revisit the plan after changes
Adding a Compose service, moving a bind mount, changing a database engine or rotating secrets can invalidate an otherwise healthy job. Treat the inventory and restore runbook as configuration that changes with the application.
Common mistakes and their fixes
| Symptom | Likely cause | Fix |
|---|---|---|
| The container starts but uploads or settings are missing. | A bind mount or named volume was omitted. | Rebuild the mount inventory from Compose and the running containers; add every source path to the archive. |
| The database starts with errors after extraction. | An active data directory was copied without a consistent dump or stop. | Use a logical export or controlled stop/snapshot and import it during restoration. |
| The backup exists but cannot be opened. | Repository password, encryption key or backend credentials were not preserved. | Store recovery credentials separately, test access periodically and document who can retrieve them. |
| A restored service cannot connect to another container. | The Docker network or service naming was not recreated. | Restore Compose network definitions and start dependencies in order. |
| Only the backup VPS is lost and so is the repository. | The repository was stored in the same failure domain. | Replicate to a separate host or object-storage destination. |
| Duplicati jobs open with missing settings. | The /data directory, encryption key or credentials were not backed up. |
Persist and restore Duplicati’s configuration state as part of the recovery plan. |
| A tar archive restores files but no history exists. | Docker’s export was used as the entire policy. | Wrap the export in an encrypted repository with retention, off-site copies, checks and scheduling. |
Which solution should you choose?
Choose Restic when
- The VPS is headless and you prefer a small command-line tool.
- You need encrypted deduplicated snapshots on SFTP or object storage.
- You are comfortable writing a wrapper for database dumps, service quiescing and alerts.
Choose Borg with Borgmatic when
- You want the backup definition, retention and database hooks expressed declaratively.
- Your team values explicit repository checks and a mature archive workflow.
- You can maintain the additional configuration and understand Borg’s consistency requirements.
Choose Duplicati when
- Browser-based administration is a material requirement.
- You will persist its
/datadirectory and protect its encryption key and service credentials. - You accept that the backup service itself must be included in restore testing.
Use Docker tar export when
- You need a quick volume migration or emergency copy.
- You are placing it inside a larger system that supplies encryption, off-site storage, retention, verification and database consistency.
Bottom line for a Linux VPS
Back up the deployable definition, persistent storage and database exports as one coordinated job. Put an encrypted repository outside the VPS, restrict its credentials and test a clean-host restore. Restic is the most balanced starting point for most headless deployments; Borg plus Borgmatic is the better fit for configuration-heavy operations and database hooks; Duplicati is reasonable when a web interface justifies preserving its own state. Docker’s tar method remains useful, but only as a migration primitive or a component of a complete policy.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
