# Verified compose for restic backup benchmark, tested 2026-10-19 by the SelfHostBench lab (3 runs; the figures are the median).
# Lab host: INTEL(R) XEON(R) PLATINUM 8573C, 2 vCPU, 7.8 GiB RAM, x86_64, Docker 28.0.4.
# Floating image tags below were replaced by the version resolved at test time;
# the registry digest is in the comment on each image line.
# Measurements: backup-restic.json (schema 3).
# Companion env file: backup-restic.env (save it as .env next to this file).
# Secrets are not published: the lab's values are public. In backup-restic.env:
#   RESTIC_PASSWORD is commented out. Uncomment it and set your own value (the comment above it explains how).

# restic 0.19.1: a backup program for the command line. This is the container the SelfHostBench backup benchmark runs restic in, with a local repository on a Docker volume.
# restic is a command, not a service: there is nothing to keep running. The container only stays up (sleep) so that you can run `docker exec restic restic ...`, or point a cron job or
# a systemd timer at it. Most people run restic straight on the host (apt/dnf install restic, or the single binary from github.com/restic/restic/releases) from a timer; this file exists so
# that the numbers on the site can be reproduced with nothing but Docker.
#
# Follows the official image's documentation (restic/restic on Docker Hub, restic.readthedocs.io). Differences, all marked below: a pinned tag, the entrypoint replaced by `sleep infinity`,
# the repository password from .env, and three named volumes (your data, the repository, a place to restore to).
#
# Quick start (after putting a long random RESTIC_PASSWORD in .env):
#   docker compose up -d
#   docker compose exec restic restic init                    # once; creates the repository in /repo (repository format v2, encrypted)
#   docker compose exec restic restic backup /data/src        # first backup, then again whenever you like: only changes are stored
#   docker compose exec restic restic restore latest --target /restore
# RESTIC_REPOSITORY and RESTIC_PASSWORD below are what `restic` reads when you give no -r flag.
# Local repository only. A repository on the same disk as your data is not a backup: point RESTIC_REPOSITORY at another disk, another machine (sftp:, rest:) or object storage (s3:, b2:).
name: restic

services:
  restic:
    image: restic/restic:0.19.1  # sha256:136600b6ff6843d61d355f7f71f460a166429f35de6fd11b568fece3c9a4d510  (version 0.19.1, from exec)
    # The image's entrypoint is `restic` itself. Replaced here so the container stays up; remove this line to run `docker run --rm restic/restic ...` one command at a time.
    entrypoint: ["sleep", "infinity"]
    # restic records the host name in every snapshot and uses it, with the path, to find the previous snapshot (that is how a later backup skips unchanged files).
    # A fixed name keeps that stable when the container is recreated.
    hostname: backup-host
    restart: unless-stopped
    environment:
      RESTIC_REPOSITORY: /repo
      # Encrypts the repository. Set in .env. If you lose it the backups cannot be opened: store it somewhere that is NOT the backed-up machine (a password manager).
      RESTIC_PASSWORD: "${RESTIC_PASSWORD:?set RESTIC_PASSWORD in .env}"
    volumes:
      # What to back up. In real use mount your own data read-only instead, for example `- /srv/photos:/data/photos:ro`. (The lab test changes files in this volume to simulate a second day.)
      - data:/data
      # The repository. In real use this should be on another disk or machine.
      - repo:/repo
      # Where `restic restore` writes.
      - restore:/restore
    healthcheck:
      # restic has no server, so this only checks that the binary is there; the container is "healthy" a few seconds after the start.
      test: ["CMD", "test", "-x", "/usr/bin/restic"]
      interval: 5s
      timeout: 3s
      start_period: 2s
      retries: 3

volumes:
  data:
  repo:
  restore: