9 Essential Restic Backup Commands for Linux Servers

I lost a week of work once because my backup “strategy” was a cron job running rsync to a USB drive that had quietly died three months earlier. A restic backup would have caught that. Restic verifies its data, encrypts everything by default, and deduplicates so well that daily snapshots of a 50 GB home directory barely grow the repository. It has over 35,000 stars on GitHub and it earned them.

This guide covers the nine restic commands I actually use on my servers, from creating a repository to automating nightly runs. Every example works on Debian, Ubuntu, Fedora, and Arch.

Installing Restic

Restic ships as a single static binary, so installation is painless:

# Debian/Ubuntu
sudo apt install restic

# Fedora
sudo dnf install restic

# Arch
sudo pacman -S restic

Distro packages lag behind releases. Once installed, restic can update itself to the latest version:

sudo restic self-update
restic version

At the time of writing that gets you restic 0.18.x. The self-update feature alone puts it ahead of most backup tools, which leave you stuck with whatever your distro shipped two years ago.

1. Create a Repository with restic init

Restic stores everything in a repository: encrypted, deduplicated blobs plus the metadata to reassemble them. Create one on a local disk or external drive:

restic init --repo /mnt/backup/restic-repo

You will be asked for a password. Do not lose it. There is no recovery, no backdoor, no “forgot password” flow. I keep mine in a password manager and a printed copy in a drawer.

The repository can also live on a remote server over SFTP, or on S3-compatible object storage:

restic init --repo sftp:user@backuphost:/srv/restic-repo
restic init --repo s3:s3.amazonaws.com/my-bucket

2. Run Your First Restic Backup

With the repository ready, the restic backup command creates your first snapshot:

restic backup /home/user --repo /mnt/backup/restic-repo

The first run reads everything. After that, restic only uploads changed chunks. On my laptop the initial snapshot of 42 GB took about 12 minutes to a USB 3 drive. The nightly incremental takes under 30 seconds.

Exclude the junk you never want back:

restic backup /home/user --exclude="*.cache" --exclude="node_modules" --exclude-file=/etc/restic/excludes.txt

Set the RESTIC_REPOSITORY and RESTIC_PASSWORD_FILE environment variables and you can drop the flags from every command. That is how the automation section below works.

3. List Snapshots

Each run produces a snapshot with a short ID:

restic snapshots

The output shows the ID, timestamp, hostname, and paths for every snapshot in the repository. You will use those short IDs (like 4bba301e) in almost every other command.

4. Restore Files

Backups you cannot restore are decoration. Restore a full snapshot to a target directory:

restic restore 4bba301e --target /tmp/restore

Or pull back a single file without restoring everything:

restic restore latest --target /tmp/restore --include /home/user/.ssh/config

The latest keyword saves you from looking up IDs when you just need the most recent copy.

5. Browse Snapshots with restic mount

This is the feature that sold me. Mount the whole repository as a filesystem and browse every snapshot like a normal directory tree:

restic mount /mnt/restic-browse

Then cd /mnt/restic-browse/snapshots/latest and copy out whatever you need with plain cp. Behind the scenes restic decrypts blocks on demand through FUSE. When a colleague asks for a file they deleted last Tuesday, this beats any restore command.

6. Verify Restic Backup Integrity

Remember my dead USB drive? This command is the fix. A restic backup can be verified end to end:

restic check
restic check --read-data-subset=10%

Plain check validates the repository structure. The --read-data-subset flag goes further and reads a random 10% of the actual data, confirming the bits on disk still match their checksums. I run the subset check weekly. Over ten weeks that covers most of the repository without hammering the disk every night.

7. Prune Old Snapshots

Snapshots pile up. The forget command applies a retention policy and prune reclaims the space:

restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune

That keeps a week of dailies, a month of weeklies, and six monthlies. Deduplication means even this generous policy uses far less space than seven full copies would. My 42 GB home directory with 90 days of history sits in a 51 GB repository.

8. Compare Snapshots with restic diff

Want to know what changed between yesterday and today? Diff two snapshot IDs:

restic diff 4bba301e 8f2c11a0

The output lists added, removed, and modified files. I have used this to figure out which package upgrade rewrote a config file, and once to spot a log directory that had ballooned overnight. If you need to track down what is eating disk space before it hits your backups, pair this with ncdu for disk usage analysis.

9. Automate Restic Backup Runs with Cron

A backup you have to remember to run is a backup that stops happening. Put the credentials in root-only files and schedule it:

# /etc/cron.d/restic
0 2 * * * root RESTIC_REPOSITORY=/mnt/backup/restic-repo RESTIC_PASSWORD_FILE=/etc/restic/password restic backup /home /etc --quiet

Add a weekly forget --prune line and the weekly check from section 6 and the whole system runs itself. On systemd machines I prefer a timer unit with OnCalendar=daily, since journald then captures the output where I actually look for it. If the machine you are backing up faces the internet, lock it down first. My fail2ban guide covers the basics.

Why Restic Backup Beats Plain Rsync

Rsync copies files. A restic backup does more: encryption at rest, deduplication across snapshots, point-in-time history, and verifiable integrity. Rsync gives you none of that without bolting on extra scripts, and the scripts are where things break.

The honest comparison is with borg, which offers a similar feature set. Borg needs borg installed on the remote end. Restic works against dumb storage: any SFTP server, S3 bucket, or Backblaze B2 account. That flexibility decided it for me. For moving individual files between machines rather than backing them up, croc is the simpler tool.

Start with a local repository on an external drive, get comfortable with restore and mount, then add an off-site target. The official restic documentation covers every backend in detail, and the restic GitHub repository is active if you hit an edge case. Ten minutes of setup now saves the week I lost. Learn from my dead USB drive.