Have the binary inside the docker image. Also use dependencies as provided by Alpine

[ArjenR]

Keeping the binary inside the docker image will make it run without issue on apparmor or selinux hardened systems. Binaries outside of a docker container are not allowed to be executed with default policies.

I went through the code and found that a variable with the backrest binary can be set to override the default location which is in a volume outside of the image.

This is my Dockerfile:

FROM alpine:latest

ARG ARCHITECTURE=Linux_x86_64
ARG VERSION=latest
ARG REPOSITORY_URL=https://github.com/garethgeorge/backrest

RUN apk --no-cache add ca-certificates curl bash openssh restic rclone tzdata && \
    mkdir -p /tmp
RUN echo $VERSION
RUN if [ $VERSION == "latest" ]; then \
      ( echo "Getting latest" ; wget -O - ${REPOSITORY_URL}/releases/${VERSION}/download/backrest_${ARCHITECTURE}.tar.gz | tar -xzf - backrest -C /); \
    else \
      (echo "Getting ${VERSION}" ; wget -O - ${REPOSITORY_URL}/releases/download/${VERSION}/backrest_${ARCHITECTURE}.tar.gz | tar -xzf - backrest -C /); \
    fi

EXPOSE 9898
ENV BACKREST_RESTIC_COMMAND=/usr/bin/restic
ENTRYPOINT ["/backrest"]

It can be used to create a container of the latest or a specific version.

[garethgeorge]

SGTM, I'll update the docker file to include it's own copy of restic. I'd also add that backrest is validated against specific versions of restic, so relying on apk to install the right one might not always be correct (though my understanding is apk's are kept pretty up to date?). Make sure the version of restic you're getting matches the version used by backrest (as set in the installer here)

[ArjenR]

Apparently Alpine is not up-to-date enough. Maybe because the packages are in the community repository. The package for rclone in Alpine stable even needs a security update...

I therefore changed my Dockerfile to pull these packages from de development branch of Alpine. Maybe a rolling release like Arch or Opensuse Tumbleweed is better suited. Currently this is my updated Dockerfile:

FROM alpine:latest

ARG ARCHITECTURE=Linux_x86_64
ARG VERSION=latest
ARG REPOSITORY_URL=https://github.com/garethgeorge/backrest

RUN apk --no-cache add ca-certificates curl bash openssh tzdata && \
    apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/community rclone restic && \
    mkdir -p /tmp
RUN echo $VERSION
RUN if [ $VERSION == "latest" ]; then \
      ( echo "Getting latest" ; wget -O - ${REPOSITORY_URL}/releases/${VERSION}/download/backrest_${ARCHITECTURE}.tar.gz | tar -xzf - backrest -C /); \
    else \
      (echo "Getting ${VERSION}" ; wget -O - ${REPOSITORY_URL}/releases/download/${VERSION}/backrest_${ARCHITECTURE}.tar.gz | tar -xzf - backrest -C /);>
    fi

EXPOSE 9898
ENV BACKREST_RESTIC_COMMAND=/usr/bin/restic
ENTRYPOINT ["/backrest"]

[garethgeorge]

Thanks for sharing this! Latest release now includes a bundled version of restic as well.