Dockup

The volume is the policy

Opt a volume in with dockup.enable=true and set its schedule, targets and retention right where the data is declared. The policy is versioned with the app that owns it.

Traefik-style, but for backups

Bind mounts are declared per container with grouped labels — dockup.bind.data=/srv/app/data and dockup.data.schedule=hourly — so nothing is duplicated across stacks.

Works with any volume driver

A short-lived helper container mounts the source read-only and streams tar back over the Docker API. No /var/lib/docker parsing, no plugin-volume blind spots, no redeploy when a new volume appears.

Local and S3, in parallel

One spool file is uploaded to every target you name — a NAS and an offsite bucket — with retries, optional checksum verification and per-target reporting.

Deduplicated by retention, not by luck

keep-last, keep-daily, keep-weekly, keep-monthly and a hard max-age cap. The newest archive is never pruned, and pruning is skipped when an upload failed.

Consistent, not merely frequent

Pre-hooks run inside the container (pg_dump), opted-in containers are stopped and always restarted, post-hooks clean up — even when the archive fails.

Encrypted when you ask

zstd or gzip, then age encryption with X25519 recipients or a passphrase. Dockup refuses to write plaintext when a source asks for encryption.

Operable

Prometheus metrics, health and readiness endpoints, SQLite run history, notifications to a webhook, healthchecks.io or Telegram, and a restore that refuses to overwrite a live volume by accident.

Thirty seconds to a first backup

yaml

# compose.yaml
services:
  app:
    image: ghcr.io/example/app
    volumes:
      - appdata:/var/lib/app

  dockup:
    image: gitea.vladfaust.com/vladfaust/dockup:latest
    restart: always
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - dockup-state:/var/lib/dockup
      - ./dockup.yml:/etc/dockup/dockup.yml:ro
      - ./backups:/backups

volumes:
  appdata:
    labels:
      dockup.enable: "true"
      dockup.schedule: daily
      dockup.target: nas
      dockup.keep-daily: "7"
  dockup-state:

yaml

# dockup.yml
targets:
  nas:
    type: local
    path: /backups

That is the whole setup. The volume is discovered, archived on schedule, uploaded and pruned. Volumes created after Dockup started are picked up automatically.

Inspect before you trust

console

$ docker compose run --rm dockup plan
KIND    SOURCE     SCHEDULE           NEXT RUN            TARGETS  RETENTION     ENCRYPT  STOP
volume  appdata    daily (23 3 * * *) 2026-11-03T03:23Z   nas      last=7        no       -

$ docker compose run --rm dockup backup --dry-run
$ docker compose run --rm dockup status --history 5

plan reads the Docker daemon and prints the resolved policy without touching anything. backup --dry-run shows the exact object keys a run would create. status merges the live plan with the recorded history and works even when Docker is unreachable.

Where to go next

Getting started — a full compose file, the configuration file, and the first restore.

Labels — every dockup.* label on volumes and containers, with types and defaults.

Configuration — targets, schedules, encryption, hooks, notifications and environment overrides.

Operations — manual runs, listing, restoring, retention semantics, monitoring and disaster recovery.

Architecture — helper containers, the data path, and why retention buckets by timestamp.

Recipes — PostgreSQL, Nextcloud, offsite S3, and restoring onto a new host.

DockupBackups that live next to your data