From e987f27a621028200a26bd7b5f75ceedbc7d349a Mon Sep 17 00:00:00 2001 From: disaster123 Date: Mon, 14 Sep 2026 22:00:35 +0200 Subject: [PATCH 1/5] Fix links rendered in GitHub Security tab --- docs/security.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/security.md b/docs/security.md index 2b880ad..ba29236 100644 --- a/docs/security.md +++ b/docs/security.md @@ -1,6 +1,6 @@ # BackupDock Security Model -[Documentation index](README.md) · [Main README](../README.md) +[Documentation index](https://github.com/disaster123/BackupDock/blob/main/docs/README.md) · [Main README](https://github.com/disaster123/BackupDock#readme) BackupDock requires privileged access to Docker and host-side persistent data. Treat its configuration, repository credentials, SSH keys, and restored data as sensitive. @@ -21,7 +21,7 @@ BackupDock requires privileged access to Docker and host-side persistent data. T - Repository maintenance such as `forget` and `prune` runs locally on the controller, not through the append-only source endpoint. - Controller and source versions must match exactly before credentials or configuration are sent. -See [Remote Docker Backups](remote-backup.md) for the complete tunnel and rest-server setup. +See [Remote Docker Backups](https://github.com/disaster123/BackupDock/blob/main/docs/remote-backup.md) for the complete tunnel and rest-server setup. ## Container safety @@ -29,7 +29,7 @@ Before stopping a container, BackupDock validates discovery, dependencies, selec Restart is attempted even after backup failure or interruption. Containers that were stopped before the run remain stopped. `SIGKILL` and host failure cannot execute recovery logic. -See [Docker Compose Backup Behavior](backup-behavior.md#safety-behavior) for the full transaction model. +See [Docker Compose Backup Behavior](https://github.com/disaster123/BackupDock/blob/main/docs/backup-behavior.md#safety-behavior) for the full transaction model. ## Restore isolation From be327f77958d69f292db988d93812b7d6a11b9b1 Mon Sep 17 00:00:00 2001 From: disaster123 Date: Mon, 14 Sep 2026 22:01:25 +0200 Subject: [PATCH 2/5] Rename security model documentation --- docs/security-model.md | 38 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) create mode 100644 docs/security-model.md diff --git a/docs/security-model.md b/docs/security-model.md new file mode 100644 index 0000000..2b880ad --- /dev/null +++ b/docs/security-model.md @@ -0,0 +1,38 @@ +# BackupDock Security Model + +[Documentation index](README.md) · [Main README](../README.md) + + +BackupDock requires privileged access to Docker and host-side persistent data. Treat its configuration, repository credentials, SSH keys, and restored data as sensitive. + +## Local mode + +- Run BackupDock with permission to access the Docker Unix socket and every selected source path. +- Protect the Restic password file with root ownership and mode `0600`. +- Keep the repository on independent storage for disaster recovery. +- Use `backupdock backup --dry-run` to inspect sources and planned Docker actions before the first real backup. + +## Remote/controller mode + +- Keep the permanent configuration and all repository credentials on the backup server. +- Bind rest-server to loopback only, require HTTP authentication, and enable `--append-only`. +- BackupDock transfers temporary session configuration and credentials through SSH standard input. +- The source-side session directory is mode `0700`; its temporary configuration is mode `0600` and is removed when the session ends. +- Repository maintenance such as `forget` and `prune` runs locally on the controller, not through the append-only source endpoint. +- Controller and source versions must match exactly before credentials or configuration are sent. + +See [Remote Docker Backups](remote-backup.md) for the complete tunnel and rest-server setup. + +## Container safety + +Before stopping a container, BackupDock validates discovery, dependencies, selected paths, unsupported volumes, AutoRemove containers, ignored-container writers, and writable overlap between groups. + +Restart is attempted even after backup failure or interruption. Containers that were stopped before the run remain stopped. `SIGKILL` and host failure cannot execute recovery logic. + +See [Docker Compose Backup Behavior](backup-behavior.md#safety-behavior) for the full transaction model. + +## Restore isolation + +Test restores use copied data, a new Compose project, an internal network, disabled restart policies, and automatically assigned ports bound to `127.0.0.1`. For stronger isolation from production workloads, restore on a separate Docker host. + +BackupDock does not archive Docker images or rewrite secrets embedded in application files. Restored content should receive the same access protection as production data. From 4e87b65eed1f3e88499c5a4cba12b696185abad6 Mon Sep 17 00:00:00 2001 From: disaster123 Date: Mon, 14 Sep 2026 22:01:26 +0200 Subject: [PATCH 3/5] Update security model links --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 6f4d707..b716ed9 100644 --- a/README.md +++ b/README.md @@ -142,7 +142,7 @@ Read [Restore and Test Docker Compose Backups](docs/restore.md) before running t - Running ignored containers cannot silently write into selected backup data. - Dry-run uses the same orchestration path while suppressing mutations. -Forced process termination or host failure cannot run recovery logic. See the [security model](docs/security.md) and [detailed backup behavior](docs/backup-behavior.md). +Forced process termination or host failure cannot run recovery logic. See the [security model](docs/security-model.md) and [detailed backup behavior](docs/backup-behavior.md). ## Current Limitations @@ -165,7 +165,7 @@ Forced process termination or host failure cannot run recovery logic. See the [s - [Scheduling and maintenance](docs/scheduling.md) - [Restore and recovery](docs/restore.md) - [Upgrade notes](docs/upgrading.md) -- [Security model](docs/security.md) +- [Security model](docs/security-model.md) - [Development and tests](docs/development.md) ## Development From 0a32ed215133403f7e09cfebd5bf3ded350ae516 Mon Sep 17 00:00:00 2001 From: disaster123 Date: Mon, 14 Sep 2026 22:01:27 +0200 Subject: [PATCH 4/5] Update documentation index --- docs/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/README.md b/docs/README.md index 9a15aea..f029f6b 100644 --- a/docs/README.md +++ b/docs/README.md @@ -21,7 +21,7 @@ Start with the quick-start guide, then choose the pages that match the deploymen - [Restore and test Docker Compose backups](restore.md) - [Upgrade notes](upgrading.md) -- [Security model](security.md) +- [Security model](security-model.md) ## Project development From 821c660ad3e839b02900f2f70941f861b8a4cae6 Mon Sep 17 00:00:00 2001 From: disaster123 Date: Mon, 14 Sep 2026 22:01:28 +0200 Subject: [PATCH 5/5] Remove Security Policy alias --- docs/security.md | 38 -------------------------------------- 1 file changed, 38 deletions(-) delete mode 100644 docs/security.md diff --git a/docs/security.md b/docs/security.md deleted file mode 100644 index ba29236..0000000 --- a/docs/security.md +++ /dev/null @@ -1,38 +0,0 @@ -# BackupDock Security Model - -[Documentation index](https://github.com/disaster123/BackupDock/blob/main/docs/README.md) · [Main README](https://github.com/disaster123/BackupDock#readme) - - -BackupDock requires privileged access to Docker and host-side persistent data. Treat its configuration, repository credentials, SSH keys, and restored data as sensitive. - -## Local mode - -- Run BackupDock with permission to access the Docker Unix socket and every selected source path. -- Protect the Restic password file with root ownership and mode `0600`. -- Keep the repository on independent storage for disaster recovery. -- Use `backupdock backup --dry-run` to inspect sources and planned Docker actions before the first real backup. - -## Remote/controller mode - -- Keep the permanent configuration and all repository credentials on the backup server. -- Bind rest-server to loopback only, require HTTP authentication, and enable `--append-only`. -- BackupDock transfers temporary session configuration and credentials through SSH standard input. -- The source-side session directory is mode `0700`; its temporary configuration is mode `0600` and is removed when the session ends. -- Repository maintenance such as `forget` and `prune` runs locally on the controller, not through the append-only source endpoint. -- Controller and source versions must match exactly before credentials or configuration are sent. - -See [Remote Docker Backups](https://github.com/disaster123/BackupDock/blob/main/docs/remote-backup.md) for the complete tunnel and rest-server setup. - -## Container safety - -Before stopping a container, BackupDock validates discovery, dependencies, selected paths, unsupported volumes, AutoRemove containers, ignored-container writers, and writable overlap between groups. - -Restart is attempted even after backup failure or interruption. Containers that were stopped before the run remain stopped. `SIGKILL` and host failure cannot execute recovery logic. - -See [Docker Compose Backup Behavior](https://github.com/disaster123/BackupDock/blob/main/docs/backup-behavior.md#safety-behavior) for the full transaction model. - -## Restore isolation - -Test restores use copied data, a new Compose project, an internal network, disabled restart policies, and automatically assigned ports bound to `127.0.0.1`. For stronger isolation from production workloads, restore on a separate Docker host. - -BackupDock does not archive Docker images or rewrite secrets embedded in application files. Restored content should receive the same access protection as production data.