Scheduled backups that survive a crash
Back up containers on a schedule with retention, verify archives, and restore — automatically via the supervisor.
The most important thing a container runtime can do is not lose your data.
cardinal's backup system archives a container's writable overlay and named
volumes on a schedule, prunes old archives, and can encrypt them with
AES-256-GCM.
1. What gets backed up
| Included | Not included |
|---|---|
Named volumes (-v mydata:/path) | Host bind mounts (-v /data/app:/app) |
| Container writable overlay (files created inside) | Image layers (read-only base) |
| Container metadata (ports, env, restart policy) | Runtime state (PID, cgroup) |
SHA-256 checksum sidecar (.sha256) | — |
Databases on named volumes — PostgreSQL, MySQL, Redis — are backed up
completely. Data you keep in a bind mount is managed by you, on the host.
2. Install the scheduler
Backups run inside the systemd supervisor unit:
cardinal bootstrap --install
systemctl status cardinal-bootstrap3. Enable automatic backups
cardinal backup enable minecraft --interval 6h --retention 14| Option | Default | Description |
|---|---|---|
--interval | 24h | How often: 6h, 30m, 1h30m, 7d |
--retention | 7 | Archives to keep (1–1000); older ones are pruned |
--dir | ~/.cardinal/backups/<container> | Custom backup directory |
With --interval 6h --retention 14 a Minecraft server keeps two weeks of
hourly-ish archives and never fills the disk.
4. Manual backup and verify
cardinal backup create minecraft # back up now
cardinal backup list # what's on disk
cardinal backup status minecraft # schedule + last run
cardinal backup verify FILE.tar.gz # check archive + checksum
cardinal backup disable minecraft # stop the schedule5. Restoring
Stop the container, restore the archive, start it again:
cardinal stop minecraft
cardinal backup restore minecraft ~/.cardinal/backups/minecraft/latest.tar.gz
cardinal start minecraft6. Encrypting backups
Backups can be encrypted with AES-256-GCM, so an archive leaking off the
server is useless without the key:
cardinal backup enable minecraft --interval 6h --encryptedPractice a restore on a stopped container quarterly, and rotate encryption
keys on upgrades — a backup you've never restored is a hope, not a plan.
7. Bind mounts: the workaround
If your data lives in a host bind mount (e.g. /data/minecraft:/data),
archive it with the host's own tools — cardinal intentionally leaves bind
mounts alone:
tar -czf mc-backup.tar.gz /data/minecraft/Or export an image as an extra safety net:
cardinal export myapp:v1 -o /data/images/myapp-v1.tar.gz