Backup docker volumes

[dgloukhman]

Is it possible to backup docker volumes to the s3 bucket? I don't see where that option is.
If not how would I access the S3 storage from a scheduled task?

[Procuria]

@dgloukhman I'm not aware of an option in Coolify to do that.

My solution for that is

1. Set up a Duplicati on every server you added to Coolify
2. mount the /var/lib/docker/volumes (or whereve you have your docker_root directory ) into the Duplicati container

volumes:
      - '/var/lib/docker/volumes:/source:ro'

3. configure S3-Provider in Duplicati

4. Backup

[notflip]

This is working perfectly, thanks.

I did have to use AWS SDK, instead of Minio, I'm using Hetzner S3

[MasterPuffin]

@Procuria
I got the error that duplicati could not access the files inside the source folder.
Going into the docker compose file and setting

      - PUID=0
      - PGID=0

did the trick

[endquote]

I tried duplicati but really struggled to get it to stop containers before backups. docker-volume-backup seems like a good option. Here's an example backup up umami's postgresql volume. The compose is from the default recipe, with one service added, and a label added to postgresql to indicate that it should be stopped.

services:
  umami:
    image: 'ghcr.io/umami-software/umami:postgresql-latest'
    environment:
      - SERVICE_FQDN_UMAMI
      - 'DATABASE_URL=postgres://$SERVICE_USER_POSTGRES:$SERVICE_PASSWORD_POSTGRES@postgresql:5432/$POSTGRES_DB'
      - DATABASE_TYPE=postgres
      - APP_SECRET=$SERVICE_PASSWORD_64_UMAMI
    depends_on:
      postgresql:
        condition: service_healthy
  postgresql:
    image: 'postgres:15-alpine'
    volumes:
      - 'postgresql-data:/var/lib/postgresql/data'
    environment:
      - POSTGRES_USER=$SERVICE_USER_POSTGRES
      - POSTGRES_PASSWORD=$SERVICE_PASSWORD_POSTGRES
      - 'POSTGRES_DB=${POSTGRES_DB:-umami}'
    healthcheck:
      test:
        - CMD-SHELL
        - 'pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}'
      interval: 5s
      timeout: 5s
      retries: 10
    labels:
      - docker-volume-backup.stop-during-backup=true
  postgresql-backup:
    image: offen/docker-volume-backup:latest
    restart: always
    environment:
      - AWS_S3_PATH=$BACKUP_AWS_S3_PATH
      - AWS_S3_BUCKET_NAME=$BACKUP_AWS_S3_BUCKET_NAME
      - AWS_ENDPOINT=$BACKUP_AWS_ENDPOINT
      - AWS_ACCESS_KEY_ID=$BACKUP_AWS_ACCESS_KEY_ID
      - AWS_SECRET_ACCESS_KEY=$BACKUP_AWS_SECRET_ACCESS_KEY
    volumes:
      - postgresql-data:/backup/postgresql-data:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro

[brand989]

I spent way too long figuring this out, so hopefully this saves someone time.

After a lot of trial and error, here's what actually worked for me — Duplicati running on a separate server, connecting to the managed server via SSH, stopping all containers before backup, and storing everything in S3.

---

Prerequisites

• Duplicati running on a separate server (not the one being backed up)
• SSH access to the managed server
• S3-compatible storage

---

Step 1 — Allow Duplicati server to SSH into managed server

On your Duplicati server, get the public key:

cat ~/.ssh/id_ed25519.pub

If there is no key yet, generate one:

ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519 -N ""

On the managed server, add it:

echo "<public key>" >> ~/.ssh/authorized_keys

Test from the Duplicati server:

ssh root@<MANAGED_SERVER_IP> "echo ok"

---

Step 2 — Install openssh-client inside Duplicati container

In Coolify UI → Duplicati → Terminal:

apt-get update && apt-get install -y openssh-client

⚠️ You will need to repeat this after every container restart.

Copy the private key from the Duplicati host into the container (run on the host, not inside the container):

docker cp ~/.ssh/id_ed25519 <duplicati_container_name>:/config/.ssh/id_ed25519

Fix permissions inside the Duplicati terminal:

chown abc:abc /config/.ssh
chown abc:abc /config/.ssh/id_ed25519
chmod 600 /config/.ssh/id_ed25519

---

Step 3 — Create stop and start scripts

In the Duplicati terminal:

cat > /config/<SERVER_NAME>-stop.sh << 'EOF'
#!/bin/bash
ssh -i /config/.ssh/id_ed25519 -o StrictHostKeyChecking=no root@<MANAGED_SERVER_IP> "docker stop \$(docker ps -q)"
EOF
chmod +x /config/<SERVER_NAME>-stop.sh

cat > /config/<SERVER_NAME>-start.sh << 'EOF'
#!/bin/bash
ssh -i /config/.ssh/id_ed25519 -o StrictHostKeyChecking=no root@<MANAGED_SERVER_IP> "docker start \$(docker ps -aq)"
EOF
chmod +x /config/<SERVER_NAME>-start.sh

Test both before proceeding:

bash /config/<SERVER_NAME>-stop.sh
bash /config/<SERVER_NAME>-start.sh

---

Step 4 — Configure backup in Duplicati UI

Source Data

• Protocol: SFTP (SSH)
• Server: <MANAGED_SERVER_IP>, Port: 22
• Add two paths: /data/coolify/applications/ and /var/lib/docker/volumes/
• Username: root, Password: leave empty
• Advanced option → ssh-keyfile → /config/.ssh/id_ed25519

Destination — your S3 bucket

Options

• run-script-before-required → /config/<SERVER_NAME>-stop.sh
• run-script-after → /config/<SERVER_NAME>-start.sh

Run a manual backup and check the log.

---

Step 5 — Restore

Go to Duplicati UI → Restore → select all files → destination /backups/restored-backups/ → Submit.

If you get a permissions error:

chown -R abc:abc /backups/

Download to your local machine:

scp -r root@<DUPLICATI_SERVER>:/var/lib/docker/volumes/<duplicati_backups_volume>/_data/restored-backups/ ~/Desktop/

Clean up after downloading:

rm -rf /var/lib/docker/volumes/<duplicati_backups_volume>/_data/restored-backups/*

How to tell which folder is which — the restored folder contains two dupl-ssh-* subfolders:

• Folder with <UUID>/_data/ inside → Volume Mount → restore to /var/lib/docker/volumes/
• Folder with <UUID>/app.db, docker-compose.yaml inside → Directory Mount → restore to /data/coolify/applications/

Restore sequence:

1. Reinstall the server, validate in Coolify, deploy all apps, stop them
2. Directory Mount:

scp ~/Desktop/restored-backups/<applications-folder>/<UUID>/app.db root@<IP>:/data/coolify/applications/<UUID>/

3. Volume Mount:

scp ~/Desktop/restored-backups/<volumes-folder>/<VOLUME_NAME>/_data/<file> root@<IP>:/root/

docker run --rm \
  -v <VOLUME_NAME>:/volume \
  -v /root:/backup \
  busybox \
  sh -c "cp /backup/<file> /volume/<file>"

4. Start all apps and verify.

---

Notes:

• app.db-shm and app.db-wal won't appear in backup if containers were stopped correctly — this is expected
• Keep your Duplicati encryption password somewhere safe