LifeBytes Journal

Overview

Running containers without root is a big security win, and Ubuntu 24.04 LTS makes it easy with Podman and systemd Quadlet. Podman is a Docker-compatible container engine that works without a daemon, and Quadlet lets you define containers as systemd units for reliable startup, health checks, logging, and auto-updates. In this tutorial, you will set up a rootless container managed by systemd, enable automatic image updates, and learn how to monitor and troubleshoot the service.

Prerequisites

You will need an Ubuntu 24.04 LTS system, a regular user with sudo rights, outbound internet access to pull images, and an open application port above 1024 (rootless containers cannot bind to privileged ports). This guide assumes your username is $USER and that you will host a simple HTTP service on port 8080.

Step 1: Install Podman

Ubuntu 24.04 includes a recent Podman package. Install it via APT and verify the version:

sudo apt update
sudo apt install -y podman
podman --version
podman info

If podman info shows cgroup version 2 and a working network backend, you are good to go. No system-wide daemon is needed.

Step 2: Enable user lingering for systemd

To let your user services keep running after logout, enable lingering and confirm that the user systemd instance is active:

sudo loginctl enable-linger "$USER"
systemctl --user status

If the second command shows a status page, the per-user systemd is ready. Otherwise, log out and back in, or start it by running any user service.

Step 3: Create a Quadlet unit for a sample web app

Quadlet reads unit files from ~/.config/containers/systemd/ and generates corresponding systemd services. Create the directory and a container unit that runs a tiny HTTP server (traefik/whoami) on port 8080:

mkdir -p ~/.config/containers/systemd

cat > ~/.config/containers/systemd/whoami.container <<'EOF'
[Unit]
Description=Rootless whoami demo (Podman + Quadlet)
After=network-online.target
Wants=network-online.target

[Container]
# Image to run
Image=traefik/whoami:latest
# Name the container consistently
ContainerName=whoami
# Map host port 8080 to container port 80
PublishPort=8080:80
# Persist simple state/logs if needed
Volume=%h/containers/whoami:/data:Z
# Health check for systemd readiness
HealthCmd=curl -fsS http://127.0.0.1:80/ || exit 1
HealthInterval=30s
# Timezone for logs
Environment=TZ=UTC
# Auto update from registry when new image is available
AutoUpdate=registry
# Pass any extra runtime args if needed
# ContainerRuntimeArguments=--pids-limit=256

[Service]
# Restart on failure
Restart=on-failure
RestartSec=3

[Install]
WantedBy=default.target
EOF

The AutoUpdate=registry directive is the Quadlet-native way to enable image updates. The PublishPort setting maps host port 8080 to the container’s port 80. The HealthCmd allows systemd to consider the service healthy only after the endpoint responds.

Step 4: Generate and start the systemd service

Reload the user systemd manager to pick up the new Quadlet file, then enable and start the service:

systemctl --user daemon-reload
systemctl --user enable --now whoami.service
systemctl --user status whoami.service

You should now see the service active. Verify the container is running and accessible:

podman ps
curl -s http://127.0.0.1:8080/

The curl output returns headers that include your container’s hostname, confirming the service is up.

Step 5: Enable automatic image updates

Podman provides a built-in timer to auto-update containers based on Quadlet’s AutoUpdate=registry or the io.containers.autoupdate label. Enable the timer:

systemctl --user enable --now podman-auto-update.timer
systemctl --user list-timers | grep podman-auto-update

You can test an update cycle without applying it:

podman auto-update --dry-run

When a new image is available, Podman will pull it and restart only the affected containers, minimizing downtime.

Step 6: Logs, troubleshooting, and lifecycle

To review live logs and diagnose issues, use journalctl and Podman’s own logs. Here are the most useful commands:

journalctl --user-unit whoami.service -f
podman logs -f whoami
systemctl --user restart whoami.service
systemctl --user stop whoami.service

If you change the .container file, always run systemctl --user daemon-reload and then systemctl --user restart whoami.service to apply changes. To remove the service completely, stop and disable it, delete the Quadlet file, and reload:

systemctl --user disable --now whoami.service
rm ~/.config/containers/systemd/whoami.container
systemctl --user daemon-reload
podman rm -f whoami

Step 7: Exposing the service on your network

If you plan to expose the service beyond localhost, open the firewall and bind to the host’s address. With UFW, allow port 8080:

sudo ufw allow 8080/tcp

For production, consider putting this behind a reverse proxy such as Caddy, Nginx, or Traefik for HTTPS termination and rate limiting. Rootless containers cannot bind to ports below 1024, so use a reverse proxy on 443/80 or use auth/stream termination upstream.

Step 8: Tips for production use

Use bind mounts or volumes for persistent data, set resource limits with ContainerRuntimeArguments (CPU/memory/pids), and prefer pinned tags or digests for image stability. For private registries, log in with podman login <registry> and consider CredentialHelpers. Finally, keep Ubuntu patched (using unattended-upgrades), and monitor your services with systemd health checks and alerts.

Conclusion

You have created a secure, rootless container on Ubuntu 24.04 using Podman and systemd Quadlet, enabled automatic image updates, and learned how to manage the service lifecycle with systemd. This pattern makes container workloads feel like first-class system services, while keeping your host safer by avoiding root privileges.

Why restic + S3 is a great backup combo in 2025

Restic is a fast, open-source, and cross-platform backup tool that encrypts data by default and deduplicates efficiently. Pairing restic with an S3-compatible storage such as Backblaze B2 or Cloudflare R2 gives you affordable, durable, and offsite backups. In this step-by-step guide, you will install restic on Linux and Windows, connect it to an S3 bucket, automate backups, and set safe retention and restore procedures.

Prerequisites

You need an S3-compatible bucket, an access key ID and secret, and the bucket’s endpoint. For Backblaze B2, create a bucket and application key in the B2 console; for Cloudflare R2, create an R2 bucket and a token with S3 API access and note the account-specific endpoint (e.g., https://ACCOUNTID.r2.cloudflarestorage.com). Keep these credentials safe.

Install restic

Linux (Ubuntu/Debian/Fedora/Arch): Use your package manager or the official release binary. Example on Ubuntu 24.04: sudo apt update && sudo apt install restic. Verify with restic version. If your distro ships an older version, download the latest from the restic GitHub releases, place it in /usr/local/bin, and make it executable with chmod +x.

Windows 10/11: Download the latest restic .exe from the official releases page and place it in a directory on your PATH (e.g., C:\Tools\restic\ and add that folder to System PATH). Confirm with restic version in Windows Terminal or PowerShell.

Set environment variables securely

Restic reads credentials from environment variables. Create a small environment file you can source (Linux) or a script (Windows). For S3-compatible providers you’ll typically set:

RESTIC_REPOSITORY=s3:s3.amazonaws.com/your-bucket-name
RESTIC_PASSWORD=YourStrongPassphrase
AWS_ACCESS_KEY_ID=AKIA...orR2Key
AWS_SECRET_ACCESS_KEY=YourSecretHere
AWS_DEFAULT_REGION=us-east-1
AWS_ENDPOINT=https://ACCOUNTID.r2.cloudflarestorage.com (only for R2 or other non-AWS S3)

On Linux, store the password in a file for safety and reference it with RESTIC_PASSWORD_FILE=/path/to/pass.txt instead of RESTIC_PASSWORD. On Windows, use a .cmd script that sets these variables before running restic. Avoid committing credentials to Git or sharing them in logs.

Initialize the repository and run a first backup

Export or set your environment variables, then initialize the repo once:

restic init

Back up a test folder:

restic backup ~/Documents --tag initial

Windows users can back up with Volume Shadow Copy to avoid locked-file issues: run the terminal as Administrator and use restic backup C:\Users\YourName\Documents --use-fs-snapshot --tag initial.

Exclude files and speed tips

Create an exclude file to skip caches, node_modules, or VM images that you back up elsewhere. Example entries: *.iso, *.vdi, */.cache/*, */node_modules/*. Then call restic backup /data --exclude-file /etc/restic/excludes.txt --one-file-system. For slower links, cap bandwidth: --limit-upload 4 (MiB/s).

Schedule automatic backups

Linux with systemd: Create a small script at /usr/local/bin/restic-backup.sh that exports variables (or sources an .env file) and runs backup, forget, and prune. Minimal content:

#!/usr/bin/env bash
set -euo pipefail
source /etc/restic/env
restic backup /home /etc --exclude-file /etc/restic/excludes.txt --tag daily
restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 12 --prune
restic check --read-data-subset=1%

Create a service /etc/systemd/system/restic-backup.service:

[Unit] Description=Restic backup
[Service] Type=oneshot ExecStart=/usr/local/bin/restic-backup.sh

Create a timer /etc/systemd/system/restic-backup.timer:

[Unit] Description=Run restic daily
[Timer] OnCalendar=daily Persistent=true
[Install] WantedBy=timers.target

Enable with sudo systemctl enable --now restic-backup.timer. Check status via systemctl list-timers.

Windows with Task Scheduler: Put a script at C:\Scripts\restic-backup.cmd:

set RESTIC_REPOSITORY=s3:s3.amazonaws.com\your-bucket
set RESTIC_PASSWORD_FILE=C:\Scripts\restic-pass.txt
set AWS_ACCESS_KEY_ID=...
set AWS_SECRET_ACCESS_KEY=...
restic backup C:\Users\YourName --use-fs-snapshot --tag daily
restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 12 --prune
restic check --read-data-subset=1%

Create a Basic Task to run daily with highest privileges, start in C:\Scripts, and point to the script. Review the History tab for errors.

Verify, prune, and restore

Use forget + prune to enforce retention (e.g., 7 daily, 4 weekly, 12 monthly). Always run restic check periodically. To see snapshots, run restic snapshots. To restore the latest snapshot to a folder:

restic restore latest --target /restore

On Windows: restic restore latest --target D:\Restores. For a single path inside a snapshot, add --include (e.g., --include "/home/user/Documents").

Health checks and notifications

Add a final step that pings a monitoring URL (e.g., Healthchecks.io) only if the backup succeeded. Append to your script: curl -fsS https://hc.example/ping/UUID. If the cron or timer fails, you’ll get an alert.

Troubleshooting

Repository does not exist: Run restic init with the correct environment, bucket, and endpoint. For Cloudflare R2, set AWS_ENDPOINT and omit a region if required.

Access denied: Check your IAM or API token permissions for list/get/put/delete on the bucket. Ensure the bucket name matches exactly.

Slow or flaky uploads: Use --limit-upload, increase --retry-interval, and ensure no ISP or firewall is blocking the endpoint. Consider enabling object-level lifecycle policies on the provider to reduce storage costs for old versions.

Locked or in-use files on Windows: Run terminal as Administrator and use --use-fs-snapshot.

Security best practices

Use a long, unique passphrase; prefer RESTIC_PASSWORD_FILE over inline passwords. Restrict API keys to the specific bucket. Do not share your password or keys—anyone with both can read your backups. If your provider supports immutability (e.g., B2 Object Lock), consider a write-once policy for ransomware protection and adjust restic operations accordingly.

Wrap-up

You now have encrypted, deduplicated, and automated backups to S3-compatible storage using restic on Linux and Windows. Test restores regularly, monitor your backup jobs, and keep your credentials and retention policies tidy. This setup scales from a single laptop to multiple servers with minimal changes, giving you reliable offsite backups at low cost.

Summary: This guide shows how to back up a Linux server to Backblaze B2 using Restic with Rclone as the transport. You will set up encryption, implement a retention policy, automate runs with systemd timers, and test restores. The result is a fast, encrypted, and low-cost off-site backup that you control.

Why Restic + Rclone + Backblaze B2?

Restic is a modern, deduplicating backup tool with built-in encryption. Rclone provides wide storage compatibility and reliable transfers. Backblaze B2 offers affordable object storage with per-GB pricing. Together, they form a portable, verifiable, and cost-effective backup solution that works on any Linux distribution.

Prerequisites

- A Linux server (Ubuntu/Debian/RHEL/AlmaLinux, etc.) with sudo/root access
- Backblaze B2 account
- Basic terminal familiarity

Step 1: Create a B2 Bucket and Key

1) In Backblaze, create a bucket (e.g., mycompany-backups). Leave it private.
2) Create an Application Key restricted to that bucket. Copy the KeyID and Application Key now; you will not see the secret again.

Step 2: Install Restic and Rclone

sudo apt update && sudo apt install -y restic rclone

On RHEL/Fedora-based systems:
sudo dnf install -y restic rclone

Step 3: Configure Rclone for B2

We will keep Rclone’s config out of your home directory for clarity.

sudo mkdir -p /etc/rclone
sudo chmod 750 /etc/rclone

sudo rclone config create b2 b2 account <KeyID> key <ApplicationKey> hard_delete true --config /etc/rclone/rclone.conf

Verify the config:

sudo rclone lsd b2: --config /etc/rclone/rclone.conf

Step 4: Initialize the Restic Repository (via Rclone)

Create a password file and initialize the repository path inside the bucket.

sudo mkdir -p /etc/restic
echo "choose-a-strong-long-passphrase" | sudo tee /etc/restic/password > /dev/null
sudo chmod 600 /etc/restic/password

Initialize:

sudo env RCLONE_CONFIG=/etc/rclone/rclone.conf restic -r rclone:b2:mycompany-backups/restic --password-file /etc/restic/password init

Step 5: Exclusions and Environment File

Define what not to back up (caches, runtime, VM disks, etc.).

sudo tee /etc/restic/excludes.txt > /dev/null <<'EOF'
/proc/**
/sys/**
/dev/**
/run/**
/tmp/**
/var/tmp/**
/var/cache/**
*.iso
*.img
*.qcow2
EOF

Create an environment file to avoid repeating flags:

sudo tee /etc/restic/restic.env > /dev/null <<'EOF'
RESTIC_REPOSITORY=rclone:b2:mycompany-backups/restic
RESTIC_PASSWORD_FILE=/etc/restic/password
RCLONE_CONFIG=/etc/rclone/rclone.conf
RESTIC_CACHE_DIR=/var/cache/restic
EOF
sudo mkdir -p /var/cache/restic && sudo chown root:root /var/cache/restic && sudo chmod 700 /var/cache/restic

Step 6: Create a Backup Script

This script performs a backup, applies retention, and verifies the repository.

sudo tee /usr/local/bin/restic-backup.sh > /dev/null <<'EOF'
#!/usr/bin/env bash
set -euo pipefail

# Sources to back up (adjust to your server)
SOURCES=(/etc /home /var/www)

# Nice/ionice to reduce system impact
nice -n 10 ionice -c2 -n7 \

env $(grep -v '^\s*#' /etc/restic/restic.env | xargs) \\
restic backup "${SOURCES[@]}" --exclude-file /etc/restic/excludes.txt --tag scheduled --one-file-system

# Retention policy: keep last 7 daily, 4 weekly, 6 monthly
env $(grep -v '^\s*#' /etc/restic/restic.env | xargs) \\
restic forget --prune --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --tag scheduled

# Optional consistency check (weekly via timer, or keep here for every run)
env $(grep -v '^\s*#' /etc/restic/restic.env | xargs) restic check --read-data-subset=1/20 || true
EOF
sudo chmod 750 /usr/local/bin/restic-backup.sh

Step 7: systemd Service and Timer

Create a systemd unit to run the script, and a timer to schedule it daily.

sudo tee /etc/systemd/system/restic-backup.service > /dev/null <<'EOF'
[Unit]
Description=Restic backup to Backblaze B2 (via rclone)
After=network-online.target
Wants=network-online.target

[Service]
Type=oneshot
EnvironmentFile=/etc/restic/restic.env
ExecStart=/usr/local/bin/restic-backup.sh
Nice=10
IOSchedulingClass=best-effort
IOSchedulingPriority=7
PrivateTmp=yes
NoNewPrivileges=yes
ProtectSystem=full
ProtectHome=yes
ProtectKernelLogs=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes

[Install]
WantedBy=multi-user.target
EOF

sudo tee /etc/systemd/system/restic-backup.timer > /dev/null <<'EOF'
[Unit]
Description=Daily Restic backup timer

[Timer]
OnCalendar=03:15
RandomizedDelaySec=20m
Persistent=true

[Install]
WantedBy=timers.target
EOF

sudo systemctl daemon-reload
sudo systemctl enable --now restic-backup.timer

Step 8: First Run and Verification

Trigger a manual run and watch the output:

sudo systemctl start restic-backup.service
sudo journalctl -u restic-backup.service -n 200 -f

List snapshots to confirm:

sudo env $(grep -v '^\s*#' /etc/restic/restic.env | xargs) restic snapshots

Step 9: Tune Retention and Costs

Adjust the restic forget policy to meet recovery objectives and budget. More aggressive pruning reduces storage but limits historical versions. Backblaze B2 costs depend on stored GB, transaction counts, and egress; deduplication in Restic helps keep usage low.

Step 10: Test a Restore

Never trust backups you have not restored. Create a temporary restore folder and recover a small file.

sudo mkdir -p /tmp/restore-test
sudo env $(grep -v '^\s*#' /etc/restic/restic.env | xargs) restic restore latest --target /tmp/restore-test --include /etc/hostname
ls -l /tmp/restore-test/etc/hostname

Security Best Practices

- Use a long, unique Restic password stored in a root-only file.
- Restrict the Backblaze Application Key to one bucket with minimal permissions.
- Enable MFA on your Backblaze account.
- Keep /etc/rclone/rclone.conf and /etc/restic/password mode 600 and owned by root.
- Consider server-side encryption on B2 as a secondary layer if required by policy, although Restic already encrypts data client-side.

Performance Tips

- Parallel uploads: Restic auto-tunes, but you can increase concurrency on bigger servers via RESTIC_OPTIONS like --jobs 4 for backups or use Rclone env vars (RCLONE_B2_UPLOAD_CONCURRENCY).
- Bandwidth limits: Add --limit-upload 4MiB to Restic, or --bwlimit via Rclone if needed.
- Exclude large/ephemeral paths to reduce churn.

Troubleshooting

Fatal: wrong password or no key found: The password in /etc/restic/password does not match the repository. Fix the password file or re-init a new repo.

Repository locked: A previous run crashed. Remove stale locks only when you are certain no job is running:
sudo env $(grep -v '^\s*#' /etc/restic/restic.env | xargs) restic unlock

Slow uploads or timeouts: Check outbound bandwidth, raise concurrency, and ensure your firewall allows long-lived HTTPS connections. Try adding a randomized delay (already in the timer) to avoid contention on shared links.

What You Achieved

You now have an automated, encrypted, off-site backup pipeline for Linux using Restic, Rclone, and Backblaze B2. Snapshots are deduplicated, retention is enforced, and restores are provable. Regularly verify snapshots, monitor storage usage, and adjust policies as your data grows.

Overview

Backups should be encrypted, efficient, and easy to automate. Restic meets all three goals: it is a fast, deduplicating, and end‑to‑end encrypted backup tool that works on Linux, Windows, and macOS. In this guide, you will learn how to back up files to Backblaze B2, schedule automatic runs, set a sensible retention policy, and verify your data. The steps cover both Linux and Windows with actionable commands and clear defaults you can copy and adapt.

Why Restic + Backblaze B2

Restic encrypts everything (including filenames) before it leaves your machine. It also deduplicates data, so repeating backups are small and fast. Backblaze B2 is affordable object storage with predictable pricing and a robust API that restic supports natively. The combination gives you offsite, encrypted, incremental backups you can restore from any machine.

Prerequisites

You need a Backblaze B2 account, a bucket created for backups, and an Application Key with permissions limited to that bucket (read, write, list, delete). Note the Key ID and Key. Decide on a repository path such as b2:my-backups:laptop01 so multiple devices can share one bucket cleanly.

Step 1 — Install Restic

Linux (Debian/Ubuntu): sudo apt update && sudo apt install restic. On other distributions, use your package manager or the official binary release. Verify with restic version.

Windows 10/11: Install via Winget: winget install restic.restic. Or via Chocolatey: choco install restic. Verify with restic version in PowerShell.

Step 2 — Configure Environment and Initialize the Repository

Linux: Export the following environment variables in your shell or place them into a root‑readable file such as /etc/restic/env and source it in your scripts.

export B2_ACCOUNT_ID="YOUR_KEY_ID"
export B2_ACCOUNT_KEY="YOUR_APP_KEY"
export RESTIC_REPOSITORY="b2:my-backups:laptop01"
export RESTIC_PASSWORD_FILE="/etc/restic/pass"

Create the password file with strong permissions and a long random passphrase: sudo install -m 600 /dev/null /etc/restic/pass then sudo sh -c 'openssl rand -base64 48 > /etc/restic/pass'. Initialize the repository: restic init. If successful, you will see “created restic repository.”

Windows: In PowerShell, create C:\restic\env.ps1 with:
$env:B2_ACCOUNT_ID="YOUR_KEY_ID"
$env:B2_ACCOUNT_KEY="YOUR_APP_KEY"
$env:RESTIC_REPOSITORY="b2:my-backups:laptop01"
$env:RESTIC_PASSWORD_FILE="C:\restic\pass.txt"
Generate a passphrase: New-Guid | Out-File C:\restic\pass.txt -Encoding ascii (or choose your own). Then run: powershell -ExecutionPolicy Bypass -File C:\restic\env.ps1; restic init.

Step 3 — Choose What to Back Up and What to Skip

Create an exclude file to avoid caches, temp folders, and large throwaway data. Examples:

# Linux excludes
/proc
/sys
/dev
/tmp
/var/tmp
/var/cache
*.ISO

# Windows excludes
C:\Windows\Temp
C:\Users\*\AppData\Local\Temp
*.iso
*.vhdx

Step 4 — Run Your First Backup

Linux: sudo --preserve-env=B2_ACCOUNT_ID,B2_ACCOUNT_KEY,RESTIC_REPOSITORY,RESTIC_PASSWORD_FILE restic backup /home /etc --exclude-file /etc/restic/excludes --tag baseline. List snapshots with restic snapshots. Sanity‑check data with restic check --read-data-subset=10%.

Windows: Open PowerShell as Administrator, then: powershell -ExecutionPolicy Bypass -File C:\restic\env.ps1; restic backup "C:\Users" "D:\Data" --exclude-file "C:\restic\excludes.txt" --tag baseline. View snapshots with restic snapshots.

Step 5 — Automate Daily Backups (Linux via systemd)

Store environment variables in /etc/restic/env and your excludes in /etc/restic/excludes. Create a systemd service /etc/systemd/system/restic-backup.service with:
[Unit]
Description=Restic backup to B2

[Service]
Type=oneshot
EnvironmentFile=/etc/restic/env
ExecStart=/usr/bin/restic backup /home /etc --exclude-file /etc/restic/excludes --tag daily
Nice=10
IOSchedulingClass=best-effort

Create the timer /etc/systemd/system/restic-backup.timer:
[Unit]
Description=Daily Restic backup

[Timer]
OnCalendar=daily
Persistent=true
RandomizedDelaySec=10m

[Install]
WantedBy=timers.target
Enable and start: sudo systemctl daemon-reload && sudo systemctl enable --now restic-backup.timer.

Step 6 — Retention and Pruning

Keep what you need and trim the rest. A good starting policy keeps a week of daily points, a month of weekly points, and a year of monthly points. Run weekly: restic forget --prune --keep-daily 7 --keep-weekly 4 --keep-monthly 12 --keep-yearly 3. Add this to a separate systemd timer (e.g., restic-prune.timer) or include it after the daily backup on Sundays.

To reduce API load and speed up operations on B2, consider limiting parallel connections when pruning: restic -o b2.connections=8 forget --prune .... You can also set a cache directory to speed up metadata operations: export RESTIC_CACHE_DIR=/var/cache/restic (ensure it’s persistent and has room).

Step 7 — Automate on Windows (Task Scheduler)

Create C:\restic\backup.ps1 with:
. C:\restic\env.ps1
restic backup "C:\Users" "D:\Data" --exclude-file "C:\restic\excludes.txt" --tag daily
restic forget --prune --keep-daily 7 --keep-weekly 4 --keep-monthly 12
Then open Task Scheduler → Create Task → General: Run whether user is logged on or not, run with highest privileges. Triggers: Daily at a quiet hour. Actions: Start a Program → Program/script: powershell → Arguments: -ExecutionPolicy Bypass -File C:\restic\backup.ps1 → Start in: C:\restic.

Step 8 — Restores You Can Trust

List snapshots and pick a point in time: restic snapshots. Restore everything to a safe directory: restic restore latest --target /tmp/restore. Restore only a folder: restic restore latest --target /tmp/restore --include "/home/alex/Documents". On Windows, run the same commands in PowerShell with paths like "C:\Users\Alex\Documents". For browsing, Linux supports FUSE: restic mount /mnt/restic (unmount with fusermount -u /mnt/restic).

Security and Cost Tips

Protect your password file and environment files with strict permissions; never hardcode keys in scripts. Use a bucket‑scoped Application Key limited to your backup bucket. Tag backups (e.g., --tag daily, --tag before-upgrade) to make pruning and auditing easier. Keep your monthly bill predictable by excluding caches and VM images that change often, and by using a sensible retention policy.

Troubleshooting

If you see transient B2 errors (429/503), restic will retry; adding -o b2.connections=4 can help. For permission errors, confirm that your Application Key has delete permissions (needed for pruning). If backups seem slow, verify your excludes and consider running restic check --with-cache during off‑hours. Always test a small restore before you need a big one.

What You Achieved

You now have encrypted, offsite, incremental backups to Backblaze B2 with restic, running on a schedule, pruned to a clear retention policy, and verified for integrity. Keep the password safe, periodically test restores, and you will be ready when hardware fails or ransomware strikes.