Konubinix' opinionated web of thoughts



borg serve has special support for ssh forced commands (see authorized_keys example below): it will detect that you use such a forced command and extract the value of the –restrict-to-path option(s).


Allow an SSH keypair to only run borg, and only have access to /path/to/repo.

$ cat ~/.ssh/authorized_keys command=“borg serve –restrict-to-path /path/to/repo”,restrict ssh-rsa AAAAB3[…]

$ cat ~/.ssh/authorized_keys command=“export BORG_XXX=value; borg serve […]",restrict


For remote backups the encryption is done locally - the remote machine never sees your passphrase, your unencrypted key or your unencrypted files.


create progress


The –progress option shows (from left to right)

  • Original (O),
  • Compressed (C),
  • and Deduplicated (D),
  • then the Number of files (N) processed so far,
  • followed by the currently processed path.


–list outputs a list of all files, directories and other file system items it considered (no matter whether they had content changes or not). For each item, it prefixes a single-letter flag that indicates type and/or status of the item.

If you are interested only in a subset of that output, you can give e.g. –filter=AME and it will only show regular files with A, M or E status (see below).

A uppercase character represents the status of a regular file relative to the “files” cache (not relative to the repo – this is an issue if the files cache is not used). Metadata is stored in any case and for ‘A’ and ‘M’ also new data chunks are stored. For ‘U’ all data chunks refer to already existing chunks.

  • ‘A’ = regular file, added (see also I am seeing ‘A’ (added) status for an unchanged file!? in the FAQ)
  • ‘M’ = regular file, modified
  • ‘U’ = regular file, unchanged
  • ‘C’ = regular file, it changed while we backed it up
  • ‘E’ = regular file, an error happened while accessing/reading this file

A lowercase character means a file type other than a regular file, borg usually just stores their metadata:

  • ‘d’ = directory
  • ‘b’ = block device
  • ‘c’ = char device
  • ‘h’ = regular file, hardlink (to already seen inodes)
  • ‘s’ = symlink
  • ‘f’ = fifo


Notes pointant ici