restic — Overview#

Identity#

Purpose#

Restic is a fast, efficient, and secure backup program written in Go, targeting individuals, sysadmins, and enterprises who need reliable off-site backups. It encrypts all data end-to-end before writing to any storage backend, so even untrusted cloud storage locations can be used safely. Its content-addressable storage model with variable-size chunking means that only new, unique data is transferred and stored, making incremental backups both fast and storage-efficient.

Significance#

Restic is one of the most widely adopted open-source backup tools in the Go ecosystem, with a community forum, active GitHub issues, and a governance document — indicating a mature, well-organized project. It has been under continuous development since 2014 and has shipped regular versioned releases through v0.18.1 (2025). It is frequently cited alongside Borg and Duplicati as a reference implementation for how to build a cryptographically sound, deduplication-aware backup system. Its reproducible-build guarantee (starting at v0.6.1) is notable in the Go ecosystem. The project’s design has influenced how Go practitioners think about content-addressable storage, pluggable backend interfaces, and secure-by-default CLI tools.

Key metrics#

  • Go files: 536 (not counting vendor)
  • Top-level directories: changelog, cmd, contrib, doc, docker, helpers, internal
  • Direct dependencies: 34 (from go.mod require block)
  • First commit / age: ~2014 (BSD license copyright: Alexander Neumann, 2014); changelogs span v0.6.0 (2017) through v0.18.1 (2025)

Notable characteristics#

  • Content-addressable deduplication via CDC: restic uses variable-size content-defined chunking (via the github.com/restic/chunker library, a separate maintained package) to split files into chunks. Chunks are identified by their content hash, stored in pack files, and never duplicated — making incremental backups nearly free for unchanged data.
  • End-to-end encryption as a first-class invariant: every blob written to a backend is encrypted with AES-256-CTR + Poly1305-AES before leaving the machine. The internal/crypto package encapsulates this, and the internal/restic package defines types that make it nearly impossible to accidentally write plaintext to a backend.
  • Interface-driven backend pluggability: the internal/backend package defines a Backend interface that is implemented by 9+ storage drivers (local, sftp, REST, S3/Minio, Azure Blob, GCS, BackBlaze B2, OpenStack Swift, rclone). The main command wires the correct driver at startup, and the rest of the system is backend-agnostic.
  • internal/restic as the domain core: the package internal/restic (29 Go files) defines the canonical domain types — ID, Blob, Snapshot, Node, Pack, Index, FileType — that every other package imports. This is a deliberate inversion of dependencies: backends depend on domain types, not vice versa.
  • FUSE mount for browsing snapshots: the internal/fuse package (12 files) implements a read-only FUSE filesystem over the backup repository, allowing users to browse historical snapshots as a virtual directory tree without a full restore — a significant usability feature with complex concurrency requirements.
Backward Buildkite Agent — Testing restic — Structure Forward