PostgreSQL backup and restore for self-hosted applications
A backup exists only when you can restore it. Combine a daily logical dump, an off-host copy and recurring recovery drills.
A Docker volume preserves data when a container is replaced, but it is not a backup. Disk failure, operator error or host encryption can destroy the volume together with the application.
For small installations, start with pg_dump custom format, an encrypted off-host copy and regular restoration into a separate database.
Choose the backup type
A logical dump is portable and convenient for one database. A physical backup plus WAL enables point-in-time recovery but needs compatible versions and more operational care.
- Record the PostgreSQL version with every backup.
- Never copy a live data directory with ordinary cp.
- Back up configuration and secrets separately.
Retention and off-host storage
Use the 3-2-1 model: multiple copies, two media types and at least one off-site location. Encrypt archives and monitor both the job result and output size.
Test the restore
Restore into an empty instance, apply migrations appropriate to the application release and run integrity checks. Record recovery duration and every dependency needed to start.
- Test after major-version changes.
- Never overwrite production during a drill.
- Remove decrypted working data afterward.
Recovery readiness
- The daily job ends successfully.
- An encrypted copy leaves the host.
- Retention contains several points in time.
- A restore has been performed and documented.
Put it into practice
N3X application requirements
Review PostgreSQL versions and deployment requirements for Docker products.
N3X application requirementsFrequently asked questions
Does one configuration fit every environment?
No. Inventory traffic, dependencies and the threat model first, then tighten controls. Verify each change externally and keep a rollback plan.
Where should I start?
Start with a tested backup, current patches and a smaller public attack surface. Then add monitoring and document an owner for every service.
How often should I repeat the review?
After every infrastructure or major-version change and at least quarterly. Monitor critical dependencies, certificates and backup outcomes continuously.