Backup Strategies in 2026: restic, Borg and the 3-2-1 Rule

The 3-2-1 rule remains a useful baseline in 2026: keep three copies of important data, on two different devices, with one copy off-site. The US-CERT guidance is older than today’s ransomware landscape, but the principle still works. The practical question for Linux administrators is which tool should build those copies.

Two mature options stand out: restic 0.19.1 and Borg 1.4.5, both released in July 2026. Each encrypts data on the client and deduplicates content-defined chunks, so a storage provider does not receive plaintext and later runs transfer only changed data. Neither tool includes a scheduler; use systemd timers or cron, and protect the repository password or Borg key separately from the backup.

Choose restic when you want one command-line binary with direct S3, Backblaze B2, SFTP, REST and rclone backends. Its retention workflow is restic forget --keep-daily 7 --keep-weekly 4 --prune, followed by restic check. Borg is a strong fit for SSH-based repositories: run borg prune for retention, then borg compact to reclaim space. Its borg serve --append-only mode can limit destructive actions by a compromised client, but append-only is not the same as storage-layer immutability.

For a stronger 3-2-1-1-0 design, make one copy offline or immutable with a detached disk, object lock, or an appropriately configured append-only service. Do not rush to Borg 2.0: the official project still labels it beta and not for production. Finally, perform a real restore regularly with restic restore or borg extract. A backup you have never restored is a hope, not a recovery plan.

See the restic documentation and Borg documentation for repository, retention and integrity-check details.