How to Install and Configure BorgBackup on Linux for Deduplicated Encrypted Backups

Backing up mission-critical Linux servers, workstations, and network-attached storage requires a delicate balance between data durability, storage capacity, and encryption security. Traditional archive utilities like tar or rsync generate redundant file copies, consuming gigabytes of duplicate storage across incremental snapshots. Furthermore, unencrypted remote backups leave sensitive databases and configuration files vulnerable to unauthorized interception.

BorgBackup (commonly known as Borg) is a premier open-source deduplicating backup program designed specifically for Unix-like operating systems. Borg breaks files into variable-length chunks, calculating cryptographic hashes to store each unique chunk only once across the entire backup history. With native client-side authenticated encryption (AES-256 or ChaCha20-Poly1305), LZ4/ZSTD compression, and SSH network transport, Borg enables fast, secure, space-efficient backups. This guide details how to install Borg on Linux, initialize encrypted repositories, automate incremental backups, prune old archives, and mount snapshots as virtual filesystems.

---

Core Features of BorgBackup

• Chunk-Level Deduplication: Unlike file-level deduplication, Borg splits files into content-defined chunks. If you modify a 10 GB virtual machine disk image or database dump by changing only 20 MB of data, Borg only uploads and stores the changed 20 MB chunk.
• Authenticated Encryption: All data is encrypted on the client machine before transmission or writing to disk. The remote storage server never possesses the decryption keys.
• High-Speed Compression: Supports LZ4 (blazing fast), ZSTD (modern high-ratio), and ZLIB/LZMA compression algorithms applied prior to encryption.
• FUSE Snapshot Mounting: Backup archives can be mounted locally via FUSE, allowing users to browse and restore individual files using standard file managers or CLI tools.

---

Step 1: Installing BorgBackup on Linux

Borg is packaged in standard package repositories across all major Linux distributions and is also available as a standalone precompiled binary.

Method A: On Ubuntu and Debian Systems

sudo apt update
sudo apt install -y borgbackup

Method B: On Fedora, RHEL, and Rocky Linux

sudo dnf install -y epel-release
sudo dnf install -y borgbackup

Method C: On Arch Linux

sudo pacman -S borg

Method D: Standalone Binary (Universal)

To run the latest upstream version on any Linux distribution without package conflicts:

# Download latest standalone 64-bit binary
curl -LO https://github.com/borgbackup/borg/releases/latest/download/borg-linux64
chmod +x borg-linux64
sudo mv borg-linux64 /usr/local/bin/borg

# Verify installation
borg --version

---

Step 2: Initialising an Encrypted Backup Repository

Before creating backups, initialize a target Borg repository on a local disk, external drive, or remote server over SSH.

Local Repository Initialisation

# Create local backup directory
sudo mkdir -p /var/backups/borg-repo
sudo chown -R $USER:$USER /var/backups/borg-repo

# Initialize repository with repokey encryption
borg init --encryption=repokey-blake2 /var/backups/borg-repo

You will be prompted to enter and confirm a secure passphrase. Do not lose this passphrase; without it, data recovery is mathematically impossible.

Remote Repository over SSH

To initialize a repository on a remote backup server (e.g., backup.example.com):

borg init --encryption=repokey-blake2 ssh://[email protected]:22/var/backups/my-server-repo

---

Step 3: Creating an Incremental Backup Archive

To create a new backup snapshot (archive) inside your repository, use the borg create command, naming your archive using a dynamic timestamp:

# Set environment variable for passphrase (convenient for scripts)
export BORG_PASSPHRASE="YourSecurePassphraseHere"

# Create a compressed backup of /etc, /home, and /var/www
borg create --verbose --stats --progress \
  --compression zstd,3 \
  --exclude-caches \
  --exclude '*/.cache' \
  --exclude '*/node_modules' \
  /var/backups/borg-repo::{hostname}-{now:%Y-%m-%d-%H%M%S} \
  /etc \
  /home \
  /var/www

When the backup completes, Borg displays detailed deduplication statistics:

------------------------------------------------------------------------------
Archive name: myhost-2026-10-14-164500
Archive fingerprint: a1b2c3d4e5f6...
Time (start): Wed, 2026-10-14 16:45:01
Duration: 42.15 seconds
Number of files: 84,219
Original size: 14.82 GB
Compressed size: 6.12 GB
Deduplicated size: 6.12 GB (First backup)
------------------------------------------------------------------------------

If you run the exact same command an hour later, the Deduplicated size will only reflect files that actually changed, often completing in mere seconds.

---

Step 4: Listing and Inspecting Archives

To view all historical snapshots stored inside your repository:

borg list /var/backups/borg-repo

To view the specific directory tree and file contents of a specific archive:

borg list /var/backups/borg-repo::myhost-2026-10-14-164500

To compare differences between two historical snapshots:

borg diff /var/backups/borg-repo::archive-day1 archive-day2

---

Step 5: Restoring Files and Mounting Snapshots

Borg offers two flexible file restoration mechanisms:

Method A: Direct Extraction

# Create restore directory
mkdir -p /tmp/restore && cd /tmp/restore

# Extract entire archive
borg extract /var/backups/borg-repo::myhost-2026-10-14-164500

# Or extract a single specific file or directory
borg extract /var/backups/borg-repo::myhost-2026-10-14-164500 etc/nginx/nginx.conf

Method B: Interactive FUSE Mounting

Mount the entire repository as a virtual read-only filesystem to browse snapshots using standard tools (ls, find, cp):

# Create mount point
mkdir -p /mnt/borg

# Mount all repository archives
borg mount /var/backups/borg-repo /mnt/borg

# Browse snapshots
ls -l /mnt/borg

# Unmount when finished
borg umount /mnt/borg

---

Step 6: Automating Pruning and Retention Policies

To prevent backup storage from expanding indefinitely, use borg prune to enforce automated retention policies (such as keeping 7 daily, 4 weekly, and 6 monthly archives):

# Prune older archives based on retention rules
borg prune --verbose --list \
  --keep-daily 7 \
  --keep-weekly 4 \
  --keep-monthly 6 \
  /var/backups/borg-repo

# Compact repository to reclaim freed disk space
borg compact /var/backups/borg-repo

---

Borg Retention and Maintenance Summary Table

Command	Operational Role
borg init	Initializes a new encrypted repository container.
borg create	Creates a new deduplicated, compressed snapshot archive.
borg extract	Restores files and directories from an archive to local disk.
borg mount	Mounts archives as a virtual FUSE filesystem for file inspection.
borg prune	Deletes old archives according to day/week/month retention rules.
borg compact	Frees unreferenced chunk space after pruning.
borg check	Verifies repository integrity and cryptographic chunk checksums.

---

Troubleshooting Common Borg Issues

Issue	Underlying Cause	Resolution
“Repository /path is locked”	Aborted previous run left lockfile active	Verify no other Borg process is actively running: borg break-lock /var/backups/borg-repo.
“Passphrase wrong or key file corrupted”	Incorrect password supplied	Verify BORG_PASSPHRASE variable. Ensure you back up your key file using borg key export.
FUSE mount fails: “fusermount: command not found”	FUSE driver packages missing	Install FUSE utilities: sudo apt install -y fuse3 libfuse3-3 or sudo dnf install -y fuse3.