---
title: Backrest Docker Stop
description: A bash script that stops Docker containers before a Backrest backup runs and restarts them after, ensuring safe database backups without complex dumps.
---


:ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}

[Backrest](https://github.com/garethgeorge/backrest) is a fantastic backup tool. In the case of [Serveex](https://docu.djeex.fr/en/serveex/introduction), most of the data that needs to be backed up consists of containers, and those containers often include databases.  

The problem? You can’t safely back up a database while it’s running. There are plenty of complex solutions involving database dumps, but often the simplest method is to stop the containers, perform the backup, and then restart them.

**Backrest** doesn’t natively provide this functionality, but it does allow the execution of custom scripts triggered by events, for example, at the start and end of a backup plan. Our goal is to stop the containers whose databases need to be backed up when the backup plan starts, and restart them when the backup plan finishes.To achieve this, we’ll need a small Bash script and a secure connection between Backrest and the Docker socket, to enable the following sequence:

- The backup plan starts  
- The event triggers the execution of a custom script  
- The script contacts Docker and retrieves a list of containers labeled `backrest.backup.stop=true`  
- It stops those containers  
- The backup plan completes  
- The event triggers another custom script  
- The script contacts Docker again, retrieves the same list, and restarts those containers  

## Securely Connecting Backrest and Docker

To allow **Backrest** to communicate securely with Docker, we’ll use [Docker Socket Proxy](https://github.com/linuxserver/docker-socket-proxy).  
This avoids exposing the full Docker socket and grants only the necessary permissions.  
Here’s an example Docker stack:

```yaml [compose.yaml]
---
services:
  backrest:
    image: garethgeorge/backrest:latest
    container_name: backrest
    hostname: backrest
    security_opt:
      - no-new-privileges:true
    volumes:
      - ...  # your volumes
    environment:
      - ...  # your environment variables
      - DOCKER_HOST=tcp://socket-proxy-backrest:2375
    restart: unless-stopped
    ports:
      - ...  # your ports
    depends_on:
      - socket-proxy

  socket-proxy:
    image: lscr.io/linuxserver/socket-proxy:latest
    container_name: socket-proxy-backrest
    security_opt:
      - no-new-privileges:true
    environment:
      - CONTAINERS=1
      - ALLOW_START=1
      - ALLOW_STOP=1
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    restart: unless-stopped
    read_only: true
    tmpfs:
      - /run
```

With this setup, Backrest can communicate with Docker safely and securely.

## The Scripts

Below are the scripts to use for **Backrest**’s *start* and *end* backup events.

::code-group
```sh [Stop]
#!/usr/bin/env bash

BACKUP_LABEL="backrest.backup.stop=true"
BACKUP_CONTAINERS=$(docker ps -aqf "label=$BACKUP_LABEL")
for BC in $BACKUP_CONTAINERS
do
    docker stop "$BC"
done
sleep 10
```

```sh [Start]
#!/usr/bin/env bash

BACKUP_LABEL="backrest.backup.stop=true"
BACKUP_CONTAINERS=$(docker ps -aqf "label=$BACKUP_LABEL")
for BC in $BACKUP_CONTAINERS
do
    docker start "$BC"
done
sleep 10
```
::

## The Label

Once the scripts are in place and configured for the proper **Backrest** hooks, you just need to add the label `backrest.backup.stop=true` to the `compose.yaml` files of the containers that should stop and restart during backups:

```yaml [compose.yaml]
---
services:
  your_service:
    ...
    labels:
      - backrest.backup.stop=true
```

And that’s it!  
At the next backup, all containers with the correct label will automatically stop during the backup and restart once it’s finished.
