A volume backup is only half a backup. The other half is everything around it: which image, which env, which domains, which mounts, which schedule. If the panel that held that configuration is gone, a bucket full of tarballs is a puzzle.
project.dockxo
Every backup run in dockxo starts by writing project.dockxo to the bucket: every setting and secret of the project — services, env, volumes and mounts, domains and redirects, backup plans — sealed with a passphrase you set on the plan. Sealing uses scrypt to derive the key and AES-256-GCM to encrypt, so the file is useless to anyone who has the bucket but not the passphrase, including us. Next to it sits a plain run.json with the summary: when, what, how big.
A plan may back up the config only, which is a cheap way to have a daily snapshot of a project’s shape even when its volumes are large.
What a run does with data
Volumes are packed on their own server and uploaded straight to the bucket in 16 MB parts. The panel never sees the bytes and memory stays flat, so a 200 GB volume does not need 200 GB of RAM anywhere. A managed MariaDB is backed up as a consistent SQL dump while it keeps running. Other services can be paused while their files are copied; a container left paused by an interrupted backup is resumed when the agent starts.
Restoring
Projects → Restore lists every backup found in a bucket, grouped by project. Pick a run, enter the passphrase, and review what will come back: services, volumes, domains, the data saved in that run, and which of your servers each source server maps to (matched by IP, then by name, editable).
The project is recreated as a new project with every service’s settings, env, mounts, domains, redirects and backup plans. Ticked volumes are refilled and SQL dumps loaded, then services are deployed in dependency order: database primaries, replicas, routers, apps, caches, balancers. Volumes you did not back up come back empty with the same settings.
This works on the panel that made the backup and on a fresh one that has never seen the project. The bucket is the source of truth.
Where the buckets live
Amazon S3, Cloudflare R2, Backblaze B2, Wasabi, Hetzner Object Storage, MinIO — anything S3-compatible. Buckets are tested when you add them under Settings → Storage and the secret is stored encrypted. Old runs past a plan’s retention are deleted from the bucket by the panel.