Backblaze 64 Personal Wine Community Container

This Docker container runs the Backblaze personal backup client via WINE, so that you can back up your files with the separation and portability capabilities of Docker on Linux.

It runs the Backblaze client and starts a virtual X server and a VNC server with Web GUI, so that you can interact with it.

⚠️ This project is not affiliated with Backblaze Inc. ⚠️

Table of Content

• Backblaze 64 Personal Wine Community Container
  • Table of Content
  • Project Status
  • Known Limitations
  • Docker Images
    • Content
    • Tags
    • Platforms
  • Environment Variables
  • Config Directory
  • Ports
  • Volumes
  • Accessing the GUI
  • Security
    • SSVNC
    • Certificates
    • VNC Password
    • DH Parameters
  • Installation Guide
  • Additional Information
  • Credits

Project Status

This docker should just work for most people. But if you for example have a complex permissions setup in the filesystem you are trying to back up you will need good knowledge of docker to get it set up.

Still please be attentive during the install process: The docker by design has read/write access to all the data you are trying to back up and if you make a grave mistake you could delete stuff.

Known Limitations

Backblaze 10.x (64-bit, Windows 10-only) installs, signs in, and backs up reliably under Wine. Two caveats are worth knowing — neither corrupts or blocks your backups:

• Upload speed is limited by Backblaze-on-Wine, not the container or your network. An iperf3 test from inside the container reaches full line speed, so the bottleneck is the Backblaze client itself: the 10.x upload path is several times slower per thread under Wine than the old 9.x client, and Backblaze's heuristic for spawning more upload threads misreads an idle box and under-spawns. Raising the thread count under Settings → Performance helps a lot — the work is network-wait-bound, so over-subscribing threads well beyond your CPU core count is fine here (the usual "stay under your core count" advice is for native machines and does not apply). Throughput is also far lower while grinding through many small files than on large ones, so expect it to climb as the backup progresses. See upstream #212 for details and a community workaround (adding CPU load to coax Backblaze into spawning more upload threads).

• "Permission Issue … bzdata\bzreports" warning. A false positive: Backblaze's permission self-check misbehaves under Wine, but it writes to that directory fine and backups run normally. Safe to ignore.

The control panel previously rendered unstyled (black background, blank dialog text). That turned out not to be an unfixable GDI+ incompatibility: bzbui.exe references its hi-DPI skin assets with hyphenated names (*-4x.gif) while the bypass install ships them underscored (*_4x.gif), so the skin failed to load and the main window couldn't build. The container now creates the hyphen-named aliases at startup, so the panel renders correctly on first launch.

Backblaze's installer — and, more importantly, its in-app self-update — runs a .NET MSI custom action (CheckVersions) inside rundll32.exe. Under Wine's Windows 8.1+ "version lie", an unmanifested process is told it is running Windows 8 (6.2) regardless of what the registry reports, so that check aborts with MajorVerTooOld / "unsupported OS" even though the prefix is forced to Windows 10. The first install sidesteps this by bypassing the MSI (it drives bzdoinstall.exe directly), but a self-update runs the MSI itself. The container therefore writes an external rundll32.exe.manifest declaring a Windows 10/11 supportedOS into system32 and syswow64 at startup and enables PreferExternalManifest, so GetVersionEx reports the real version and self-updates do not break on the OS gate.

Docker Images

Content

Here are the main components of this image:

• S6-overlay, a process supervisor for containers.
• x11vnc, a X11 VNC server.
• xvfb, a X virtual framebuffer display server.
• openbox, a windows manager.
• noVNC, a HTML5 VNC client.
• NGINX, a high-performance HTTP server.
• stunnel, a proxy encrypting arbitrary TCP connections with SSL/TLS.
• WINE, a compatibility layer for windows applications on Linux
• Winetricks is a helper script to download and install various redistributable runtime libraries needed to run some programs in Wine
• Backblaze Personal Backup

Tags

LTS policy. The image tracks the two most recent Ubuntu LTS releases at a time. The older of the two is the default (latest), chosen for stability; the newer ships alongside (currently ubuntu26) so problems can be found and fixed before it ever becomes the default. Interim bugfixes and base/runtime uplifts are released against both as they land. When an LTS reaches end of support it is retired — the newer LTS becomes the new default and the next LTS is added as the early-access variant. So latest always points at a mature, well-supported LTS, while the newer-LTS tag lets you opt in early if you want it.

The older ubuntu22 / ubuntu20 / ubuntu18 variants are no longer published.

Platforms

As Backblaze runs on Windows and MacOS, there is no point in supporting these platforms.

Environment Variables

Environment variables can be set by adding one or more arguments -e "<VAR>=<VALUE>" to the docker run command.

Config Directory

Inside the container, wine's configuration and with it Backblaze's configuration is stored in the /config/wine/ directory.

This directory is also used to store the VNC password. See the VNC Pasword section for more details.

Ports

Here is the list of ports used by container. They can be mapped to the host via the -p <HOST_PORT>:<CONTAINER_PORT> parameter. The port number inside the container cannot be changed, but you are free to use any port on the host side.

Volumes

A minimum of 2 volumes need to be mounted to the container

• /config - This is where Wine and Backblaze will be installed
• Backup drives - these are the locations you wish to backup, any volume that is mounted as /drive_driveletter (from d up to z) will be mounted automatically for use in Backblaze with their equivalent letter, for example /drive_d will be mounted as D:. Mount these read-write - Backblaze creates a .bzvol folder in each drive's root, so a read-only mount will fail (the volume can't be tracked or its backup state inherited).

You can mount drives with different paths, but these will need to be mounted manually within wine using the following method

1. Add your storage path as a wine drive, so Backblaze can access it

   docker exec --user app Backblaze64 ln -s /backup_volume/ /config/wine/dosdevices/d:
   

2. Restart the docker to get Backblaze to recognize the new drive

   docker restart Backblaze64
   

3. Reload the Web Interface

   

Accessing the GUI

Assuming that container's ports are mapped to the same host's ports, the graphical interface of the application can be accessed via:

• A web browser:

http://<HOST IP ADDR>:5800

• Any VNC client:

<HOST IP ADDR>:5900

Security

By default, access to the application's GUI is done over an unencrypted connection (HTTP or VNC).

Secure connection can be enabled via the SECURE_CONNECTION environment variable. See the Environment Variables section for more details on how to set an environment variable.

When enabled, application's GUI is performed over an HTTPs connection when accessed with a browser. All HTTP accesses are automatically redirected to HTTPs.

When using a VNC client, the VNC connection is performed over SSL. Note that few VNC clients support this method. SSVNC is one of them.

SSVNC

SSVNC is a VNC viewer that adds encryption security to VNC connections.

While the Linux version of SSVNC works well, the Windows version has some issues. At the time of writing, the latest version 1.0.30 is not functional, as a connection fails with the following error:

ReadExact: Socket error while reading

However, for your convienence, an unoffical and working version is provided here:

https://github.com/jlesage/docker-baseimage-gui/raw/master/tools/ssvnc_windows_only-1.0.30-r1.zip

The only difference with the offical package is that the bundled version of stunnel has been upgraded to version 5.49, which fixes the connection problems.

Certificates

Here are the certificate files needed by the container. By default, when they are missing, self-signed certificates are generated and used. All files have PEM encoded, x509 certificates.

NOTE: To prevent any certificate validity warnings/errors from the browser or VNC client, make sure to supply your own valid certificates.

NOTE: Certificate files are monitored and relevant daemons are automatically restarted when changes are detected.

VNC Password

To restrict access to your application, a password can be specified. This can be done via two methods:

• By using the VNC_PASSWORD environment variable.
• By creating a .vncpass_clear file at the root of the /config volume. This file should contains the password in clear-text. During the container startup, content of the file is obfuscated and moved to .vncpass.

The level of security provided by the VNC password depends on two things:

• The type of communication channel (encrypted/unencrypted).
• How secure access to the host is.

When using a VNC password, it is highly desirable to enable the secure connection to prevent sending the password in clear over an unencrypted channel.

Access to the host by unexpected users with sufficient privileges can be dangerous as they can retrieve the password with the following methods:

• By looking at the VNC_PASSWORD environment variable value via the docker inspect command. By defaut, the docker command can be run only by the root user. However, it is possible to configure the system to allow the docker command to be run by any users part of a specific group.
• By decrypting the /config/.vncpass file. This requires the user to have the appropriate permission to read the file: it has to be root or be the user defined by the USER_ID environment variable. Also, to be able to retrieve the correct decryption key, one needs to know that the content of the file was generated by x11vnc.

DH Parameters

Diffie-Hellman (DH) parameters define how the DH key-exchange is performed. More details about this algorithm can be found on the OpenSSL Wiki.

DH Parameters are saved into the PEM encoded file located inside the container at /config/certs/dhparam.pem. By default, when this file is missing, 2048 bits DH parameters are automatically generated. Note that this one-time operation takes some time to perform and increases the startup time of the container.

Installation Guide:

1. Understand, that this docker is a volunteer project, not a commercial product. Some thinkering is to be expected, community based solution finding is encouraged in the issues. If something does not work: look for an open issue about the topic, if there isn't create one. If there is one read through it to see if somebody has found a workaround/fix. If you are a developer I highly encourage you to turn your fix into a Pull Request to allow others to benefit from it.

2. Check for yourself if using this docker complies with the Backblaze terms of service

3. Modify the following for your setup (in terms of ports, volumes and environment variables) and run it

   (for Unraid users, instead of running this command navigate to the Apps tab, search for this docker and install it)

   NOTE: root priviliges may be needed

   docker run \
       -p 8080:5800 \
       --init \
       --name Backblaze64 \
       -v "[backup folder]/:/drive_d/" \
       -v "[config folder]/:/config/" \
       ghcr.io/iamfoz/backblaze-personal-wine:latest
   

4. Open the Web Interface (on the port you specified in the docker run command, in this example 8080):

5. You may see wine being updated, this will take a couple of minutes

   

6. The UI of the first step of the Backblaze installer is broken on wine, but it doesn't matter, just insert the email to your backblaze account into the input field. (If the UI does not load for you, look in the top left corner for a white pixel. Move your mouse pointer over that pixel, the pixel will go away, and the UI should load.)

   

7. Press Enter

   

8. Insert your password (important: keyboard locale mismatches can mess up your inputs)

   • TIP: You can use the clipboard function of the web interface, but some passwords will still not get transferred correctly, i would reccommend setting your backblaze password to a long string without special characters

   

9. Press Enter

   

10. Wait for Backblaze to analyze your drives

    

11. Click Ok

    

12. If your [config folder] is somewehere inside the [backup folder] on the docker host side (which is the case for the Unraid template) in order to prevent an infinite loop of config file uploads, because those uploads change bz_done* files in [config folder]/wine/drive_c/ProgramData/Backblaze/bzdata/bzbackup/bzdatacenter open the web interface, open the Backblaze settings, open the "Exclusions" tab, click on "Add Folder" and in the popup navigate to My Computer -> (D:) and naviagate to the config folder inside. For unraid template installs this is My Computer -> (D:) -> appdata -> Backblaze64. Click on OK and close the Backblaze Settings.

13. The Installation is done 🎉

14. Buy a license for your Computer in the Backblaze Dashboard, just like for a normal Windows/Mac installation

Troubleshooting

• The Backblaze Installer says it recognized a server operating system

  

  • Explanation: I don't know what can cause this, it seems to randomly occur on some installations

  • Solution: Stop the docker, delete the config directory, restart installation from beginning

  • (Speculation: I think this only happens, when no volume is mounted at /config/ and docker manages the folder instead of the volume)

• The backup folder mounted as drive D is not being backed up

  • Explanation: Depending on when you added drive D to your wine configuration, the Backblaze installer might not recognize it

  • Solution:

    • Open the Backblaze settings
    • In the section "Hard Drives" in the first tab "Settings" enable the checkbox for next to the drive D:\

  • Still not working:

    • Run

      docker exec --user app Backblaze64 ls -la /config/wine/dosdevices/
      

    • The output should look like this:

        drwxr-xr-x 2 app app 4096 Jan 16 13:43 .
        drwxr-xr-x 4 app app 4096 Jan 16 14:08 ..
        lrwxrwxrwx 1 app app   10 Jan 16 13:43 c: -> ../drive_c
        lrwxrwxrwx 1 app app   10 Jan 16 13:43 d: -> /drive_d/
        lrwxrwxrwx 1 app app    1 Jan 16 13:43 z: -> /
      

    • If it doesn't confirm you've mounted the volume in the container correctly for automatic attachment or followed the manual instructions in volumes

• I can only see a black screen when I start the container

  • Explanation: The Docker container may have insufficient permissions to download and install Backblaze.

  • Solution:

    • Try a different run command where you explicitly pass the root ID 0 to the container:

    docker run \
        -p 8080:5800 \
        --init \
        -e USER_ID=0 \
        -e GROUP_ID=0 \
        --name Backblaze64 \
        -v "[backup folder]/:/drive_d/" \
        -v "[config folder]/:/config/" \
        ghcr.io/iamfoz/backblaze-personal-wine:latest
    

  • Additional 'black screen' troubleshooting for Synology devices:

    • It may be necessary to run the container with even higher permissions (--privileged)

    docker run \
        -p 8080:5800 \
        --init \
        --privileged \
        -e USER_ID=0 \
        -e GROUP_ID=0 \
        --name Backblaze64 \
        -v "[backup folder]/:/drive_d/" \
        -v "[config folder]/:/config/" \
        ghcr.io/iamfoz/backblaze-personal-wine:latest
    

  • For More Information: See #98, #99

Additional Information

1. Warning: The Backblaze client is not an init system (who knew) and doesn't clean up its zombie children. This will cause it to fill up your system's PID limit within a few hours which prevents new processes from being created system-wide, would not recommend.
   The --init flag installs a tiny process that can actually do a few init things like wait()ing children in place of the backblaze client as PID 1.
2. Backblaze will create a .bzvol directory in the root of every hard drive it's configured to back up in which it'll store a full copy of files >100M split into 10M parts. Mount accordingly if you want to preserve SSD erase cycles.
3. You can browse the files accessible to Backblaze using:

   docker exec --user app Backblaze64 wine explorer
   

4. You can open the Wine Config using:

   docker exec --user app Backblaze64 winecfg
   

5. We are using Wine's virtual desktop mode as default and are using a default screen resoluzion of 900x700 pixels. It's larger than the Backblaze UI window itself to make room for the Backblaze restore app. You can always modify the resolution as you like with DISPLAY_WIDTH and DISPLAY_HEIGHT:

   docker run ... -e "DISPLAY_WIDTH=1280" -e "DISPLAY_HEIGHT=800" ...
   

Credits

Backblaze 64 is a 64-bit / Windows 10 fork maintained by @iamfoz, re-engineered to install and run Backblaze Personal Backup 10.x (which dropped 32-bit and pre-Windows 10 support).

It builds directly on @JonathanTreffler's Backblaze Personal Wine Community Container — huge thanks to Jonathan, whose project this is forked from. That project was originally developed by @Atemu and is built on @jlesage's excellent GUI base image.

The Backblaze name, logo and application are the property of Backblaze, Inc. This image does not redistribute the Backblaze application; it is downloaded from the official Backblaze servers during installation.

Contributors:

This project was made by: