Your Unraid data, sealed in a vault. Drop a backup. Detonate a restore.
BombVault backs up Docker containers, KVM VMs, appdata, the Unraid flash config — and even itself — and restores everything with a single click. Containers automatically reappear in the Docker tab, VMs automatically in the VM tab — no manual reinstall, no reconfiguration, no drama.

Your data, locked in. Loss, locked out. Data loss doesn't stand a chance.
Powered by restic — deduplicated, incremental, always encrypted.

Status: one-click Docker container, KVM/libvirt VM, Unraid flash, app configuration and files/folders backup & restore are all live (VMs over SSH — no libvirt mount), with off-site repos (SMB/NFS/rclone/SSH-sftp), per-source retention, file-level restore, integrity checks, pre/post-backup hooks, a protection-status dashboard with restore-verification drills, immutable/append-only off-site with tamper verification (ransomware-resistant), live restore progress + cancel, restore from another BombVault repo (one-time, read-only), self-healing maintenance (orphaned-lock auto-recovery), and notifications (webhook / Matrix / email / Apprise / Healthchecks / Unraid-native / Prometheus). A few niceties remain on the roadmap — marked (planned) below.

Table of Contents

1. What is this?
2. Screenshots
3. Features
4. How it works
5. Security / trust model
6. Requirements
7. Install on Unraid
8. Configuration
9. Development
10. Credits
11. License
12. Support this project

1. What is this?

BombVault is a self-hosted, Unraid-native web app for backup and full disaster recovery of your Docker containers and KVM/libvirt VMs. It runs as a single Docker container, gives you a modern dark web UI, and handles the whole lifecycle:

• Backs up Docker appdata + container definitions, KVM/libvirt VM disks + XML (incl. UEFI NVRAM), the whole Unraid flash (/boot), any folders you point it at (named file sets with per-set excludes), and its own /config (settings database + off-site credentials).
• Restores automatically — containers are reinstalled and restarted so they reappear in the Docker tab exactly as before, and VMs are re-defined in the VM Manager with their disks + NVRAM reattached.
• Schedules incremental backups in the background (per domain) from one place — the Schedules tab under Settings — with one-click "include all in schedule" for containers and VMs, so you never have to think about it.
• Optionally updates a container right after its backup — flip on Update after successful backup on a container (advanced, off by default) and BombVault pulls the newest image and recreates it, but only when there's actually a newer image. A fresh restore point always exists first, so a bad update is one restore away. Optional extras: a notification per updated container so you know to check it, and image cleanup (Settings → Paths & Storage) that removes the superseded image afterwards — a base image shared by other containers is never deleted.

The core idea — one-click backup and automatic re-install of Docker containers — comes from VolumeVault by @Darkdragon14 (Apache-2.0). BombVault is a fresh, independent implementation with restic as the engine; see Credits.

2. Screenshots

One click: a deleted container is restored from its backup and running again in seconds.

Dashboard — a compact health summary (overall status, next backup, last result) above protection status per domain, last backups, run history and a backup-health heatmap.

Recovery — a guided disaster-recovery flow: confirm your backups are readable, restore BombVault's own settings, then attach and restore your container, VM and flash backups onto a fresh install.

Containers — per-container backup with an include-in-schedule toggle, collapsible filters, bulk include/exclude, one-click backup and an expandable per-container history.

Settings — organised into tabs (General · Paths & Storage · Schedules · Off-site · Notifications · Integrity · System); enable each backup domain and pick an accent colour.

3. Features

Simple by default. The interface shows only the essentials (back up, restore, schedule). Use the Simple / Advanced switch in the sidebar to reveal the expert controls — retention, off-site copy, pre/post hooks, file-level restore, notifications, Prometheus metrics, integrity/maintenance tools and more. It's a per-browser preference, off by default, so newcomers get a clean UI and power users get everything.

Backup scope

4. How it works

Browser ──HTTPS──> BombVault container
                   ├─ Go binary: JSON API + embedded React UI
                   ├─ Background worker (per-domain scheduler + job executor)
                   │
                   ├─ /var/run/docker.sock  ─> Docker API (container stop/inspect/recreate)
                   ├─ qemu+ssh://host       ─> libvirt / KVM on the HOST over SSH (no mount)
                   ├─ /mnt/ ─> /host/user   ─> appdata, VM disks + restic repos (read/write)
                   ├─ /boot/ ─> /host/boot  ─> Unraid flash backup (whole USB)
                   ├─ /config               ─> BombVault's own settings + credentials (self-backup)
                   └─ <repo path>           ─> restic repository (local or remote: rclone/s3/rest/sftp)

BombVault talks to the Docker socket to stop containers before backup and recreate them after restore. For VMs it runs virsh on the host over SSH (qemu+ssh://) to gracefully shut down or live-snapshot a domain — it never bind-mounts any libvirt path, so it can never interfere with the host VM Manager. All actual data movement goes through restic — BombVault is the orchestration and UI layer, not the storage engine.

Restore is the star: after copying data back from the restic snapshot, BombVault replays the saved container definition against the Docker API (docker run equivalent), so the container reappears in the Unraid Docker tab as if it had always been there. VMs get their XML re-defined over SSH and their disks + UEFI NVRAM reattached.

5. Security / trust model

[!WARNING] BombVault holds root-equivalent control of the host: via the Docker socket it can stop, remove and recreate containers and reads/writes appdata, and for VM backup it logs in to the host over SSH (qemu+ssh://, root by default) to run virsh. Anyone who can reach its web UI effectively has root on the host.

BombVault has optional built-in password protection (Settings → Security): set a password to require login, clear it to disable. It is off by default for trusted-LAN use. Sessions are signed (HMAC, derived from APP_KEY) and changing the password invalidates them; logins are rate-limited to slow guessing. Regardless, run BombVault only on a trusted, non-exposed network — never publish it directly to the internet; for remote access put it behind a reverse proxy that adds authentication and TLS. Responses carry baseline security headers (CSP, nosniff, X-Frame-Options, Referrer-Policy).

Because the password gate is opt-in, when it is unset the whole UI and API are reachable by anyone who can reach the port — including the off-site setup and tamper-test routes that mint or use append-only credentials, and the encryption-key recovery kit. Enable the password gate (Settings → Security), especially once off-site/immutable backups or encryption are in use, and never expose the port directly to the internet — reach it over a VPN or a reverse proxy that adds authentication.

Two caveats for the security-conscious: with HTTP_ONLY=true the session cookie loses its Secure flag (it has to, to work over plain HTTP), so only enable the password behind a TLS-terminating proxy if confidentiality matters. And the VM-backup SSH connection trusts the host key on first connect (TOFU) and pins it thereafter — fine on a trusted LAN, but verify the host's key out-of-band if your container↔host path isn't trusted.

Backups are encrypted by restic when encryption is enabled (Settings; on by default), with the key derived from APP_KEY.

6. Requirements

[!IMPORTANT] VM backup uses SSH, not a libvirt mount. BombVault never bind-mounts any libvirt path (mounting the host's libvirt socket/runtime on Unraid is fragile — the VM Manager owns those paths and toggling "Enable VMs" can leave libvirt unable to start). Instead it runs virsh on the host over SSH (qemu+ssh://), so it can never affect your host VM Manager. Setup: Settings → System → VM Backup over SSH → copy the shown public key → append it to Unraid's /root/.ssh/authorized_keys → click Test connection. The template adds --add-host=host.docker.internal:host-gateway so the container reaches the host; set LIBVIRT_HOST to your Unraid LAN IP if that name doesn't resolve (e.g. when the container runs on a custom br0.x network). If you changed Unraid's SSH port, set LIBVIRT_SSH_PORT to match (default 22). The SSH key grants root on the host — the same trust level as the docker.sock BombVault already uses. Live snapshots additionally need the qemu guest agent in the VM and the disk on /mnt/cache (not /mnt/user).

Full setup + networking guide: docs/vm-backup-ssh-setup.md.

7. Install on Unraid

Install via Community Applications — search for BombVault.

Or add the template manually:

1. In Unraid, go to Docker → Add Container → Template repositories and add:

   https://github.com/junkerderprovinz/unraid-apps
   

2. Search for BombVault in Templates.
3. Set the required variables (see Configuration) and click Apply.

8. Configuration

Mount the Docker socket, the flash (/boot) and the Host Data root (/mnt) as shown in the CA template — backup sources and destinations both live under Host Data, and it is mounted rslave so a remote share that mounts after the container starts (e.g. under /mnt/remotes) becomes visible without a restart. Backup repository paths are configured in the app (Settings → Backup paths) — not via env — and default to /mnt/user/bombvault/{container,vms,flash,config,files}, created on the first backup (change the location any time in Settings). VM backup needs no mount: see §6 and docs/vm-backup-ssh-setup.md.

[!NOTE] Host integration check: open /spike in the web UI after the container starts. It probes every mount and CLI (Docker socket, libvirt, restic, qemu-img, rclone) and reports any missing pieces.

9. Development

BombVault is a single static Go binary that serves a JSON API and an embedded React/Vite SPA (go:embed). Build the SPA first, then run the binary:

npm --prefix web ci
npm --prefix web run build     # outputs web/dist (embedded into the binary)
export APP_KEY=$(openssl rand -hex 32)
go test ./...                  # Go unit + integration tests (real restic roundtrip)
golangci-lint run ./...        # lint
go run ./cmd/bombvault         # serves https://localhost:3443 (self-signed cert)

Real Docker, libvirt and Unraid behavior cannot be tested in CI (no KVM, no Unraid on runners). Use the host integration check (/spike in the web UI) to validate mounts, restic and the VM SSH connection on your actual Unraid host before submitting a PR.

10. Credits

• VolumeVault by @Darkdragon14 (Apache-2.0) — the original idea that sparked BombVault: one-click backup and automatic re-install of Docker containers. Thank you. BombVault is an independent rewrite (Go + restic) that extends the concept to VMs and the Unraid flash.
• restic — the fast, secure, deduplicating backup engine BombVault orchestrates.
• rclone — off-site cloud backends.

11. License

Copyright (C) 2026 Junker der Provinz.

BombVault is free software under the GNU Affero General Public License v3.0 (AGPL-3.0); see LICENSE. You may run, study, share and modify it. If you distribute it, or run a modified version as a network service, you must release your source under the same AGPL-3.0 terms and keep the existing copyright and attribution notices intact.

Name and branding are not licensed. The AGPL covers the source code only. "BombVault", its logo and its branding remain reserved: a fork or derivative must use its own distinct name and branding, and may not present itself as BombVault. This keeps it unambiguous which project is the original.

12. Support this project

Questions, bugs, ideas? Unraid support thread → (or open a GitHub issue).