Separate UI from backup process

[Stefan-Olt]

I would like to backup most if the system, not just a /home/user folder, but for example /etc, /usr/local, /opt and so on. To access all files I would essentially have to give full filesystem access, which I don't like. I'm not a Docker expert, but I also want to store all the original permissions and user/group, so I basically have to give root permissions, which feels very wrong for a web ui (even if it is not accessible from outside the local network).

The question is: Wouldn't it be possible to separate the backup process from the UI? Borg would run outside the container with maybe a minimal server script that would read the backup configuration created by the UI and starts borg (including the timed backups). The backups would be written to a place where the UI had only read access. borg-ui would monitor the backup process by connecting to the server script on the host, is able to browse the backups, but doesn't need access to the system.

[karanhudia]

This is the direction Borg UI has moved in.

For machines that should run Borg outside the Borg UI container, Managed Agents are now the intended path: install borg-ui-agent on the machine that owns the files, let it connect outbound to Borg UI, and run backups there with the selected service user's permissions. That avoids mounting the whole host filesystem into the web container.

There is also remote-direct SSH backup execution for the specific case where the SSH source and SSH repository are on the same remote connection, so the high-I/O work stays on that remote host.

A completely read-only/unmanaged monitor, where Borg UI never starts the backup and only ingests external results, is still separate follow-up work.