ConsoleKnow what must be protected
The standard Compose bundle stores the database and encrypted credential records in sqlite_data, and Vault key material in vault_data. Docker prefixes actual volume names with the Compose project name. Confirm the real names with docker volume ls and your Compose configuration; do not assume another installation's names.
Take a consistent backup
Schedule a maintenance window and stop the application cleanly with docker compose -f docker-compose.prod.yml stop. Archive both actual named volumes using your infrastructure backup tools. Preserve file ownership and permissions. Save the matching image digest, Compose file and environment configuration securely with the recovery record.
- Store database and Vault archives as one dated recovery set.
- Encrypt and restrict access to backups: the Vault material can unlock saved secrets.
- Resume the installation with docker compose -f docker-compose.prod.yml up -d --wait.
Test restoration without overwriting production
Create an isolated Docker project with new empty volumes. Restore both archives into their matching volumes and use a compatible image version from the backup record. Keep the test endpoint separate from production. Verify administrator sign-in, host inventory, authorization and successful credential decryption against an authorized test destination.
Restore a compatible image and backup
Do not run docker compose down -v or delete production volumes as a recovery shortcut. An older image may not understand a migrated database. Use the image and both volume snapshots from the same tested recovery point.