read backup in small chunks when encrypting

This commit is contained in:
Frederik Ring 2021-08-23 08:19:22 +02:00
parent 411a62a6c7
commit 7086c6e645
3 changed files with 66 additions and 51 deletions

View File

@ -2,7 +2,7 @@
Backup Docker volumes locally or to any S3 compatible storage. Backup Docker volumes locally or to any S3 compatible storage.
The [offen/docker-volume-backup](https://hub.docker.com/r/offen/docker-volume-backup) Docker image can be used as a sidecar container to an existing Docker setup. It handles recurring backups of Docker volumes to a local directory or any S3 compatible storage (or both) and rotates away old backups if configured. The [offen/docker-volume-backup](https://hub.docker.com/r/offen/docker-volume-backup) Docker image can be used as a lightweight (below 15MB) sidecar container to an existing Docker setup. It handles recurring backups of Docker volumes to a local directory or any S3 compatible storage (or both), and rotates away old backups if configured.
## Configuration ## Configuration
@ -177,8 +177,8 @@ docker exec <container_ref> backup
This image is heavily inspired by the `futurice/docker-volume-backup`. We decided to publish this image as a simpler and more lightweight alternative because of the following requirements: This image is heavily inspired by the `futurice/docker-volume-backup`. We decided to publish this image as a simpler and more lightweight alternative because of the following requirements:
- The original image is based on `ubuntu` and additional tools, making it very heavy. This version is roughly 1/25 in compressed size (it's ~12MB). - The original image is based on `ubuntu` and additional tools, making it very heavy. This version is roughly 1/25 in compressed size (it's ~12MB).
- The original image uses a shell script, when this is written in Go. - The original image uses a shell script, when this is written in Go, which makes it easier to extend and maintain (more verbose also).
- The original image proposed to handle backup rotation through AWS S3 lifecycle policies. This image adds the option to rotate away old backups through the same command so this functionality can also be offered for non-AWS storage backends like MinIO. Local copies of backups can also be pruned once they reach a certain age. - The original image proposed to handle backup rotation through AWS S3 lifecycle policies. This image adds the option to rotate away old backups through the same command so this functionality can also be offered for non-AWS storage backends like MinIO. Local copies of backups can also be pruned once they reach a certain age.
- InfluxDB specific functionality was removed. - InfluxDB specific functionality from the original image was removed.
- `arm64` and `arm/v7` architectures are supported. - `arm64` and `arm/v7` architectures are supported.
- Docker in Swarm mode is supported. - Docker in Swarm mode is supported.

View File

@ -4,6 +4,7 @@
package main package main
import ( import (
"bufio"
"bytes" "bytes"
"context" "context"
"errors" "errors"
@ -43,6 +44,8 @@ func main() {
s.logger.Info("Finished running backup tasks.") s.logger.Info("Finished running backup tasks.")
} }
// script holds all the stateful information required to orchestrate a
// single backup run.
type script struct { type script struct {
ctx context.Context ctx context.Context
cli *client.Client cli *client.Client
@ -62,27 +65,10 @@ type script struct {
pruningPrefix string pruningPrefix string
} }
// lock opens a lockfile at the given location, keeping it locked until the
// caller invokes the returned release func. When invoked while the file is
// still locked the function panics.
func lock(lockfile string) func() error {
lf, err := os.OpenFile(lockfile, os.O_CREATE, os.ModeAppend)
if err != nil {
panic(err)
}
return func() error {
if err := lf.Close(); err != nil {
return fmt.Errorf("lock: error releasing file lock: %w", err)
}
if err := os.Remove(lockfile); err != nil {
return fmt.Errorf("lock: error removing lock file: %w", err)
}
return nil
}
}
// init creates all resources needed for the script to perform actions against // init creates all resources needed for the script to perform actions against
// remote resources like the Docker engine or remote storage locations. // remote resources like the Docker engine or remote storage locations. All
// reading from env vars or other configuration sources is expected to happen
// in this method.
func (s *script) init() error { func (s *script) init() error {
s.ctx = context.Background() s.ctx = context.Background()
s.logger = logrus.New() s.logger = logrus.New()
@ -178,22 +164,25 @@ func (s *script) stopContainersAndRun(thunk func() error) error {
if err != nil { if err != nil {
return fmt.Errorf("stopContainersAndRun: error querying for containers to stop: %w", err) return fmt.Errorf("stopContainersAndRun: error querying for containers to stop: %w", err)
} }
if len(containersToStop) == 0 {
return thunk()
}
s.logger.Infof( s.logger.Infof(
"Stopping %d containers labeled `%s` out of %d running container(s).", "Stopping %d container(s) labeled `%s` out of %d running container(s).",
len(containersToStop), len(containersToStop),
containerLabel, containerLabel,
len(allContainers), len(allContainers),
) )
var stoppedContainers []types.Container var stoppedContainers []types.Container
var errors []error var stopErrors []error
if len(containersToStop) != 0 { for _, container := range containersToStop {
for _, container := range containersToStop { if err := s.cli.ContainerStop(s.ctx, container.ID, nil); err != nil {
if err := s.cli.ContainerStop(s.ctx, container.ID, nil); err != nil { stopErrors = append(stopErrors, err)
errors = append(errors, err) } else {
} else { stoppedContainers = append(stoppedContainers, container)
stoppedContainers = append(stoppedContainers, container)
}
} }
} }
@ -246,17 +235,13 @@ func (s *script) stopContainersAndRun(thunk func() error) error {
return nil return nil
}() }()
var stopErr error if len(stopErrors) != 0 {
if len(errors) != 0 { return fmt.Errorf(
stopErr = fmt.Errorf( "stopContainersAndRun: %d error(s) stopping containers: %w",
"stopContainersAndRun: %d errors stopping containers: %w", len(stopErrors),
len(errors),
err, err,
) )
} }
if stopErr != nil {
return stopErr
}
return thunk() return thunk()
} }
@ -280,9 +265,10 @@ func (s *script) encryptBackup() error {
return nil return nil
} }
buf := bytes.NewBuffer(nil) output := bytes.NewBuffer(nil)
_, name := path.Split(s.file) _, name := path.Split(s.file)
pt, err := openpgp.SymmetricallyEncrypt(buf, []byte(s.passphrase), &openpgp.FileHints{
pt, err := openpgp.SymmetricallyEncrypt(output, []byte(s.passphrase), &openpgp.FileHints{
IsBinary: true, IsBinary: true,
FileName: name, FileName: name,
}, nil) }, nil)
@ -290,20 +276,30 @@ func (s *script) encryptBackup() error {
return fmt.Errorf("encryptBackup: error encrypting backup file: %w", err) return fmt.Errorf("encryptBackup: error encrypting backup file: %w", err)
} }
unencrypted, err := ioutil.ReadFile(s.file) file, err := os.Open(s.file)
if err != nil { if err != nil {
pt.Close() return fmt.Errorf("encryptBackup: error opening unencrypted backup file: %w", err)
return fmt.Errorf("encryptBackup: error reading unencrypted backup file: %w", err)
} }
_, err = pt.Write(unencrypted)
if err != nil { // backup files might be very large, so they are being read in chunks instead
pt.Close() // of loading them into memory once.
return fmt.Errorf("encryptBackup: error writing backup contents: %w", err) scanner := bufio.NewScanner(file)
chunk := make([]byte, 0, 1024*1024)
scanner.Buffer(chunk, 10*1024*1024)
for scanner.Scan() {
_, err = pt.Write(scanner.Bytes())
if err != nil {
file.Close()
pt.Close()
return fmt.Errorf("encryptBackup: error encrypting backup contents: %w", err)
}
} }
file.Close()
pt.Close() pt.Close()
gpgFile := fmt.Sprintf("%s.gpg", s.file) gpgFile := fmt.Sprintf("%s.gpg", s.file)
if err := ioutil.WriteFile(gpgFile, buf.Bytes(), os.ModeAppend); err != nil { if err := ioutil.WriteFile(gpgFile, output.Bytes(), os.ModeAppend); err != nil {
return fmt.Errorf("encryptBackup: error writing encrypted version of backup: %w", err) return fmt.Errorf("encryptBackup: error writing encrypted version of backup: %w", err)
} }
@ -487,6 +483,26 @@ func (s *script) must(err error) {
} }
} }
// lock opens a lockfile at the given location, keeping it locked until the
// caller invokes the returned release func. When invoked while the file is
// still locked the function panics.
func lock(lockfile string) func() error {
lf, err := os.OpenFile(lockfile, os.O_CREATE|os.O_RDWR, os.ModeAppend)
if err != nil {
panic(err)
}
return func() error {
if err := lf.Close(); err != nil {
return fmt.Errorf("lock: error releasing file lock: %w", err)
}
if err := os.Remove(lockfile); err != nil {
return fmt.Errorf("lock: error removing lock file: %w", err)
}
return nil
}
}
// copy creates a copy of the file located at `dst` at `src`.
func copy(src, dst string) error { func copy(src, dst string) error {
in, err := os.Open(src) in, err := os.Open(src)
if err != nil { if err != nil {

View File

@ -9,7 +9,6 @@
set -e set -e
# Write cronjob env to file, fill in sensible defaults, and read them back in # Write cronjob env to file, fill in sensible defaults, and read them back in
mkdir -p /etc/backup
cat <<EOF > /etc/backup.env cat <<EOF > /etc/backup.env
BACKUP_SOURCES="${BACKUP_SOURCES:-/backup}" BACKUP_SOURCES="${BACKUP_SOURCES:-/backup}"
BACKUP_CRON_EXPRESSION="${BACKUP_CRON_EXPRESSION:-@daily}" BACKUP_CRON_EXPRESSION="${BACKUP_CRON_EXPRESSION:-@daily}"