How to Install restic on Ubuntu: Fast, Encrypted, Deduplicated Backups

restic is a backup program built around three promises: fast, efficient and secure. Your files are cut into content-defined chunks and each unique chunk is stored exactly once, so the tenth backup of a laptop takes a fraction of the time and space of the first. Everything is encrypted and authenticated locally before it is uploaded, and the one Go binary talks to local disks, SFTP, a REST server, S3 and S3-compatible storage, Backblaze B2, Azure, Google Cloud Storage and every rclone remote.

Ubuntu carries restic in its universe archive, but the version is fixed when each release ships, and an LTS release keeps that version for its whole lifetime. That is a long time to go without restore speed-ups, repository improvements and bug fixes in the program you are trusting with your data.

The unofficial deb.griffo.io repository offers a better path: current restic releases packaged as a drop-in .deb that replaces the archive’s restic (same package name, same paths), delivered over APT with man pages and shell completions included, so you install and update it with the commands you already use.

Install the Latest restic on Ubuntu: The Short Version

If you only came for the commands, this adds the repository and installs the latest restic .deb package on Ubuntu:

sudo install -d -m 0755 /etc/apt/keyrings
curl -fsSL https://deb.griffo.io/EA0F721D231FDD3A0A17B9AC7808B4DD62C41256.asc | sudo gpg --dearmor --yes -o /etc/apt/keyrings/deb.griffo.io.gpg
echo "deb [signed-by=/etc/apt/keyrings/deb.griffo.io.gpg] https://deb.griffo.io/apt $(lsb_release -sc 2>/dev/null) main" | sudo tee /etc/apt/sources.list.d/deb.griffo.io.list > /dev/null
sudo apt update
sudo apt install restic

The rest of this guide explains what each command does, how to verify the install, how to run your first backup, how to keep restic up to date, and what to check when something goes wrong.

What Makes restic Special?

  • 🔐 Encryption is not optional - Repositories are always encrypted and authenticated, so a stolen disk or leaked bucket reveals nothing.
  • 🧩 Deduplication - Identical data is stored once, whether it repeats inside a file, across snapshots or between machines.
  • ⚡ Quick incremental runs - Unchanged files are skipped and only new chunks travel over the network.
  • ☁️ Plenty of backends - Local paths, SFTP, REST server, S3-compatible storage, B2, Azure, GCS, Swift, plus anything rclone supports.
  • 📸 Snapshot based - Every run produces an independent snapshot you can list, tag, diff and restore.
  • 🗂️ Browse backups with FUSE - Mount the repository and pick out individual files with ordinary tools.
  • 🧹 Retention policies - Keep hourly, daily, weekly, monthly or yearly snapshots and prune the rest in a single command.
  • ✅ Integrity checks - restic check verifies the repository, and can read back the data itself.
  • 📦 One static binary - Nothing extra to install, which is precisely what you want when you are restoring a broken machine.

Why Use the deb.griffo.io Repository?

  • Far newer than the Ubuntu archive, which keeps the restic version a release shipped with.
  • Drop-in replacement for Ubuntu’s restic, using the same package name and file layout.
  • Easy installation and updates through APT instead of manual downloads or restic self-update.
  • Man pages and completions for bash, fish and zsh bundled with the package.
  • Built from signature-verified upstream binaries for amd64, arm64, armhf, ppc64el, s390x and riscv64.
  • Works across supported Ubuntu releases, with the codename detected for you.

Prerequisites

Before starting, confirm you have:

  • An Ubuntu system (Jammy 22.04 LTS, Noble 24.04 LTS, Questing 25.10, or Resolute 26.04 LTS)
  • sudo privileges
  • curl installed (sudo apt install curl if needed)

restic itself has no runtime dependencies. ca-certificates, needed for HTTPS backends, is already present on a standard Ubuntu install, and fuse3 is only necessary if you want to browse snapshots with restic mount.

Step 1: Add the deb.griffo.io Repository

Register the key and repository source:

# Create the keyrings directory
sudo install -d -m 0755 /etc/apt/keyrings

# Download and install the repository GPG key
curl -fsSL https://deb.griffo.io/EA0F721D231FDD3A0A17B9AC7808B4DD62C41256.asc | sudo gpg --dearmor --yes -o /etc/apt/keyrings/deb.griffo.io.gpg

# Add the repository (auto-detects your distro codename)
echo "deb [signed-by=/etc/apt/keyrings/deb.griffo.io.gpg] https://deb.griffo.io/apt $(lsb_release -sc 2>/dev/null) main" | sudo tee /etc/apt/sources.list.d/deb.griffo.io.list > /dev/null

# Update the package list
sudo apt update

Breaking it down:

  1. Create the keyrings directory - makes sure /etc/apt/keyrings exists with the right permissions.
  2. Install the GPG key - downloads and de-armours the repository key into its own keyring so APT can verify signatures.
  3. Add the repository - writes a signed-by source line, letting lsb_release -sc fill in your Ubuntu codename.
  4. Update the package list - refreshes APT’s view of available packages.

Step 2: Update the Package List

If you did not run the final command above, do it now:

sudo apt update

Step 3: Install restic

Install with APT:

sudo apt install restic

Ubuntu’s universe component also provides restic, so check that APT picked the repository build:

apt policy restic

The candidate should be the newer version coming from deb.griffo.io. To be able to mount snapshots later, add FUSE now:

sudo apt install fuse3

Step 4: Verify the Installation

The binary is restic. Check the version:

restic version

You should see something like:

restic 0.19.1 compiled with go1.25.1 on linux/amd64

Each subcommand is documented with --help (for example restic restore --help) and in a dedicated man page such as man restic-restore.

Getting Started with restic

Your First Repository

restic writes snapshots into a repository. The simplest one is a directory, say on a USB drive mounted under /media:

# Create the repository; you will be prompted for a password
restic -r /media/$USER/backup/restic-repo init

Store the password somewhere safe. Without it the repository cannot be decrypted, by you or anyone else.

Taking and Listing Snapshots

# Back up your home directory
restic -r /media/$USER/backup/restic-repo backup ~

# Leave out cache directories and patterns from a file
restic -r /media/$USER/backup/restic-repo backup ~ --exclude-caches --exclude-file ~/.config/restic/excludes

# Label a snapshot with a tag
restic -r /media/$USER/backup/restic-repo backup ~/Projects --tag projects

# Show what is in the repository
restic -r /media/$USER/backup/restic-repo snapshots

A second backup run only reads changed files, so routine backups finish quickly.

Configuring restic Through the Environment

Rather than repeating -r and typing a password each time, export the settings:

# A password file readable only by you
install -d -m 0700 ~/.config/restic
printf '%s\n' 'a-long-random-passphrase' > ~/.config/restic/password
chmod 600 ~/.config/restic/password

export RESTIC_REPOSITORY=/media/$USER/backup/restic-repo
export RESTIC_PASSWORD_FILE=~/.config/restic/password

restic snapshots

If your password lives in a secret manager, RESTIC_PASSWORD_COMMAND can run a command that prints it instead.

Backing Up Off-Site: SFTP, REST Server and S3

The prefix of the repository location selects the backend:

# Any SSH server you can already log in to
restic -r sftp:user@backup-host:/srv/restic-repo init

# A restic REST server
restic -r rest:https://backup-host:8000/my-desktop init

# Amazon S3
export AWS_ACCESS_KEY_ID=<YOUR-ACCESS-KEY-ID>
export AWS_SECRET_ACCESS_KEY=<YOUR-SECRET-ACCESS-KEY>
restic -r s3:s3.us-east-1.amazonaws.com/my-bucket init

# Your own S3-compatible endpoint
restic -r s3:https://s3.example.com/my-bucket init

Once initialised, every command behaves the same regardless of where the data lives.

Getting Files Back

# Restore the newest snapshot into a scratch directory
restic restore latest --target /tmp/restore

# Restore just one directory from it
restic restore latest --target /tmp/restore --include /home/user/Documents

# Explore all snapshots as a filesystem (requires fuse3)
mkdir -p ~/restic-mount
restic mount ~/restic-mount

These examples assume RESTIC_REPOSITORY and RESTIC_PASSWORD_FILE are exported. The mount lasts until you press Ctrl-C or unmount it; inside you will find snapshots/, hosts/ and tags/, ready to open in Files or any terminal tool.

Keeping the Repository Tidy

# See which snapshots a policy would drop, without changing anything
restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 12 --dry-run

# Drop them and free the unused data
restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 12 --prune

forget decides which snapshots go; --prune removes the data nothing references any more.

Verifying Your Backups

# Check the repository structure and metadata
restic check

# Additionally read and verify a random 10% of the stored data
restic check --read-data-subset=10%

Schedule checks as seriously as backups, and practise a restore before you actually need one.

Automating Backups with a systemd Timer

On Ubuntu, a systemd timer is the tidy way to run restic unattended. Keep credentials in a root-only environment file:

sudo install -d -m 0700 /etc/restic
sudo tee /etc/restic/env > /dev/null <<'EOF'
RESTIC_REPOSITORY=s3:https://s3.example.com/my-bucket
RESTIC_PASSWORD_FILE=/etc/restic/password
AWS_ACCESS_KEY_ID=<YOUR-ACCESS-KEY-ID>
AWS_SECRET_ACCESS_KEY=<YOUR-SECRET-ACCESS-KEY>
EOF
sudo chmod 600 /etc/restic/env

Next, the service and timer units:

# /etc/systemd/system/restic-backup.service
[Unit]
Description=restic backup
Wants=network-online.target
After=network-online.target

[Service]
Type=oneshot
EnvironmentFile=/etc/restic/env
ExecStart=/usr/bin/restic backup /etc /home --exclude-caches
ExecStartPost=/usr/bin/restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 12 --prune

# /etc/systemd/system/restic-backup.timer
[Unit]
Description=Daily restic backup

[Timer]
OnCalendar=daily
Persistent=true
RandomizedDelaySec=30m

[Install]
WantedBy=timers.target

Activate the timer and run the service once by hand to confirm it succeeds:

sudo systemctl daemon-reload
sudo systemctl enable --now restic-backup.timer
sudo systemctl start restic-backup.service
journalctl -u restic-backup.service

Thanks to Persistent=true, a laptop that was asleep at the scheduled time catches up at the next boot.

Keeping restic Updated

restic rides along with your normal Ubuntu upgrades:

sudo apt update && sudo apt upgrade

When a newer restic appears in deb.griffo.io, apt upgrade installs it alongside your other packages. Since the binary is managed by APT, leave restic self-update alone: it exists for the official standalone downloads and would replace /usr/bin/restic behind the package manager’s back.

Other Tools from deb.griffo.io

The repository includes many tools that sit well next to restic:

  • Garage - a lightweight, self-hosted S3-compatible object store to use as a backup destination.
  • Headscale - a self-hosted Tailscale control server for private access to your backup host.
  • just - a handy command runner for backup, check and restore recipes.
  • Yazi - a blazing fast terminal file manager for digging through a mounted snapshot.

Troubleshooting

GPG or Key Errors

If APT flags the repository as unsigned or the key as invalid, re-import it:

curl -fsSL https://deb.griffo.io/EA0F721D231FDD3A0A17B9AC7808B4DD62C41256.asc | sudo gpg --dearmor --yes -o /etc/apt/keyrings/deb.griffo.io.gpg
sudo apt update

Package Not Found

If APT cannot locate restic in the repository:

  1. Re-run sudo apt update after adding the repository.
  2. Verify your Ubuntu release is supported (Jammy, Noble, Questing, or Resolute).
  3. Check the source list: cat /etc/apt/sources.list.d/deb.griffo.io.list.

The Ubuntu Archive Version Was Installed

With restic available from both universe and deb.griffo.io, confirm which one you have:

apt policy restic

If the installed version is the older archive build, refresh and upgrade to the repository one:

sudo apt update
sudo apt install --only-upgrade restic

Mounting a Snapshot Does Not Work

restic mount depends on FUSE:

sudo apt install fuse3

Mount onto an empty directory, and never onto a path inside a local repository.

The Repository Is Locked

An interrupted run can leave a stale lock. When you are sure no other restic process is active against the repository, clear it:

restic unlock

An Older Binary Shadows the Package

A manually downloaded restic in /usr/local/bin or ~/.local/bin can take precedence over the packaged one:

which -a restic

Delete the stray binary or reorder your PATH so /usr/bin/restic wins.

Uninstalling

Remove restic with:

sudo apt remove restic

Your repositories and the data in them are left untouched. To also remove the repository and key:

sudo rm /etc/apt/sources.list.d/deb.griffo.io.list
sudo rm /etc/apt/keyrings/deb.griffo.io.gpg
sudo apt update

Conclusion

On Ubuntu, deb.griffo.io turns restic into an always-current APT package that slots in where the universe build used to be: no manual downloads, no self-updater, just encrypted, deduplicated backups to wherever you keep them, with man pages and completions ready to go.

Set up a repository, let a systemd timer do the daily work, check the repository on a schedule, and test a restore once in a while. Upgrading restic then happens quietly, together with everything else, every time you run apt upgrade.

Frequently Asked Questions

How do I install the latest restic on Ubuntu?

Add the deb.griffo.io APT repository and its signing key, then run sudo apt install restic. The repository tracks upstream restic releases, so you get the latest packaged version rather than a build frozen when your distribution was released.

Is there a .deb package for restic?

Yes. deb.griffo.io publishes restic as a signed .deb for Ubuntu. You could download that .deb and install it by hand, but adding the repository is the better option: APT then resolves dependencies and picks up new versions on its own.

How do I update restic to the latest version?

Run sudo apt update && sudo apt upgrade. Avoid restic self-update, which targets the official standalone binaries, not packaged installs.

Can I keep using repositories created with Ubuntu’s older restic?

Yes. Newer restic releases open repositories written by older ones, and the package replaces the archive build in place. The only thing to watch is running restic migrate to a newer repository format and then trying to use a much older restic against it.

How do I install restic on Debian?

Exactly the same way; lsb_release -sc simply resolves to a different codename. There is a companion guide with the Debian specifics: How to install restic on Debian.

Which Ubuntu releases are supported?

Jammy 22.04 LTS, Noble 24.04 LTS, Questing 25.10 and Resolute 26.04 LTS. Because the repository line is built from lsb_release -sc, the matching suite is selected for you.

Resources

Disclaimer: The deb.griffo.io repository is an unofficial community project and is not affiliated with the official Debian or Ubuntu projects, or with the upstream restic project.