<commit_before><!--[metadata]>
+++
title = "Backups and disaster recovery"
description = "Learn how to backup your Docker Trusted Registry cluster, and to recover your cluster from an existing backup."
keywords = ["docker, registry, high-availability, backup, recovery"]
[menu.main]
parent="dtr_menu_high_availability"
identifier="dtr_backup_disaster_recovery"
weight=10
+++
<![end-metadata]-->


# Backups and disaster recovery

When you decide to start using Docker Trusted Registry on a production
setting, you should [configure it for high availability](high-availability.md).

The next step is creating a backup policy and disaster recovery plan.

## DTR data persistency

Docker Trusted Registry persists four kinds of data:

* Configurations: the cluster configurations are stored on a key-value store
that is replicated through all DTR nodes.
* Image and repository metadata: the information about the repositories and
images deployed. This information is replicated through all DTR nodes.
* Docker images: By default images are stored on the host of the filesystem
where DTR is installed.
* Certificates and keys: the certificates, public keys, and private keys that
are used for mutual TLS communication.

This data is persisted on the host machine using named volumes.
[Learn more about DTR named volumes](../architecture.md).

## Backup DTR data

To perform a backup of a DTR node, use the `docker/dtr backup`
command. This command creates a backup of DTR:

* Configurations,
* Repository metadata,
* Certificates and keys used by DTR.

These files are added to a tar archive, and the result is streamed to stdout.

The backup command does not create a backup of Docker images. You should
implement a separate backup policy for the Docker images, taking in
consideration whether your DTR installation is configured to store images on the
filesystem or using a cloud provider.

When creating a backup, the resulting .tar file contains sensitive information
like private keys. You should ensure the backups are stored securely.

To learn about the options available on the backup command, you can
[check the reference documentation](../reference/backup.md), or run:

```bash
$ docker run --rm -it docker/dtr backup --help
```

As an example, to create a backup of a DTR node, you can use:

```bash
$ docker run -it --rm docker/dtr backup \
  --insecure-tls --pod-id 8b6174866010 \
  --username admin --password password \
  --host 192.168.10.100 > /tmp/backup.tar
```

Where:

* `--insecure-tls` allows connecting to UCP without TLS,
* `--pod-id` specifies the DTR pod to backup,
* `--username, --password` are the credentials of a UCP admin user,
* `--host` is the IP address of UCP.

## Restore DTR data

You can restore a DTR node from a backup using the `docker/dtr restore`
command.<commit_msg>death to pods, long live replicas<commit_after><!--[metadata]>
+++
title = "Backups and disaster recovery"
description = "Learn how to backup your Docker Trusted Registry cluster, and to recover your cluster from an existing backup."
keywords = ["docker, registry, high-availability, backup, recovery"]
[menu.main]
parent="dtr_menu_high_availability"
identifier="dtr_backup_disaster_recovery"
weight=10
+++
<![end-metadata]-->


# Backups and disaster recovery

When you decide to start using Docker Trusted Registry on a production
setting, you should [configure it for high availability](high-availability.md).

The next step is creating a backup policy and disaster recovery plan.

## DTR data persistency

Docker Trusted Registry persists four kinds of data:

* Configurations: the cluster configurations are stored on a key-value store
that is replicated through all DTR nodes.
* Image and repository metadata: the information about the repositories and
images deployed. This information is replicated through all DTR nodes.
* Docker images: By default images are stored on the host of the filesystem
where DTR is installed.
* Certificates and keys: the certificates, public keys, and private keys that
are used for mutual TLS communication.

This data is persisted on the host machine using named volumes.
[Learn more about DTR named volumes](../architecture.md).

## Backup DTR data

To perform a backup of a DTR node, use the `docker/dtr backup`
command. This command creates a backup of DTR:

* Configurations,
* Repository metadata,
* Certificates and keys used by DTR.

These files are added to a tar archive, and the result is streamed to stdout.

The backup command does not create a backup of Docker images. You should
implement a separate backup policy for the Docker images, taking in
consideration whether your DTR installation is configured to store images on the
filesystem or using a cloud provider.

When creating a backup, the resulting .tar file contains sensitive information
like private keys. You should ensure the backups are stored securely.

To learn about the options available on the backup command, you can
[check the reference documentation](../reference/backup.md), or run:

```bash
$ docker run --rm -it docker/dtr backup --help
```

As an example, to create a backup of a DTR node, you can use:

```bash
$ docker run -it --rm docker/dtr backup \
  --insecure-tls --replica-id 8b6174866010 \
  --username admin --password password \
  --host 192.168.10.100 > /tmp/backup.tar
```

Where:

* `--insecure-tls` allows connecting to UCP without TLS,
* `--replica-id` specifies the DTR replica to backup,
* `--username, --password` are the credentials of a UCP admin user,
* `--host` is the IP address of UCP.

## Restore DTR data

You can restore a DTR node from a backup using the `docker/dtr restore`
command.
{'fraction_non_alphanumeric': 0.07486725663716814, 'fraction_numerical': 0.008495575221238939, 'mean_word_length': 4.331132075471698, 'pattern_counts': {'":': 0, '<': 7, '<?xml version=': 0, '>': 9, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 2, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1882415', 'n_tokens_mistral': 1599, 'n_tokens_neox': 1474, 'n_words': 780}