restic vs rclone vs TagBackup for database and file dumps

~7 min read · Sep 2026 · Commands match docs v0.0.10

People often ask which tool should push database dumps (or a handful of archive files) to S3. The honest answer is: it depends what “backup” means in your case. restic, rclone, and TagBackup solve overlapping but different problems. This guide is a decision aid, not a league table.

Short version

Need	Lean towards
Encrypted, deduplicated backups of whole trees or systems	restic
Sync or copy trees between cloud/local endpoints	rclone
Tagged single-file dumps with expression filters and retention	TagBackup

You can use more than one. Many teams run restic for the host and TagBackup (or plain aws s3 cp) for a nightly SQL dump that developers pull by hand.

When to use which

restic — full encrypted repository backups

restic is built for repositories: encrypted, content-addressed, deduplicated snapshots. You back up directories (or raw disks with care), prune by policy, and restore with confidence that history is integrity-checked.

Strengths for dump-like work

Encryption and integrity are first-class.
Deduplication helps if you snapshot large trees repeatedly.
Mature forget/prune policies and many backends (including S3-compatible).

Less ideal when

Your unit of work is literally one dump file per night and you want to fetch “the latest prod dump” with a one-liner.
You do not want a repository abstraction — you want ordinary objects in a bucket that you can also open with other S3 tools.

restic is the right default for “back up this machine / this dataset properly.” It is heavier conceptual machinery than a push/pull of a single SQL file.

rclone — sync and copy swiss army knife

rclone is the general-purpose cloud filesystem tool: copy, sync, mount, filter, move between dozens of providers.

Strengths for dump-like work

Excellent when dumps land in a directory and you need them mirrored elsewhere.
Rich filters, bandwidth limits, and multi-cloud gymnastics.
Fine for “copy *.sql.gz to this remote every night.”

Less ideal when

Your primary question is tag-based selection (“latest object that has both nightly and prod”) rather than path layouts.
You want retention as “delete objects matching this tag expression older than 30 days” without encoding that logic in shell around ls + delete.

rclone will happily store your dumps; organisation and “latest by meaning” are mostly up to you (folder names, timestamps in filenames, extra scripts).

TagBackup — tagged single-file dumps

TagBackup is a small Go CLI aimed at upload / list / pull / delete of individual files on S3-compatible buckets, with human-readable tags baked into the object key. There is no separate index and no telemetry. Optional local UI: tagbackup serve (bound to 127.0.0.1 only).

Classic pattern from the project README:

# On the server (cron)
pg_dump mydb | tagbackup push - --bucket=db --tag=nightly,prod --filename=dump.sql
tagbackup delete --bucket=db --tag=nightly+prod --older-than=30d --force

# On your laptop
tagbackup pull --bucket=db --tag=nightly+prod --latest

Strengths

Tags travel with the file in the key; filter with AND / OR / NOT expressions.
Script-friendly: --non-interactive, --json, documented exit codes (including 5 for no match).
Retention via delete --older-than scoped by the same tag expressions you use to pull.
Works with AWS S3, Cloudflare R2, MinIO, Backblaze B2, and other S3 APIs — credentials stay in your local config or env/IAM.

Less ideal when

You need restic-style encrypted repositories and block-level dedupe.
You need rclone’s sync semantics across many files and remotes.
You rely on AWS S3 object tags (the tagging API). TagBackup’s tags are part of the key path/name, not S3 tag metadata.

Decision table

Concern	restic	rclone	TagBackup
Primary model	Encrypted snapshot repository	Sync/copy/mount of files	Tagged single-object push/pull
Encryption	Built-in (repository password)	Optional / provider-side / your wrappers	Your dump encryption if you add it; tool itself is transport to your bucket
Deduplication	Yes (content-addressed)	No (file copy)	No (one object per push)
“Latest dump for prod”	Snapshot IDs / tags in restic sense	Naming conventions + scripts	`pull --tag=… --latest`
Retention	`forget` / `prune` policies	Lifecycle rules or scripted deletes	`delete --tag=… --older-than=…`
Browse UI	Various GUIs exist externally	Web GUIs / mounts	Built-in `tagbackup serve` (localhost)
Best mental fit	Whole-system / tree backup	Move data between places	Cron dump → offsite → laptop pull

A realistic split

For a small production box:

restic (or your hoster’s snapshot feature) for the OS and application trees you cannot afford to lose.
TagBackup for the nightly pg_dump / mysqldump that developers restore onto laptops — cheap object storage (R2 or B2 is often enough), tags for environment and schedule, prune with --older-than.
rclone only if you also need to sync a tree of artefacts, media, or multi-cloud copies that are not “one tagged dump.”

Example TagBackup retention line (verified against the docs):

tagbackup delete --bucket=dbbackup --tag=nightly+prod --older-than=30d --force

List before you prune:

tagbackup files --bucket=dbbackup --tag=nightly+prod
tagbackup delete --bucket=dbbackup --tag=nightly+prod --older-than=30d --dry-run

When TagBackup is enough on its own

One (or a few) dump files per job.
You already trust the bucket provider for at-rest encryption, or you encrypt the dump before push (gpg, age, etc.).
Developers need a boring command to fetch the newest matching dump.
You do not want to teach the team a repository tool just to grab last night’s SQL.

When those are not true, prefer restic or rclone without guilt. Tools are cheap; picking the wrong abstraction is expensive.

restic vs rclone vs TagBackup for database and file dumps

Short version

When to use which

restic — full encrypted repository backups

rclone — sync and copy swiss army knife

TagBackup — tagged single-file dumps

Decision table

A realistic split

When TagBackup is enough on its own

Further reading