Check explicit restic source paths against exclusion expectations

Review executed restic source arguments alongside filters before accepting backup scope.

Source facts

Restic’s backup guide states that exclusions do not override source paths explicitly passed to the backup command. The exact named file is backed up even if an exclusion would otherwise match it; directory contents are still filtered. The guide also describes cache-tag and marker-file exclusions, with different handling of the tag itself. Consequently, reviewing an exclusion file alone is insufficient to determine backup scope when a wrapper script also supplies explicit source arguments.

Source: restic — Backing Up.

Applicability

This applies to the stable restic backup command documented here. It addresses the interaction between explicit roots and exclusion rules, not a guarantee that every excluded item is absent from historical snapshots.

DSE recommendation

DSE recommends reviewing the final executed argument list alongside exclusion files and application-generated source lists. Use harmless test markers that represent sensitive or intentionally omitted paths before approving scope. Record whether a marker excludes a directory’s contents and whether the marker itself should remain. Keep historical cleanup requests separate from future backup filtering. Avoid assuming that adding a path to an exclusion list changes an older archive or overrides a script that explicitly names that file.

Verification

Build a disposable directory tree and compare a file named directly on the command line with the same file reached through a parent directory. Inspect each snapshot’s actual file listing. Retain the executed arguments and expected inclusion matrix, and investigate any difference before using real sensitive data.

Official reference

restic — Backing Up. Reviewed October 15, 2026.