Constrain Borg serve to exact repository paths when that is the intent

Test the exact repository boundary granted to a Borg server client.

Source facts

Borg 1.4.5 serve distinguishes restrict-to-path from restrict-to-repository. A permitted path also allows its subdirectories, whereas a permitted repository grants access only to that repository and does not implicitly include descendants. Both can be specified more than once. The append-only option governs low-level repository segment appending; it does not prohibit reading or issuing archive delete and prune operations. Repository selection and low-level append behavior are therefore different controls with different boundaries.

Source: Borg 1.4.5 — borg serve.

Applicability

This applies to Borg 1.4.5 server-process restrictions, including supervised SSH forced-command deployments. It does not establish a complete SSH account policy or certify immutable recovery storage.

DSE recommendation

DSE recommends writing the exact set of repositories a backup client should reach before selecting a restriction. Prefer an exact repository boundary when sibling or descendant repositories should remain separate. Review low-level append behavior independently of the archive operations visible to the client, and keep repository maintenance authority separate from ordinary backup access. Record how the server process receives its restrictions so a future account or service change does not silently broaden the permitted storage tree.

Verification

With disposable repositories, test the intended permitted target, a sibling repository, and a nested repository. Confirm the server enforces the selected boundary. Rehearse append-only behavior separately and record what clients can still read or logically remove, without describing that test as proof against every privileged administrator action.

Official reference

Borg 1.4.5 — borg serve. Reviewed October 15, 2026.