Immutable Backups: Building a Ransomware-Resilient Architecture with BorgBackup and MinIO S3 Object Lock

The Evolution of Ransomware: Why Traditional Backups Fail

In the modern cybersecurity landscape, the question is no longer if an organization will face a ransomware attack, but when. Historically, standard backup strategies relied on the 3-2-1 rule: keeping three copies of data, across two different media types, with one copy stored offsite. While this framework remains foundational, sophisticated modern ransomware variants specifically target online backup repositories first. If an attacker gains administrative access to your network, they will attempt to encrypt, delete, or alter your backups before launching the primary payload. Without an immutable data layer, traditional backups are merely a false sense of security.

To achieve true resilience, modern enterprises must adopt Immutable Backups. This strategy guarantees that once data is written, it cannot be modified, overwritten, or deleted by any user—including root administrators—for a predefined retention period. This blog post provides a comprehensive guide to architecting a self-hosted, enterprise-grade immutable backup system leveraging two powerful open-source tools: BorgBackup and MinIO.

The Architectural Powerhouse: BorgBackup and MinIO WORM

Building a cost-effective yet robust backup infrastructure requires a combination of efficient data processing and strict storage enforcement. The integration of BorgBackup with MinIO satisfies both requirements seamlessly.

BorgBackup: Deduplication, Compression, and Encryption

BorgBackup (often simply called Borg) is a deduplicating backup program written in Python and C. It is highly regarded in the systems engineering community for several key reasons:

Deduplication: Borg uses a content-defined chunking algorithm to split files into variable-sized chunks. Only modified chunks are added to the repository, drastically reducing storage consumption.
Local Authenticated Encryption: Data can be encrypted using 256-bit AES-CTR with HMAC-SHA256, ensuring data confidentiality and integrity before it leaves the client machine.
Speed and Efficiency: Because of its caching mechanisms and chunking design, subsequent backups are remarkably fast, minimizing network overhead.

MinIO S3 Object Lock: True WORM Capabilities

MinIO is a high-performance, Kubernetes-native Object Storage suite compatible with the Amazon S3 API. To prevent ransomware from tampering with stored archives, MinIO utilizes S3 Object Lock, which implements a WORM (Write Once, Read Many) model. When Object Lock is enabled, objects enter a state where they are legally protected from deletion or modification.

MinIO supports two primary retention modes for Object Lock:

Governance Mode: Users with special permissions (such as `s3:BypassGovernanceRetention`) can overwrite or delete object versions, though standard users cannot. This is useful for internal policy compliance but vulnerable if the root credentials are compromised.
Compliance Mode: The gold standard for ransomware defense. No user, including the MinIO root account or system administrators, can delete or modify the data until the retention period expires. This creates an airtight barrier against malicious insider threats and external attackers alike.

Step-by-Step Architecture: Integrating Borg with MinIO via Rclone

Because BorgBackup natively expects a local filesystem or an SSH-accessible target, bridging it directly to an S3-compatible object store like MinIO requires a translation layer. We achieve this by using Rclone or Borgmatic combined with a local staging cache or an S3 fuse mount, or alternatively, utilizing Borg's native experimental S3 backends. However, the most robust, battle-tested architecture involves running Borg locally to an encrypted repository, and then syncing or streaming those repository files directly into a MinIO bucket protected by an active Object Lock policy.

Step 1: Setting Up the MinIO Bucket with Object Lock

First, you must initialize a MinIO bucket with strict Object Lock capabilities enabled at creation time. This cannot be retroactively applied to an existing standard bucket. Using the MinIO Client (mc) utility, execute the following commands:

mc mb --with-lock myminio/immutable-backups mc retention set --mode compliance --validity 30d myminio/immutable-backups

This configures the bucket named immutable-backups to enforce Compliance Mode for a duration of 30 days. Any data written to this bucket will be mathematically and programmatically locked for the next month.

Step 2: Preparing the BorgBackup Repository

On your production client server, initialize a new encrypted Borg repository. It is best practice to use the repokey-blake2 mode for optimal performance and cryptographic security:

borg init --encryption=repokey-blake2 /var/backup/borg-local

Once initialized, you can perform your initial backup archive ingestion:

borg create --stats --compression zstd,3 /var/backup/borg-local::{hostname}-{now:%Y-%m-%d} /etc /var/www /home

This command captures your critical data directories, compresses them using the highly efficient Zstandard algorithm, deduplicates the data against existing chunks, and encrypts it locally.Step 3: Streaming to MinIO via Rclone with WORM Protection

To safely offload your local Borg repository to your immutable MinIO storage, configure Rclone to target your MinIO instance. Use the rclone sync command to replicate your local repository to the S3 bucket:

rclone sync /var/backup/borg-local myminio:immutable-backups --immutable

The --immutable flag tells Rclone that files on the destination should never be modified or deleted. Because MinIO enforces Compliance Mode on the bucket level, even if an attacker compromises your production client and tries to force-delete the remote objects via Rclone or standard S3 commands, MinIO will reject the request with an AccessDenied error.

Disaster Recovery Operations: Restoring in a Post-Attack Scenario

Should your primary infrastructure fall victim to a ransomware deployment, your recovery strategy must be swift and structured. Because your backup repository is locked in MinIO, your historical recovery points remain pristine.

Rebuilding the Clean Environment

Before pulling data from your immutable MinIO store, ensure that the recovery environment is entirely sanitized and free of lateral network infections. Provision fresh server instances with verified operating system images.

Mounting and Extracting the Immutable Archives

Once your new environment is verified, configure your S3 connection credentials and fetch the required Borg repository files from the MinIO bucket. Because the files are immutable, you can pull them down safely knowing they have not been altered:

rclone copy myminio:immutable-backups /var/backup/borg-restore

With the repository safely downloaded locally, you can list your available historical snapshots to pinpoint the exact state of your data before the incident occurred:

borg list /var/backup/borg-restore

Identify the cleanest, most recent snapshot and initiate the extraction process to restore production capabilities:

borg extract /var/backup/borg-restore::server-2026-06-01

Best Practices for Monitoring and Operational Lifecycle

Deploying the software is only half the battle. To ensure long-term operational success, follow these foundational pillars:

Implement Strict IAM Policies: Ensure the S3 access keys used by your backup scripts possess restricted permissions. They should only have `s3:PutObject` and `s3:GetObject` capabilities. Crucially, withhold `s3:DeleteObject` and bucket-level modification rights from standard automation tokens.
Automate Retention Monitoring: Set up continuous alerting pipelines to track your storage capacity on MinIO. Because compliance mode prevents data pruning until the expiration window closes, your storage consumption will grow predictably. Monitor these metrics closely to avoid sudden out-of-disk events.
Regular Restoration Testing: A backup system is only as good as its proven recovery capability. Automate a weekly or monthly routine that pulls a locked archive from MinIO, extracts it inside an isolated sandbox sandbox, and runs automated integrity checks against the recovered databases and files.

Conclusion: Achieving Ultimate Peace of Mind

Defeating ransomware requires moving away from reactive detection models toward proactive, architectural enforcement. By pairing BorgBackup's industry-leading deduplication and encryption with MinIO's immutable S3 Object Lock in Compliance Mode, organizations can build an impenetrable vault for their critical business assets. Even if production credentials fall into malicious hands, your historical data trail remains untouched, giving your enterprise the ultimate leverage to refuse extortion demands and restore normal business operations with minimal downtime.