embabel backup [directory]

Everything the appliance knows, copied to a folder on the host: a cold tarball of each volume the appliance’s graph engine keeps data in (the data volume, and Neo4j’s on a Neo4j appliance), this machine’s .env, secrets.env and mounts override, and a manifest recording when it was taken, from which images, at which checkout commit.

Backups go under ~/embabel-backups unless you name a directory — deliberately outside the install folder, because embabel uninstall deletes that folder and a backup an uninstall removes is not a backup. Each run makes its own timestamped folder, so backing up twice never overwrites the first one.

The copy is cold. Whichever mode is running stops for it and starts again afterwards — including on a failure, so a backup that goes wrong is never the reason your assistant is down. This is not caution: a graph copied while it is live restores as a corrupt graph — Community Neo4j has no online backup, and the Embabel engine’s SQLite file is torn the same way mid-write.

The volume bytes never cross a bind mount — a helper container tars them to stdout and the CLI streams that to the file — so Docker Desktop’s file-sharing list has no opinion about where a backup may live, and an external disk works.

Flag
--list	what backups are already in that directory, newest first

The folder holds credentials: the database password, provider keys, realm tokens. Treat it like the keys it holds — the README.txt written beside them says so too.