Base
Hardened build
minimal ports, security patches applied at build time
WAL-G PostgreSQL Backup & PITR Host on Ubuntu 24.04 LTS
Azure
Databases
WAL-G, an archival and restore tool for PostgreSQL, shipped as a complete backup host that streams write ahead log and takes base backups with point in time recovery.
Overview
WAL-G is an archival and restore tool for PostgreSQL that continuously streams write ahead log and takes full and delta base backups to storage, then restores a cluster to any point in time. It compresses and encrypts everything it writes and is built to back up databases of any size efficiently. It replaces hand rolled dump scripts with a tested, checksum aware backup stream that can be proven rather than assumed.
This image is a complete PostgreSQL backup and recovery host rather than a bare binary: a PostgreSQL server, WAL-G configured against it, continuous write ahead log archiving into an encrypted store on a dedicated volume, scheduled base backups and retention pruning, and a documented restore path. The store ships as a local file backend so the appliance works on its own, and the same appliance can be repointed at object storage such as Azure Blob by editing configuration alone.
Why the cloudimg image
cloudimg ships a backup host that has already proven itself. On the first boot of every instance the PostgreSQL superuser password and the archive encryption key are generated uniquely for that machine and written to a file only the root user can read, and an initial base backup is taken and listed, so the instance is protecting data before anyone logs in. Nothing is baked in: the image carries no password, no encryption key and no backup data at all. The database listens on the loopback interface only, so no database port is exposed to the network, and the sole inbound port is SSH. The archive lives on its own dedicated volume so backup growth can never fill the operating system disk, and every archived backup and log segment is encrypted with the per machine key. A self test ships in the image that takes a backup, writes a row, and recovers it into a scratch datadir by replaying archived log, so point in time recovery can be proven on demand rather than trusted. The base is fully patched with unattended security updates enabled, and every deployment is paired with a step by step deploy guide and backed by 24/7 cloudimg support.
Common uses
- Continuous write ahead log archiving and scheduled base backups for PostgreSQL
- Point in time recovery by replaying archived write ahead log into a restored cluster
- An encrypted backup store on a dedicated volume, repointable to Azure Blob or S3