There are many ways to do this, but the next up from users is using groups!

For each file or data directory, create a group that owns it. This group should have the service's user as member. Then create a user for running the backups, and add it to all these groups.

The benefit of this is you don't have to use root, and you have an association of directory to group that you can always change. You can for example grant a user access to a data directory by just adding it to its group.

Might want to take a look at a dedicated backup tool like Borg. It will keep all the proper permissions and file attributes in the backup.

I am somewhat in the same boat, but more gentoo sided. For the main repo they killed mkstage4 because its outdated and insecure. So like you i wanted to backup my data (my gentoo install) to my nas or local storage. Rsync is the magic bullet for this. You can use ssh to securley transfer data to or from the server. And it automate it via a cron job (i suggest fcron) for a automatic timed backup/sync. Now i will add, rysnc can be used as a backup. But as the name implies it syncs data from one pc to the other. So if you break your desktop and it syncs to your server. Your SOLPDQ, thats only if you automate it tho.

And for the services id reccomend making a directory and adding all the services to a group, which owns the directory. Or the more lazy solution, which is probably frowned uponed. But you can rsync your docker container data to a directory where it has permissions to copy/sync.

Id highly recommend Rsync tho and just syncing offsite to another computer

If Unix permissions don’t work for you, acls are the next logical step.

1. Make a snapshot with LVM2 or BTRFS to ensure consistency, delete the snapshot after backing up.
2. You can back up files as root (I do) or a dedicated user that has perms to all the relevant data via groups.
3. Rsync can preserve users either numerically or by name.
4. Rsync can do incremental backups via hardlinks (you'll have a complete view of all files in each snapshot, but only pay the storage when files actually change).