Bacula Community: Open-Source Backup Ledger 2026

Part of the Open-Source Backup Ledger (edition 2026-10-02). How the scores work: methodology.

Snapshot

Kind: Backup platform
Licence: AGPLv3 with Section 7 terms (FLOSS exception, trademark clause); contributions need a copyright assignment
Backer: Bacula Systems SA (Switzerland), which sells Bacula Enterprise
Paid edition or support: Bacula Enterprise subscriptions (quote only); hypervisor and database plugins are Enterprise-only
Latest release: 17.0.0, 2026-08-06
Next signal: 17.x: catalog 1027 stabilisation, storage-group balancing, tighter daemon TLS
Archetype: Open-core platform with a thinning community edition
Evidence grade: A. Release notes and GitLab API read directly; GitLab issues are disabled, so issue-age metrics are missing.

Scorecard

Dimension	Score	Direction
Capability today	58.0 / 100	higher is better
Momentum since end of 2022	+5.6 points	higher is better
Credibility	15.5 / 25	higher is better
Sustainability risk	15.0 / 25	lower is better
Technical lock-in	10.0 / 25	lower is better
Support and ecosystem	14.0 / 20	higher is better
AI leverage	1.5 / 20	higher is better
Ledger Index	51.8 / 100	balanced weights

Capability by domain

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Domain (weight)	2016	2019	2022	Today
Virtual and physical servers (12)	2.5	2.5	2.5	2.5
Databases and applications (12)	1.5	1.5	1.5	1.5
Recovery (14)	3	3	3	3
Cyber resilience (14)	1.5	2	2	3.5
Storage efficiency and targets (10)	2	3	3	3
Long-term retention and tape (6)	4	4.5	4.5	4.5
Replication and DR (10)	2.5	3	3	3
Security and compliance (8)	3	3	3.5	4
New-platform support (VMware exit) (8)	1	1	1	1
Management at scale and automation (6)	2.5	3.5	3.5	4
Total / 100	45.4	51.6	52.4	58.0

Year by year: 2016: 45.4 · 2017: 45.4 · 2018: 45.4 · 2019: 51.6 · 2020: 51.6 · 2021: 51.6 · 2022: 52.4 · 2023: 52.4 · 2024: 58.0 · 2025: 58.0 · 2026: 58.0

What moved the score

Year	Domain	Change	Points	Trigger
2019	Cyber resilience	1.5 → 2	+1.4	9.4: WORM tape cartridges
2019	Long-term retention and tape	4 → 4.5	+0.6	9.4: WORM tape
2019	Management at scale and automation	2.5 → 3.5	+1.2	Baculum web console and REST API
2019	Replication and DR	2.5 → 3	+1.0	Copy jobs to S3
2019	Storage efficiency and targets	2 → 3	+2.0	9.4: S3 cloud driver
2022	Security and compliance	3 → 3.5	+0.8	11.0/13.0: TLS-PSK, audit events, LDAP console login
2024	Cyber resilience	2 → 3.5	+4.2	15.0.2: immutable and append-only volumes, volume encryption, ClamAV and malware hash checks
2024	Management at scale and automation	3.5 → 4	+0.6	15.0.2: installation manager; official Ansible collection
2024	Security and compliance	3.5 → 4	+0.8	15.0.2: TOTP console authentication

Direction, 2023 to 2026

Each item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

Date	Item	Theme	Driver
2024-03	15.0.2: Bacula Installation Manager	D10 Scale and automation	C
2024-03	15.0.2: Kubernetes CSI snapshot plugin	D11 Ecosystem openness	V
2024-03	15.0.2: TOTP console authentication	D9 Security	C
2024-03	15.0.2: ZSTD compression, new cloud driver	D5 Storage efficiency	C
2024-03	15.0.2: immutable and append-only volumes	D4 Cyber resilience	M
2024-03	15.0.2: volume encryption, ClamAV plugin, malware hash checks	D4 Cyber resilience	M
2025-03	15.0.3: enforced malware database download	D4 Cyber resilience	M
2026-08	17.0.0: catalog 1027, IBM lin_tape integration	D8 Retention and tape	C

Centre of gravity: Cyber resilience (3), Security (1), Storage efficiency (1)
Driver mix: Vision 12%, Customer need 50%, Market window 38%, Upstream 0%, Portfolio 0%

Credibility: 15.5 / 25

Criterion	Score	Basis
Cadence	3	About one release a year (15.0.2 2024, 15.0.3 2025, 17.0.0 2026)
Roadmap transparency	2.5	Release notes and GitLab public; issues and merge requests disabled, bug tracker on MantisBT; no public roadmap
Say-do	4	10 of 10 items shipped, but most were taken from beta notes of the same release
Velocity	2.5	Commits fell from 1,142 (2023) to 196 (2024), 26 (2025) and 5 (2026 to date)
Lifecycle stability	3.5	Long-lived lines with in-place catalog upgrades

Say-do record, 2023 to 2026: 10 forward items, 10 shipped, typically 4.7 months from beta notes to release. A weak test: the items came from beta notes, not an independent roadmap.

Sustainability risk: 15.0 / 25 (lower is better)

Criterion	Score	Basis
Maintainer concentration	4	Over 75% of commits since 2021 from baculasystems.com
Backer health	2.5	Bacula Systems is a going concern, but its effort goes to the Enterprise edition
Licence-change risk	3	Copyright assignment to Bacula Systems / Kern Sibbald makes relicensing possible
Abandonment signs	3	Commit activity collapsed in 2025-2026 even though 17.0.0 shipped
Security response	2.5	No public advisory process found

Project health: Last release 2026-08-06. Commits per year: 1,602 (2022), 1,142 (2023), 196 (2024), 26 (2025), 5 (2026 to 1 Oct). Distinct authors fell from 26 to 2. Issues tracked on MantisBT, not GitLab.

Technical lock-in: 10.0 / 25 (lower is better)

Criterion	Score	Basis
Formats	3	Proprietary Bacula volume format (BB03 since 15.0.2)
Export path	1.5	bextract and bls read volumes without Director or catalog
Stack coupling	2.5	Director, Storage and File daemons plus a SQL catalog; web UI needs PHP
Hardware / cloud coupling	0	Any POSIX storage, tape or S3; no phone-home
Skills and tooling coupling	3	Complex configuration; Bacula-specific skills

Support and ecosystem: 14.0 / 20

Criterion	Score	Basis
Paid support	3	Paid support is through Bacula Enterprise, not the community edition
Consultants and partners	3.5	Regional integrators; Bacula Administrator I and II certification
Documentation	4	Manual of more than 1,200 pages; REST API documented in Swagger
Community and packaging	3.5	Packaged in Debian, Ubuntu, EPEL, openSUSE (often old versions); mailing list since 2001

AI leverage: 1.5 / 20

Strand	Today	Latest step
AI for protection / protecting AI	0	none
AI platform stack	0	none
AI-assisted operations	0	none
Agent openness	1.5	2019: Baculum REST API

No machine-learning feature. Malware detection in 15.0.2 is signature and hash based, which this Ledger does not count as AI.

Reading

Bacula Community is still a capable tape-first backup system, and 15.0.2 brought real ransomware defences (immutable volumes, malware checks). But everything that matters for VMware leavers, agentless VM and database plugins, is reserved for Bacula Enterprise, and community development has nearly stopped since 2024. Treat it as a stable engine for file and tape backup, not as a growing platform.

Open questions and evidence caveats

Commit counts come from the GitLab API; the 2026 count (5) may miss work pushed in bulk before 17.0.0.
Issue-age metrics are not available because GitLab issues are disabled.
Bacula Enterprise is scored in the commercial Ledger, not here.