Bareos: Open-Source Backup Ledger 2026

Part of the Open-Source Backup Ledger (edition 2026-10-02). How the scores work: methodology.

Snapshot

Kind: Backup platform
Licence: AGPLv3; all plugins (VMware, Proxmox, Hyper-V, NDMP, MSSQL) open source
Backer: Bareos GmbH & Co. KG (Cologne), which sells subscriptions
Paid edition or support: Subscriptions Basic to Platinum with certified repositories and long-term support (quote only)
Latest release: 25.1.1, 2026-09-03
Next signal: Bareos 26: Vue web UI as default, Proxmox and Hyper-V plugin hardening, GlusterFS removal
Archetype: Vendor-led open platform, growing fastest
Evidence grade: A. CHANGELOG, PRs and releases read on GitHub. Yearly commit figures are 100-commit samples.

Scorecard

Dimension	Score	Direction
Capability today	75.4 / 100	higher is better
Momentum since end of 2022	+16.2 points	higher is better
Credibility	20.5 / 25	higher is better
Sustainability risk	9.0 / 25	lower is better
Technical lock-in	10.0 / 25	lower is better
Support and ecosystem	15.5 / 20	higher is better
AI leverage	1.5 / 20	higher is better
Ledger Index	67.7 / 100	balanced weights

Capability by domain

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Domain (weight)	2016	2019	2022	Today
Virtual and physical servers (12)	3.5	3.5	3.5	4.5
Databases and applications (12)	2	3	3	3.5
Recovery (14)	3	3	3	3.5
Cyber resilience (14)	1.5	2	2	3.5
Storage efficiency and targets (10)	2	3	3	3.5
Long-term retention and tape (6)	4	4	4.5	5
Replication and DR (10)	2.5	3	3	3
Security and compliance (8)	3	3.5	3.5	4
New-platform support (VMware exit) (8)	1.5	1.5	1.5	4
Management at scale and automation (6)	2.5	3	3.5	4
Total / 100	49.8	58.0	59.2	75.4

Year by year: 2016: 49.8 · 2017: 49.8 · 2018: 49.8 · 2019: 58.0 · 2020: 58.0 · 2021: 58.0 · 2022: 59.2 · 2023: 60.4 · 2024: 64.2 · 2025: 74.8 · 2026: 75.4

What moved the score

Year	Domain	Change	Points	Trigger
2019	Cyber resilience	1.5 → 2	+1.4	TLS-PSK; retention locks
2019	Databases and applications	2 → 3	+2.4	MSSQL VDI with log backups; PostgreSQL and MySQL plugins; NDMP
2019	Management at scale and automation	2.5 → 3	+0.6	python-bareos library
2019	Replication and DR	2.5 → 3	+1.0	Offsite copies to S3
2019	Security and compliance	3 → 3.5	+0.8	TLS-PSK; web UI multi-tenancy and ACLs
2019	Storage efficiency and targets	2 → 3	+2.0	S3 through the Droplet backend
2022	Long-term retention and tape	4 → 4.5	+0.6	Tape lifecycle with LTO encryption management
2022	Management at scale and automation	3 → 3.5	+0.6	Ansible collection
2023	Databases and applications	3 → 3.5	+1.2	23.0: rewritten PostgreSQL plugin; MariaDB backup plugin
2024	Cyber resilience	2 → 3	+2.8	24.0: native WORM storage backend
2024	Storage efficiency and targets	3 → 3.5	+1.0	24.0: dedupable storage backend
2025	Cyber resilience	3 → 3.5	+1.4	25.0: media_vault air-gap rotation
2025	Long-term retention and tape	4.5 → 5	+0.6	WORM tape and offsite vaulting
2025	New-platform support (VMware exit)	1.5 → 4	+4.0	25.0/25.1: agentless Proxmox, Hyper-V and Incus
2025	Recovery	3 → 3.5	+1.4	25.0: Proxmox and Hyper-V VM restore; Windows bare-metal imager
2025	Security and compliance	3.5 → 4	+0.8	Role-based web UI access, LDAP/AD; MFA only through PAM
2025	Virtual and physical servers	3.5 → 4.5	+2.4	25.0: agentless Proxmox and Hyper-V plugins
2026	Management at scale and automation	3.5 → 4	+0.6	25.1: Vue web UI, gRPC plugins, Prometheus exporter

Direction, 2023 to 2026

Each item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

Date	Item	Theme	Driver
2023-12	23.0: PostgreSQL plugin rewrite	D2 Databases and applications	C
2023-12	23.0: parallel compression in the file daemon	D5 Storage efficiency	C
2024-12	24.0: dedupable storage backend	D5 Storage efficiency	C
2024-12	24.0: gRPC out-of-process plugins	D10 Scale and automation	V
2024-12	24.0: native WORM media support	D4 Cyber resilience	M
2025-12	25.0: Windows bare-metal imager (barri)	D3 Recovery	C
2025-12	25.0: agentless Hyper-V plugin	D1 Virtual and physical servers	M
2025-12	25.0: agentless Proxmox VE plugin	D1 Virtual and physical servers	M
2025-12	25.0: media_vault air-gap rotation	D4 Cyber resilience	M
2026-08	25.1: Incus/LXD plugin; Vue web UI	D1 Virtual and physical servers	C

Centre of gravity: Virtual and physical servers (3), Storage efficiency (2), Cyber resilience (2)
Driver mix: Vision 10%, Customer need 50%, Market window 40%, Upstream 0%, Portfolio 0%

Credibility: 20.5 / 25

Criterion	Score	Basis
Cadence	4.5	Yearly major release with 10 to 16 tags a year
Roadmap transparency	4.5	Public GitHub PRs, milestones and CHANGELOG
Say-do	4	10 of 10 items shipped, but with 10 to 27 months from proposal to release
Velocity	4	Steady feature delivery every year
Lifecycle stability	3.5	Up to 5 years of LTS for subscribers; MySQL and SQLite catalog backends removed in 21

Say-do record, 2023 to 2026: 10 forward items since 2023, all shipped. Lags were long: dedupe backend about 20 months, Proxmox plugin about 23, new web UI about 27.

Sustainability risk: 9.0 / 25 (lower is better)

Criterion	Score	Basis
Maintainer concentration	3.5	81 to 97% of sampled commits from bareos.com
Backer health	2	Bareos GmbH, stable since 2012, small company
Licence-change risk	1.5	AGPLv3 with every plugin open; no relicensing in 16 years
Abandonment signs	0.5	Active: last commit 2026-10-02, 57 open issues with a 24-day median age
Security response	1.5	Active maintenance; advisory process not separately checked

Project health: Last release 2026-09-03. 1,260 stars, 317 forks. 57 open issues (median age 24 days), 38 open PRs (24 days). 6 to 14 distinct authors a year; maintainer handover to Andreas Rogge and Sebastian Sura in 2023.

Technical lock-in: 10.0 / 25 (lower is better)

Criterion	Score	Basis
Formats	3	Bareos volume format (from Bacula)
Export path	1.5	bextract and bls read volumes without the Director
Stack coupling	2.5	Daemons plus a mandatory PostgreSQL catalog; PHP or Vue web UI
Hardware / cloud coupling	0	Any POSIX storage, tape or S3; no phone-home
Skills and tooling coupling	3	Bacula-style configuration skills

Support and ecosystem: 15.5 / 20

Criterion	Score	Basis
Paid support	4	Four subscription tiers with LTS packages
Consultants and partners	4	Partners in Europe, North America and Japan; training and certification
Documentation	4	Versioned documentation per release
Community and packaging	3.5	Official repositories for all major distros; Google group, GitHub discussions

AI leverage: 1.5 / 20

Strand	Today	Latest step
AI for protection / protecting AI	0	none
AI platform stack	0	none
AI-assisted operations	0	none
Agent openness	1.5	2019: python-bareos library and Director API

No AI or machine-learning feature, and none announced.

Reading

Bareos is the most complete open-source backup platform in this Ledger and the one moving fastest toward VMware leavers: agentless Proxmox and Hyper-V arrived in 2025, on top of long-standing VMware, tape and database support. Everything is AGPLv3 with no closed plugins, and the company behind it ships every year. The trade-offs are long lead times from proposal to release and dependence on one small company for nearly all commits.

Open questions and evidence caveats

The Proxmox and Hyper-V plugins are less than a year old; production maturity is the next thing to check.
Yearly commit figures are samples of 100 commits, so trends rely on distinct authors and release counts.
MFA is only available through PAM or a reverse proxy, not natively.