$ sudo docker run --name borgbackup_sshd \
    -v ssh_host_keys:/etc/ssh/host_keys:rw \
    -v /somewhere:/repository:rw \
    --tmpfs /home/borg/.ssh:mode=1777,size=16k \
    --tmpfs /tmp:mode=1777,size=1M \
    -p 2200:2200 \
    -e SSH_CLIENT_PUBLIC_KEYS="$(cat ~/.ssh/id_*.pub)" \
    -e SSH_CLIENT_PUBLIC_KEYS_APPEND_ONLY="$(cat optional-append-only-keys.pub)" \
    --read-only --security-opt=no-new-privileges --cap-drop=ALL \
    docker.io/fphammerle/borgbackup-sshd

$ borg init --encryption=editme ssh://[email protected]:2200//repository

$ borg create --stats ssh://[email protected]:2200//repository::{hostname}-{utcnow} \
    ~/documents ~/photos ...

$ sudo docker run --name borgbackup_sshd \
    -v repo_foo:/some/where/repo-foo \
    -e REPO_PATH_foo=/some/where/repo-foo \
    -e SSH_CLIENT_PUBLIC_KEYS_foo="$(cat keys-foo.pub)" \
    -e SSH_CLIENT_PUBLIC_KEYS_APPEND_ONLY_foo="$(cat keys-foo-append-only.pub)" \
    ...
    -v repo_bar:/some/where/else/bar \
    -e REPO_PATH_bar=/some/where/else/bar \
    -e SSH_CLIENT_PUBLIC_KEYS_bar="$(cat keys-bar.pub)" \
    -e SSH_CLIENT_PUBLIC_KEYS_APPEND_ONLY_bar="$(cat keys-bar-append-only.pub)" \
    ...

$ sudo docker run --name borgbackup_sshd \
    -v repo_foo:/some/where/repo-foo \
    -e REPO_PATH_foo=/some/where/repo-foo \
    -v repo_bar:/some/where/else/bar \
    -e REPO_PATH_bar=/some/where/else/bar \
    ...
    -e SSH_CLIENT_PUBLIC_KEYS_ALL="$(cat ~/.ssh/id_*.pub)" \
    ...