diff --git a/backup/Dockerfile b/backup/Dockerfile
new file mode 100644
index 0000000..8e1d651
--- /dev/null
+++ b/backup/Dockerfile
@@ -0,0 +1,11 @@
+FROM alpine:3.20
+
+RUN apk add --no-cache restic postgresql16-client curl tzdata dcron tar bash
+
+COPY backup/backup.sh /backup.sh
+COPY backup/entrypoint.sh /entrypoint.sh
+COPY backup/crontab /etc/crontabs/root
+
+RUN chmod +x /backup.sh /entrypoint.sh
+
+ENTRYPOINT ["/entrypoint.sh"]
diff --git a/backup/backup.sh b/backup/backup.sh
new file mode 100644
index 0000000..d11b97f
--- /dev/null
+++ b/backup/backup.sh
@@ -0,0 +1,3 @@
+#!/bin/bash
+set -euo pipefail
+exit 0
diff --git a/backup/crontab b/backup/crontab
new file mode 100644
index 0000000..3686087
--- /dev/null
+++ b/backup/crontab
@@ -0,0 +1,2 @@
+0 3 * * * /backup.sh >> /proc/1/fd/1 2>&1
+0 4 * * 0 restic check >> /proc/1/fd/1 2>&1
diff --git a/backup/entrypoint.sh b/backup/entrypoint.sh
new file mode 100644
index 0000000..b063181
--- /dev/null
+++ b/backup/entrypoint.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+set -euo pipefail
+
+if ! restic snapshots >/dev/null 2>&1; then
+  restic init
+fi
+
+exec crond -f -l 2