Restic publishes container images and can be run in one-shot backup jobs.
docker run --rm ghcr.io/restic/restic:latest version
docker run --rm \
-e RESTIC_REPOSITORY="/repo" \
-e RESTIC_PASSWORD="change-me" \
-v /srv/data:/data:ro \
-v /srv/restic-repo:/repo \
ghcr.io/restic/restic:latest \
backup /data
RESTIC_PASSWORD_FILE and mounted secret files for production.