diff --git a/cli/app/backup.go b/cli/app/backup.go
index 96781dd2..f6c8d2ae 100644
--- a/cli/app/backup.go
+++ b/cli/app/backup.go
@@ -1,21 +1,12 @@
 package app
 
 import (
-	"context"
 	"fmt"
 
 	"coopcloud.tech/abra/cli/internal"
 	"coopcloud.tech/abra/pkg/autocomplete"
 	"coopcloud.tech/abra/pkg/client"
-	"coopcloud.tech/abra/pkg/config"
-	containerPkg "coopcloud.tech/abra/pkg/container"
 	"coopcloud.tech/abra/pkg/recipe"
-	"coopcloud.tech/abra/pkg/service"
-	"coopcloud.tech/abra/pkg/upstream/container"
-	"github.com/docker/cli/cli/command"
-	"github.com/docker/docker/api/types"
-	"github.com/docker/docker/api/types/filters"
-	dockerClient "github.com/docker/docker/client"
 	"github.com/sirupsen/logrus"
 	"github.com/urfave/cli"
 )
@@ -41,58 +32,6 @@ var resticRepoFlag = &cli.StringFlag{
 	Destination: &resticRepo,
 }
 
-// retrieveBackupBotContainer gets the deployed backupbot container.
-func retrieveBackupBotContainer(cl *dockerClient.Client) (types.Container, error) {
-	ctx := context.Background()
-	chosenService, err := service.GetServiceByLabel(ctx, cl, config.BackupbotLabel, internal.NoInput)
-	if err != nil {
-		return types.Container{}, err
-	}
-
-	logrus.Debugf("retrieved %s as backup enabled service", chosenService.Spec.Name)
-
-	filters := filters.NewArgs()
-	filters.Add("name", chosenService.Spec.Name)
-	targetContainer, err := containerPkg.GetContainer(
-		ctx,
-		cl,
-		filters,
-		internal.NoInput,
-	)
-	if err != nil {
-		return types.Container{}, err
-	}
-
-	return targetContainer, nil
-}
-
-// runBackupCmdRemote runs a backup related command on a remote backupbot container.
-func runBackupCmdRemote(cl *dockerClient.Client, backupCmd string, containerID string, execEnv []string) error {
-	execBackupListOpts := types.ExecConfig{
-		AttachStderr: true,
-		AttachStdin:  true,
-		AttachStdout: true,
-		Cmd:          []string{"/usr/bin/backup", "--", backupCmd},
-		Detach:       false,
-		Env:          execEnv,
-		Tty:          true,
-	}
-
-	logrus.Debugf("running backup %s on %s with exec config %v", backupCmd, containerID, execBackupListOpts)
-
-	// FIXME: avoid instantiating a new CLI
-	dcli, err := command.NewDockerCli()
-	if err != nil {
-		return err
-	}
-
-	if _, err := container.RunExec(dcli, cl, containerID, &execBackupListOpts); err != nil {
-		return err
-	}
-
-	return nil
-}
-
 var appBackupListCommand = cli.Command{
 	Name:    "list",
 	Aliases: []string{"ls"},
@@ -133,7 +72,7 @@ var appBackupListCommand = cli.Command{
 			logrus.Fatal(err)
 		}
 
-		targetContainer, err := retrieveBackupBotContainer(cl)
+		targetContainer, err := internal.RetrieveBackupBotContainer(cl)
 		if err != nil {
 			logrus.Fatal(err)
 		}
@@ -148,7 +87,7 @@ var appBackupListCommand = cli.Command{
 			execEnv = append(execEnv, fmt.Sprintf("INCLUDE_PATH=%s", includePath))
 		}
 
-		if err := runBackupCmdRemote(cl, "ls", targetContainer.ID, execEnv); err != nil {
+		if err := internal.RunBackupCmdRemote(cl, "ls", targetContainer.ID, execEnv); err != nil {
 			logrus.Fatal(err)
 		}
 
@@ -196,7 +135,7 @@ var appBackupDownloadCommand = cli.Command{
 			logrus.Fatal(err)
 		}
 
-		targetContainer, err := retrieveBackupBotContainer(cl)
+		targetContainer, err := internal.RetrieveBackupBotContainer(cl)
 		if err != nil {
 			logrus.Fatal(err)
 		}
@@ -211,7 +150,7 @@ var appBackupDownloadCommand = cli.Command{
 			execEnv = append(execEnv, fmt.Sprintf("INCLUDE_PATH=%s", includePath))
 		}
 
-		if err := runBackupCmdRemote(cl, "download", targetContainer.ID, execEnv); err != nil {
+		if err := internal.RunBackupCmdRemote(cl, "download", targetContainer.ID, execEnv); err != nil {
 			logrus.Fatal(err)
 		}
 
@@ -266,7 +205,7 @@ var appBackupCreateCommand = cli.Command{
 			logrus.Fatal(err)
 		}
 
-		targetContainer, err := retrieveBackupBotContainer(cl)
+		targetContainer, err := internal.RetrieveBackupBotContainer(cl)
 		if err != nil {
 			logrus.Fatal(err)
 		}
@@ -277,7 +216,7 @@ var appBackupCreateCommand = cli.Command{
 			execEnv = append(execEnv, fmt.Sprintf("RESTIC_REPO=%s", resticRepo))
 		}
 
-		if err := runBackupCmdRemote(cl, "create", targetContainer.ID, execEnv); err != nil {
+		if err := internal.RunBackupCmdRemote(cl, "create", targetContainer.ID, execEnv); err != nil {
 			logrus.Fatal(err)
 		}
 
@@ -324,7 +263,7 @@ var appBackupSnapshotsCommand = cli.Command{
 			logrus.Fatal(err)
 		}
 
-		targetContainer, err := retrieveBackupBotContainer(cl)
+		targetContainer, err := internal.RetrieveBackupBotContainer(cl)
 		if err != nil {
 			logrus.Fatal(err)
 		}
@@ -335,7 +274,7 @@ var appBackupSnapshotsCommand = cli.Command{
 			execEnv = append(execEnv, fmt.Sprintf("SNAPSHOT=%s", snapshot))
 		}
 
-		if err := runBackupCmdRemote(cl, "snapshots", targetContainer.ID, execEnv); err != nil {
+		if err := internal.RunBackupCmdRemote(cl, "snapshots", targetContainer.ID, execEnv); err != nil {
 			logrus.Fatal(err)
 		}
 
diff --git a/cli/app/restore.go b/cli/app/restore.go
index 209839d6..c80347f5 100644
--- a/cli/app/restore.go
+++ b/cli/app/restore.go
@@ -1,20 +1,12 @@
 package app
 
 import (
-	"context"
 	"fmt"
 
 	"coopcloud.tech/abra/cli/internal"
 	"coopcloud.tech/abra/pkg/autocomplete"
 	"coopcloud.tech/abra/pkg/client"
-	"coopcloud.tech/abra/pkg/config"
-	containerPkg "coopcloud.tech/abra/pkg/container"
 	"coopcloud.tech/abra/pkg/recipe"
-	"coopcloud.tech/abra/pkg/service"
-	"coopcloud.tech/abra/pkg/upstream/container"
-	"github.com/docker/cli/cli/command"
-	"github.com/docker/docker/api/types"
-	"github.com/docker/docker/api/types/filters"
 	"github.com/sirupsen/logrus"
 	"github.com/urfave/cli"
 )
@@ -66,21 +58,7 @@ var appRestoreCommand = cli.Command{
 			logrus.Fatal(err)
 		}
 
-		chosenService, err := service.GetServiceByLabel(context.Background(), cl, config.BackupbotLabel, internal.NoInput)
-		if err != nil {
-			logrus.Fatal(err)
-		}
-
-		logrus.Debugf("retrieved %s as backup enabled service", chosenService.Spec.Name)
-
-		filters := filters.NewArgs()
-		filters.Add("name", chosenService.Spec.Name)
-		targetContainer, err := containerPkg.GetContainer(
-			context.Background(),
-			cl,
-			filters,
-			internal.NoInput,
-		)
+		targetContainer, err := internal.RetrieveBackupBotContainer(cl)
 		if err != nil {
 			logrus.Fatal(err)
 		}
@@ -94,25 +72,8 @@ var appRestoreCommand = cli.Command{
 			logrus.Debugf("including TARGET=%s in backupbot exec invocation", targetPath)
 			execEnv = append(execEnv, fmt.Sprintf("TARGET=%s", targetPath))
 		}
-		execBackupListOpts := types.ExecConfig{
-			AttachStderr: true,
-			AttachStdin:  true,
-			AttachStdout: true,
-			Cmd:          []string{"/usr/bin/backup", "--", "restore"},
-			Detach:       false,
-			Env:          execEnv,
-			Tty:          true,
-		}
 
-		logrus.Debugf("running backup list on %s with exec config %v", targetContainer.ID, execBackupListOpts)
-
-		// FIXME: avoid instantiating a new CLI
-		dcli, err := command.NewDockerCli()
-		if err != nil {
-			logrus.Fatal(err)
-		}
-
-		if _, err := container.RunExec(dcli, cl, targetContainer.ID, &execBackupListOpts); err != nil {
+		if err := internal.RunBackupCmdRemote(cl, "restore", targetContainer.ID, execEnv); err != nil {
 			logrus.Fatal(err)
 		}
 
diff --git a/cli/internal/backup.go b/cli/internal/backup.go
index 79951810..530735c9 100644
--- a/cli/internal/backup.go
+++ b/cli/internal/backup.go
@@ -1,35 +1,67 @@
 package internal
 
 import (
-	"strings"
+	"context"
+
+	"coopcloud.tech/abra/pkg/config"
+	containerPkg "coopcloud.tech/abra/pkg/container"
+	"coopcloud.tech/abra/pkg/service"
+	"coopcloud.tech/abra/pkg/upstream/container"
+	"github.com/docker/cli/cli/command"
+	"github.com/docker/docker/api/types"
+	"github.com/docker/docker/api/types/filters"
+	dockerClient "github.com/docker/docker/client"
+	"github.com/sirupsen/logrus"
 )
 
-// SafeSplit splits up a string into a list of commands safely.
-func SafeSplit(s string) []string {
-	split := strings.Split(s, " ")
-
-	var result []string
-	var inquote string
-	var block string
-	for _, i := range split {
-		if inquote == "" {
-			if strings.HasPrefix(i, "'") || strings.HasPrefix(i, "\"") {
-				inquote = string(i[0])
-				block = strings.TrimPrefix(i, inquote) + " "
-			} else {
-				result = append(result, i)
-			}
-		} else {
-			if !strings.HasSuffix(i, inquote) {
-				block += i + " "
-			} else {
-				block += strings.TrimSuffix(i, inquote)
-				inquote = ""
-				result = append(result, block)
-				block = ""
-			}
-		}
+// RetrieveBackupBotContainer gets the deployed backupbot container.
+func RetrieveBackupBotContainer(cl *dockerClient.Client) (types.Container, error) {
+	ctx := context.Background()
+	chosenService, err := service.GetServiceByLabel(ctx, cl, config.BackupbotLabel, NoInput)
+	if err != nil {
+		return types.Container{}, err
 	}
 
-	return result
+	logrus.Debugf("retrieved %s as backup enabled service", chosenService.Spec.Name)
+
+	filters := filters.NewArgs()
+	filters.Add("name", chosenService.Spec.Name)
+	targetContainer, err := containerPkg.GetContainer(
+		ctx,
+		cl,
+		filters,
+		NoInput,
+	)
+	if err != nil {
+		return types.Container{}, err
+	}
+
+	return targetContainer, nil
+}
+
+// RunBackupCmdRemote runs a backup related command on a remote backupbot container.
+func RunBackupCmdRemote(cl *dockerClient.Client, backupCmd string, containerID string, execEnv []string) error {
+	execBackupListOpts := types.ExecConfig{
+		AttachStderr: true,
+		AttachStdin:  true,
+		AttachStdout: true,
+		Cmd:          []string{"/usr/bin/backup", "--", backupCmd},
+		Detach:       false,
+		Env:          execEnv,
+		Tty:          true,
+	}
+
+	logrus.Debugf("running backup %s on %s with exec config %v", backupCmd, containerID, execBackupListOpts)
+
+	// FIXME: avoid instantiating a new CLI
+	dcli, err := command.NewDockerCli()
+	if err != nil {
+		return err
+	}
+
+	if _, err := container.RunExec(dcli, cl, containerID, &execBackupListOpts); err != nil {
+		return err
+	}
+
+	return nil
 }