The only option is a full download of all pictures, and they do their damnedest to ensure it's uncomfortable. Albums aren't properly labelled and linked. Labels are a mess. Picture naming is broken. Exif data randomly stripped or altered. Duplicates galore. This process ensures that, even if one is diligent and ensures they regularly download the entire database, they'll end up with a completely unmanageable picture library with dozens of duplicates. And most people aren't that studious.
Caveat 1: it's technically a sync, not a backup. The risk remains that Apple deletes all my pictures remotely, and this deletion propagates to delete my local copies. There is still a recycle bin, but perhaps Apple has some way of deleting even that remotely. I don't think so, but it's a risk. To mitigate this, I periodically download all pictures to "cold" storage. It's fragmented and poorly categorised but at least the pictures are there in the case of a catastrophe.
Caveat 2: this only works in the Apple ecosystem.
For Unraid/Windows (Docker), I found this: https://www.reddit.com/r/selfhosted/comments/tsxi5k/icloudpd...