Restore from tar backup

What you will achieve

Restore files from tar archives safely — preserving permissions, avoiding overwrite of a running system root, and verifying archive integrity first.

1) Inspect before extracting

tar -tzf backup.tar.gz | head
tar -tzf backup.tar.gz | wc -l

2) Verify checksum

sha256sum -c backup.tar.gz.sha256

3) Restore to staging path

sudo mkdir -p /restore
sudo tar -xzf backup.tar.gz -C /restore
sudo rsync -aHAX /restore/etc/ /etc/

Never extract unknown archives directly over / on a live system — inspect paths for absolute entries (tar -tzf shows leading /).

4) Preserve ownership

sudo tar -xzpzf backup.tar.gz -C /target

-p preserves permissions; -z gzip; -f file.

Verify

diff -rq /restore/etc /etc | head
systemctl daemon-reload

5) List contents matching path

tar -tzf backup.tar.gz | grep 'etc/nginx'

6) Extract single file

tar -xzf backup.tar.gz -C /tmp etc/nginx/nginx.conf

7) GNU tar atime

tar --atime-preserve -xzf backup.tar.gz

Compression formats

• .tar.gz — gzip, universal.
• .tar.zst — faster, smaller; needs zstd support.
• .tar.xz — slow compress, small archives.

Disaster restore

Boot live USB, partition disk, mkfs, mount target at /mnt, extract archive to /mnt, chroot and reinstall GRUB — full bare-metal recovery path.

8) selinux contexts after restore

sudo restorecon -Rv /var/www

Fedora/RHEL restores need context fix or Apache serves files with permission denied despite chmod 644.

Prerequisites

Archive integrity verified (checksum). Target filesystem mounted with enough space. Know whether archive paths are absolute or relative. SELinux systems need restorecon after restore.

Partial restore workflow

Extract to /tmp/restore, diff against live, copy selectively — safer than wholesale overwrite of /etc on running production server.

xattr and ACLs

tar --xattrs -xzpzf backup.tar.gz

Include xattrs when backup source used SELinux or POSIX ACLs — plain tar drops them otherwise.

Pipe from ssh

ssh user@backuphost 'cat /backups/etc.tar.gz' | sudo tar -xzp -C /

Stream restore without copying archive locally first — saves disk on space-constrained recovery shell. Verify gzip integrity with gzip -t on source before piping.

GNU tar atime and xattrs together

Production restore checklist: verify owner, permissions, SELinux contexts, and systemd daemon-reload after /etc restore — tar solves files not running state.

Incremental tar with snapshot

rsync --link-dest snapshot then tar snapshot dir — faster incremental archives than full tar daily while keeping tar portability for offsite storage.

Related guides

• Restic encrypted backups intro
• Timeshift snapshots on Linux desktop