Linux · file management

tar

many files into one

tar gathers files and directories into one archive, keeping their names, permissions and timestamps. On its own it does not compress — it hands that to gzip or xz — which is why archives are named .tar.gz and .tar.xz.

Three letters do most of it: c creates, x extracts, t lists — and f names the archive file.

Create

tar -czf

c, with gzip, to a file

Extract

tar -xzf

x, into the current directory

List

tar -tzf

t, without unpacking

Keeps

Modes and times

and the directory structure

At the terminal

Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.

user@netflow — bashtar

$ tar -czvf site-backup.tar.gz site/

1site/

site/index.html

site/css/

site/css/style.css

$ ls -lh site-backup.tar.gz

2-rw-r--r-- 1 user user 1.2M Sep 30 11:40 site-backup.tar.gz

3$ tar -tzf site-backup.tar.gz | head -2

site/

site/index.html

4$ tar -xzf site-backup.tar.gz -C /tmp/restore

Illustrative session · names, sizes and dates are examples, and every address is from a documentation or private range

Reading the output

What the numbered lines are telling you

-v lists each entry as it is added

c creates, z compresses with gzip, v is verbose, f names the archive. The paths are stored exactly as shown, starting with "site/".

One file holds the whole tree

The archive is an ordinary file. It can be copied, sent over the network or kept as a backup.

t lists without unpacking

Always worth doing first: it shows what the archive will create, and where, before anything is written.

-C chooses where to extract

Without it, x unpacks into the current directory. The directory named by -C must already exist.

Switches

A switch changes how the command behaves. These are the ones used day to day; man tar lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.

-c: Create a new archive.
-x: Extract files from an archive.
-t: List the contents of an archive without extracting.
-f FILE: The archive to work on. Nearly every tar command needs it.
-z: Compress or decompress with gzip — the .tar.gz format.
-J: Compress or decompress with xz — smaller, slower. -j is bzip2.
-v: Verbose: print each file as it is added or extracted.
-C DIR: Change to this directory before extracting or adding.

Variations worth knowing

The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.

tar -xf archive.tar.xz

Extracts any archive — modern tar works out the compression by itself when reading.

tar -czf etc-$(date +%F).tar.gz /etc

Makes a dated backup of a directory, such as etc-2026-09-30.tar.gz.

tar -xzf backup.tar.gz site/index.html

Extracts a single file from the archive, by its stored path.

tar -czf code.tar.gz --exclude=node_modules project/

Leaves a directory out of the archive.

In cybersecurity

An archive is a list of paths that tar will write for you, so one from an untrusted source deserves a look before it is unpacked.

List before you extract

An archive can hold thousands of files with no top directory, or names you did not expect. "tar -tf" shows them first; extract into an empty directory.

Never extract as root without need

As root, tar restores the stored owners and set-uid bits. A hostile archive can then leave a root-owned set-uid program behind.

Backups hold secrets

A tar of /etc or a home directory contains keys and password hashes. Give the archive the permissions the originals had, and encrypt it if it leaves the machine.

Filed under

File management

Read alongside

cpCopies files and directories, optionally preserving their permissions, ownership and timestamps.duAdds up how much disk space a directory and everything inside it is using.