ops@toolbox:~$ tarcommandexamples --run

tar Command Examples

The tar invocations you actually need: create, extract, list, compress, exclude.

CommandWhat it does
tar -czf backup.tar.gz /etcCreate (c) a gzip-compressed (z) archive file (f) from /etc.
tar -xzf backup.tar.gzExtract (x) a .tar.gz into the current directory.
tar -xzf backup.tar.gz -C /restoreExtract into /restore instead of the current directory.
tar -tzf backup.tar.gzList (t) contents without extracting. Always do this before extracting an unfamiliar archive.
tar -xzf a.tar.gz etc/nginx/nginx.confExtract only one file (path exactly as shown by -t).
tar -czf site.tar.gz --exclude='*.log' --exclude='node_modules' /srv/siteCreate while excluding patterns. --exclude goes before the source path.
tar -cJf backup.tar.xz /dataxz compression (J): much smaller, much slower. zstd (--zstd) is the modern speed/size sweet spot.
tar -caf backup.tar.zst /dataAuto-select compressor (a) from the filename extension.
tar -czpf full.tar.gz --same-owner /homePreserve permissions (p) and ownership, for backups run as root.
tar -xzf app.tar.gz --strip-components=1Drop the leading directory: extract archive/app/* as app/*.
tar -czf - /data | ssh host 'cat > /backup/data.tar.gz'Stream an archive over SSH without a local temp file (f - = stdout).
ssh host 'tar -czf - /data' | tar -xzf -Copy a tree between machines through a pipe.
tar -dzf backup.tar.gzDiff (d): compare archive contents against the filesystem.
tar --append -f archive.tar newfileAppend to an uncompressed archive (append doesn't work through gzip).

Decoding the flag soup

Every tar command is built from the same pieces: exactly one operation, create, extract, list, plus f for "the archive is this file" (almost always needed, almost always last before the filename), a compressor (z gzip, j bzip2, J xz, --zstd), and modifiers like v for verbose. Read -czf as "create, gzip, file:" and the whole table above becomes predictable rather than memorised.

Habits that prevent disasters

List before extracting (-t): a well-made archive contains a single top-level directory; a careless one is a "tar bomb" that sprays files into your current directory. Extract into a fresh directory or use -C when unsure. For backups, run as root with -p --same-owner or restored permissions will silently belong to whoever extracted. And keep archive paths relative (tar strips leading / by default, a safety feature, not a bug) so a restore can't blindly overwrite a live /etc.

Choosing compression in 2026

gzip (z) remains the compatibility default. xz (J) squeezes ~30% smaller but can be ten times slower to create. zstd (--zstd) compresses nearly as well as xz at nearly gzip speed and decompresses faster than both, for backups on modern systems it's the right answer, and -a with a .tar.zst filename selects it automatically. For huge trees, compression, not disk I/O, is usually the bottleneck: -I 'zstd -T0' (or pigz for gzip) uses all cores.

Related tools

DNS Record Types
Searchable reference of DNS record types with practical notes.
HTTP Headers Reference
Searchable reference of the HTTP request and response headers that matter in operations.
Linux Signals Reference
kill -9 and friends: every signal a sysadmin meets, with default actions and notes.
rsync Command Examples
The rsync invocations that matter: mirror, dry-run, delete, resume, bandwidth limits.