Proxmox VE can already back up virtual machines to compressed files, but each backup is a full copy: with ten machines and a few weeks of history, space runs out quickly. Proxmox Backup Server (PBS) was created to solve this. It is a separate, free product that integrates with the hypervisor and changes how backups are stored.
The idea: chunks and deduplication
PBS splits the data to be saved into chunks and identifies each by the cryptographic hash of its content. If a chunk with the same hash already exists in the datastore, it is not stored a second time. Each backup is therefore a list of references to chunks, and only new ones take up space.
There are two practical effects:
- deduplication: ten virtual machines running the same operating system share most of their chunks;
- incremental backups that look full: each backup restores on its own, with no chain of incrementals to rebuild, yet occupies only the difference.
For running virtual machines, Proxmox VE tracks changed blocks with a dirty bitmap: the next backup reads only those. The bitmap lives in memory, though, and is reset when the VM is shut down or the host restarts; the next backup then has to reread the whole disk, while still storing only new chunks.
Where to install it
PBS installs from a dedicated image or as a package on Debian. Realistic options at home:
- a separate physical machine, even a modest one, with its own disks: the best solution, because a hypervisor failure does not affect the backups;
- on the NAS, as a virtual machine, if the NAS is a system separate from the hypervisor;
- on the same Proxmox VE host, in a virtual machine or alongside the hypervisor: handy to start with, but it must be paired with a copy elsewhere.
The datastore works with a great many small files and lots of random reads during verification and cleanup. SSDs are ideal; with spinning disks, use a ZFS pool with an SSD special vdev for metadata, or accept longer maintenance times.
Retention: how much to keep
The retention policy is expressed as a number of backups to keep per interval:
| Option | Meaning |
|---|---|
| keep-last | the last N backups |
| keep-daily | one for each of the last N days |
| keep-weekly | one for each of the last N weeks |
| keep-monthly | one for each of the last N months |
| keep-yearly | one for each of the last N years |
A reasonable combination for a homelab: 7 daily, 4 weekly, 6 monthly. Thanks to deduplication, longer history costs less than you might think.
Removing expired backups happens in two stages: prune deletes the references, while garbage collection physically removes chunks no longer used by any backup. Until garbage collection runs, space is not freed.
Verification
A backup that cannot be restored is worthless. PBS offers verify jobs that reread chunks and check their hashes, flagging any corruption on the storage. Schedule them weekly and set up email notifications.
Technical verification does not replace a practical test, though: in my work I periodically restore a virtual machine into a test environment and check that it boots and the data is intact.
Encryption
Backups can be encrypted client-side: the hypervisor encrypts the data before sending it, with a key PBS does not know. This protects the data if the backup server is compromised or a copy of it falls into someone else's hands.
The trade-off is stark: without the key, the backups are unrecoverable. Export the key and keep it in at least two safe places outside the hypervisor, for example in a password manager and on paper in a secure location.
Restoring individual files
Besides restoring a whole virtual machine, PBS lets you browse a backup's contents and download single files or folders. For containers it works directly; for virtual machines the feature is available from the Proxmox VE interface with the most common file systems. It is the feature you use most: a configuration file changed by mistake, a deleted document.
The off-site copy
A single PBS at home protects against failures and mistakes, not theft or fire. Two routes:
- a sync job to a second PBS at another site, which downloads only missing chunks and so needs little bandwidth after the first copy;
- tape backup, supported by PBS, for anyone with an LTO drive.
With client-side encryption, the second server can even be hosted by a third party without it being able to read the data.
In short
- PBS stores deduplicated chunks: each backup is complete but occupies only the differences.
- The backup server should sit on hardware separate from the hypervisor, ideally on SSD.
- Prune and garbage collection together free the space of expired backups.
- Regular verification and test restores confirm the backups work.
- Keep the encryption key outside the hypervisor; make the remote copy with a sync job.
