Use tar on Linux: Create, Inspect and Extract Archives Safely

The tar command groups files and directories into an archive. Compression is a separate layer, commonly gzip, bzip2 or xz. The examples below use GNU tar in Bash on disposable files; macOS and other BSD tar implementations can differ. Check tar --version and your installed manual before adapting GNU-specific options.

Create and list an archive

Run this practice sequence in one Bash session as an ordinary user. It creates a fresh private directory, including a hidden file, and writes the archive outside the source tree. No real website or home directory is read.

umask 077
lab=$(mktemp -d)
cd "$lab" || exit 1
mkdir source
printf 'hello\n' > source/readme.txt
printf 'setting=yes\n' > source/.settings
tar -cf site.tar -C source .
tar -tf site.tar

-c creates, -f names the archive, -t lists and -v adds verbose output. A new create operation can overwrite an existing archive, so do not reuse an important output name. The explicit . includes dotfiles; a shell wildcard would commonly omit them.

Extract into a new directory

mkdir restore
tar -xf site.tar -C restore --no-same-owner --no-same-permissions
cmp source/readme.txt restore/readme.txt
cmp source/.settings restore/.settings

-x extracts. -C changes the working directory; the destination must already exist, and extraction still creates archived files and directories there. These comparisons check two synthetic files, not the completeness of a real backup. Restoring original ownership, ACLs, extended attributes or security labels requires a deliberate compatible recovery plan.

List trusted members before selecting one. In this fixture its stored name begins with ./:

mkdir selected
tar -xf site.tar -C selected ./readme.txt
mkdir matching
tar -xf site.tar -C matching --wildcards './*.txt'

Quote wildcard expressions so the shell does not expand them first. GNU -w asks for interactive confirmation; it is inappropriate for an unattended job. Listing or confirming a name does not make a malicious archive safe. Extract unfamiliar archives only with appropriate isolation and an unprivileged account, never over a live tree. Avoid -P, overwrite and permission-preservation overrides without a specific trusted restore requirement.

Compression

tar -czf site.tar.gz -C source .
gzip -t site.tar.gz
tar -tzf site.tar.gz

-z selects gzip, -j bzip2 and -J xz when those compressors are available. None encrypts data, and neither size nor speed has a universal winner. Extraction can use the matching compression option; GNU tar often detects compression when reading a named archive. Integrity checks do not prove required files were included.

Append, update and delete on a working copy

cp site.tar working.tar
printf 'extra\n' > source/extra.txt
tar -rf working.tar -C source ./extra.txt
tar -tf working.tar
tar --delete -f working.tar ./extra.txt
tar -tf working.tar

-r appends; -u appends files newer than matching stored members, rather than replacing the old member in place. GNU --delete removes named members from a suitable uncompressed archive. These are not direct editing operations on a gzip stream. If only a compressed original exists, decompress it to a separate working file, edit that copy and compress to a new output; retain the original until verified.

Exclusions and large backups

Place options such as --exclude='./cache' before source operands and confirm the resulting member list. Write outputs outside the input tree to avoid including the growing archive itself. For split archives, retain an explicit ordered part manifest and trusted checksums; concatenating an uncontrolled wildcard can include unrelated or misordered parts. Files changing during archiving and live databases need application-consistent capture, not just another tar option.

References: GNU tar manual and GNU tar security considerations.

Reviewed October 15, 2026. The five practice blocks were executed with synthetic files in a disposable GNU/Linux container. No customer archive, hostile-archive sandbox or application restore was tested.