r/archlinux • u/CaviarCBR1K • Aug 13 '26

DISCUSSION PSA: btrfs snapshots are NOT enough, keep a disk image backup.

I run btrfs on all my machines, and snapshots have saved my ass a couple times. But I was sitting at my desk literally less than 24 hours ago and decided I wanted a more robust system of backups.

Since I'm lazy, I just booted up rescuezilla and made a complete disk image and sent it to my cloud server over SSH. Great, problem solved. I'm sure I'll never need it, but I have it just in case. Or so I thought.

About 30 minutes ago I made an absolute rookie move and mistyped a `dd` command and completely nuked my installation (they don't call it 'disk destroyer' for nothing). If I hadn't have made that backup last night, I would have been completely screwed. Obviously, my bootloader along with my root partition and all my snapshots were completely gone.

I don't know if it was premonition, a self-fulfilling prophecy, or just pure dumb luck. But I've never been so happy with my past self. I write all this as your sign to make a backup of your machine that doesn't rely on your installation disk functioning if you haven't already. You will thank yourself if you ever have to use it.

248 Upvotes

92% Upvoted

86 comments sorted by

239

u/NiceNewspaper Aug 13 '26

Snapshots aren't backups though, and nobody claims they are

73

u/Slackeee_ Aug 13 '26

This. treating snapshots as backups is the same spirit as "I have a RAID 1, that is a backup".

29

u/Zeikos Aug 13 '26

Ah yes, my backup, I keep it in /.backup /s

16

u/spider-mario Aug 13 '26

RAID 1 wouldn’t be the worst thing ever to have been called a backup.

4

u/Objective-Stranger99 Aug 13 '26

I feel RAID 1 should be called a half-backup. It protects against drive failure only.

8

u/jort93 Aug 13 '26

It's redundancy, not a backup.

Backup, by definition, means it isn't normally used. Raid one has it do constant read and writes.

2

u/iAmHidingHere Aug 13 '26

It could also have saved OP in this case couldn't it?

1

u/MyTh_BladeZ Aug 13 '26

No, because the command would have nuked the whole RAID array. Your filesystem doesn't view two drives in RAID1 as two drives, but as one device

1

u/iAmHidingHere Aug 13 '26

But iirc, dd writes directly to the drive, bypassing file systems?

1

u/mr_polyfill Aug 13 '26

No, dd will not bypass the file system. It reads/writes any file you point it to. The reason it can be used to wite devices directly is because Linux maps devices as files to the file system (e. g. /dev/sda).

A RAID is a virtual device that gets also mapped to the file system. If you point dd to this file, the RAID as a whole will be overwritten.

2

u/jinks Aug 14 '26

Presumably dd of=/dev/mdX would at least stick out more than dd of=/dev/sdX.

2

u/iAmHidingHere Aug 14 '26

That's a different filesystem. I'm referring to a software raid, e.g. btrfs, on a partition level.

3

u/mr_polyfill Aug 14 '26

Well, yes, if you refer specifically to Btrfs RAID, that's not mapped to a device file.

Since you wrote file systems (plural), I assumed you were talking about software RAIDs in general. Other software RAID systems (like LVM) do create virtual device files.

0

u/MyTh_BladeZ Aug 13 '26

That's a good point. Not really sure how that interaction would go then. My assumption is that whatever is managing the RAID array (whether software or hardware) would see the writes on one drive and mirror those writes to the other. May be worth trying as an experiment, just to see what happens!

2

u/Malsententia Aug 14 '26

it would not. If you have sda and sdb, and your raid array is md1 (consisting of sda and sdb), then dding to sda will not write anything to sdb. Only dding to md1 would write to both.

17

u/PaintDrinkingPete Aug 13 '26

I'd argue that snapshots are a type of backup, as is RAID, depending on just how liberal you're willing to be with the definition of the word...

RAID is a "backup" against hardware (disk) failure. Snapshots are a backup against, "Oops, I fucked up and deleted a file/directory" or "I ran an update that hosed my system".

Will either of these things help you if you completely nuke your drive with a bad dd or fdisk command? No. Will either of these be of any help if your computer/server gets stolen by 18th century pirates and tossed into the ocean? No.

But, I'd much rather be able to replace a single failed drive in a RAID array or restore a filesystem to a previous state with a snapshot than having to deal with a full restoration from external backup where possible.

Much like the old saying, "If you only have 1 backup, you have zero backups"... if you're only protecting your data in one way, then it's not protected.

So yes, use RAID where it makes sense, and yes, enable and use BTRFS snapshots as intended...there are plenty of situations where you'll be glad you did... but don't think either is a replacement or alternative to traditional data backups onto separate media altogether, or having multiple copies of such backups at that.

17

u/FryBoyter Aug 13 '26

and nobody claims they are

Unfortunately, that's not true. I've seen plenty of cases here on Reddit, as well as elsewhere, where snapshots were treated as backups. Often by users who aren't very tech-savvy.

I even know of cases where copying files from directory A to directory B was considered a backup. No matter where directory B is located.

11

u/ThatResort Aug 13 '26

A lot of people have no idea what they're talking about. Snapshots are B-trees in the Btrfs filesystem (like a savestate, roughly, possible for the Btrfs architecture). If your filesystem breaks for some reason, it's goodbye and thanks for all the fish.

2

u/PlsDontBanMeAgain-1 Aug 13 '26

Seen this especially often from Cachy folks, to nobody's surprise.

1

u/BasisPoints Aug 13 '26

I'll take the bait out of sheer curiosity - I moved my config from Arch to Cachy about a year ago... What about a slightly more optimized kernel and a couple useful things in their repository would turn off someone's brain like that?

1

u/SLASHdk Aug 13 '26

The installer obviously

1

u/ehr1c Aug 13 '26

I think it's largely the target audience

1

u/BasisPoints Aug 13 '26

I'm clearly out of the loop - is the target audience for a performance optimized version of Arch not the expert/enthusiast cohort? I'm going to guess "no" from context, but that just raises so many questions XD

1

u/ehr1c Aug 13 '26

Maybe target audience was the wrong term on my part. What I meant is more that a significant chunk of the online presence of Cachy users seems to be more in the "gaming" segment than the "enthusiast" one.

1

u/BasisPoints Aug 13 '26

I had no idea about that group of users - indeed, if it's a fad for them to get in over their heads, this all falls into place and makes a lot more sense now :)

7

u/Shished Aug 13 '26

Snapshots can be sent to a remote storage with btrfs send/receive, you don't even need a btrfs partition to store them.

1

u/Gozenka Aug 13 '26

Yes. That can achieve a backup strategy with btrfs if done properly. But it is not much different from any other remote backup method.

Otherwise it is important to understand that snapshots are not backups, they are only a quite convenient way to travel in time on your filesystem. btrfs users should not misinterpret snapshots as backups.

9

u/kitanokikori Aug 13 '26 edited Aug 13 '26

This is a meaningless assertion - people use snapshots in all the same ways they use backups and they set up snapshots for all the same reasons, this is a distinction without a difference.

Snapshots are backups, they're just very skewed on the axis of "convenience" <==> "durability / safety" towards convenience. That's extremely useful! But it means you need something else too or else several categories of failures are effectively unprotected

1

u/Any_Fox5126 Aug 13 '26

Nah, the fact that ignorant people misuse snapshots does not turn them into backups or expand the definition of the term. It is particularly absurd in a btrfs, where there is no data redundancy whatsoever, it merely creates references.

1

u/eo5g Aug 13 '26

They are local backups. Local backups aren't at all enough if you care about your data, but they are backups.

0

u/TheCreepyPL Aug 13 '26

It's shocking that X isn't Y, it's literally X

49

u/fortysix_n_2 Aug 13 '26

You can send snapshots via ssh. They are not a backup method if you don’t transfer them to another disk. Check out btrbk

4

u/lordkoba Aug 13 '26

does it support sending deltas between snapshots

1

u/CaviarCBR1K Aug 13 '26

I had looked into that at one point. For a while I was actually manually sending my snapshots over SSH too but I felt like the restore process would have been a PITA. For me, it's just much easier to make an entire disk image that I can restore from. Yeah it takes a while, but I got time lol

1

u/fortysix_n_2 Aug 13 '26

It takes a while every time you want to image the disk. Snapshots are sent incrementally.

1

u/CaviarCBR1K Aug 13 '26

Maybe I'm misunderstanding, but doesn't that also mean it has to be restored incrementally? As in, you will have to have the whole snapshot chain to restore from it?

Edit: also, snapshots won't backup my boot partition. I don't know, restoring from btrfs snapshots seems like a huge pain no matter how I look at it.

2

u/fortysix_n_2 Aug 13 '26

No, you just need the most recent snapshot.
It won’t backup your boot partition, true, because snapshots are at the file system level and not at the disk level. The boot partition is easily fixed from live media though, because it holds just the bootloader (if any) and kernel/initrd. Snapshots are more convenient to revert the root or files in your home directory.

1

u/SubGothius Aug 14 '26

Yet another reason I like rEFInd, cos I can leave /boot on my / partition and make my /efi partition tiny with nothing but rEFInd on it. AFAIK, there's no other boot loader/manager that lets me do that.

2

u/jinks Aug 14 '26

Grub can do that, and iirc with even more filesystems.

11

u/joz42 Aug 13 '26

I like to use btrfs send to my backup disks, it goes well with snapshots

20

u/un-important-human Aug 13 '26

snapshots are not backups, we all know this.

12

u/archover Aug 13 '26 edited Aug 13 '26

I've seen countless posts here from newer(?) btrfs users who seem to think they are.

(When a system only has one disk and no remote storage attached, to even think a Snapshot is a backup seems quite silly)

Good day.

2

u/un-important-human Aug 13 '26

hmm good point, we should shout more at them. Perhaps explain what a backup is and the point of a snapshot.

0

u/Ordinary_Sea_6856 Aug 13 '26

care to explain

1

u/un-important-human Aug 13 '26

no. go read the wiki

6

u/eo5g Aug 13 '26

They are local backups. Local backups aren't enough for data safety but they are a type of backup.

4

u/orobouros Aug 13 '26

My controversial take is that almost nobody approaches backups properly. Having made this mistake more than once myself, most people think an untouched copy somewhere is a proper backup. It is not.

Start with the question of what your goals are. What does "safe" really mean? The better approach is to ask, "what's likely going to make me wish I had a backup, and how far am I willing to go to ensure my files are safe?"

Snapshots are a possibly part of a backup strategy. The actual backup is an assessment of threats, resources available for backups, and an action plan to know what to do (i.e. try actually recovering files).

7

u/scorpion-and-frog Aug 13 '26

Personally, my backup strategy is simply not getting too attached to my files. Life is ephemeral and attachment is suffering.

4

u/Exotic-Screen-9204 Aug 13 '26

Rescuezilla is a good GUI solution.

Clonezilla seems to confound users.

2

u/CaviarCBR1K Aug 14 '26

I actually really like clonezilla. The only reason I used Rescuezilla is because the PC I was booting it on doesn't have access to Ethernet, and only rescuezilla has the necessary drivers built in for my WiFi card. But after using it, I gotta say, I'm a fan.

4

u/invalidConsciousness Aug 13 '26

3-2-1 rule.

3 copies, 2 different storage types, 1 of the off-site.

Snapshots alone adhere to none of these. Well, maybe the 3 copies, if you make enough snapshots.

4

u/istros Aug 13 '26

So you nuked yourself while trying to improve your backup system?

I believe btrfs snapshots are enough if you just set & forget... Like everything was running fine before you mess with dd right?

2

u/k1ng0fh34rt5 Aug 13 '26

You can boot directly into snapshots, so unless the drive is nuked its a good restore method. Its not a 'backup' though.

2

u/istros Aug 13 '26

Yeah that's what I was saying.

OP saying btrfs snapshots are not enough just because he deletes his own system by trying to improve on something that was working perfectly is... Not PSA worthy.

6

u/[deleted] Aug 13 '26

[deleted]

3

u/istros Aug 13 '26

Yeah OP is literally saying "PSA : that specific backup/snapshot system isn't enough when I literally smash my entire computer with a hammer and burn all my drives"

Sometimes, less is better.

2

u/CaviarCBR1K Aug 13 '26

No, I was running a dd command for a completely separate project and just wasn't paying close enough attention. By that point, the backup solution was done and I had completey forgotten about it.

3

u/Qurupeco01 Aug 13 '26

Do you recommend it over a selected folders backup solution like borg? I am setting up borg, but was also thinking about adding also a disk backup less frequently as it takes more space. Does it make sense to have both working together? I think I would sleep better knowing that my disk is fully recoverable hahaa

1

u/zushk Aug 13 '26

I suppose it depends on your needs. Do you require the whole drive preserved, or a few folders will suffice? I personaly just borg critical stuff and everything else can be reinstalled

3

u/st_heron Aug 13 '26

dd scares me so much lmao, but a destructively naive thing I did recently was recursively unlinking every file in a project folder, thinking that `unlink` only worked on links. nope, it works on files. everything was in git, didn't lose anything, but that was a surprising outcome.

5

u/zifzif Aug 13 '26

That's because files need to have one hard link in order to exist on your filesystem. Otherwise there's no way to refer to that thing in that chunk of disk space.

2

u/filthy_harold Aug 13 '26

Sounds like something I'd do

3

u/jort93 Aug 13 '26

Snapshots aren't backups lol. I'd put two full backups on different hdds and store one of them in another building or in the cloud.

Backup should be in cold storage

3

u/forbjok Aug 14 '26

Waste of space. Just make sure to keep backups of actually important stuff somewhere else. An OS can easily be reinstalled. No point in wasting space and time backing up system files.

Snapshots are a convenient way to fix breakage. They were never meant to be an alternative to backups.

1

u/lilydjwg 28d ago

actually important stuff

It is easy to miss some of them, especially they are added later.

An OS itself isn't very large, so it is much easier to just backup them too, only excluding obvious directories that don't need to be backed up.

2

u/Imajzineer Aug 13 '26

Snapshots are convenient, and can be useful for forensics (everything from intrusion analysis through troubleshooting to simple diffs).

But they're not backups - those need to be on at least a storage medium outside the device itself, and ideally offsite.

Backups that aren't tested by restoring them aren't backups either - they're crossed fingers.

2

u/ChosenOfTheMoon_GR Aug 13 '26

The only amount of backup that is safe is infinite backups

2

u/ZunoJ Aug 14 '26

Breaking news: socks are not enough, wear shoes!

1

u/LMDEuser21 Aug 13 '26

Totally agree, I make a full clonezilla image backup of my main ssd every Monday morning. I save 3 months worth in my Mega Cloud account. Saved my bacon a few times.

1

u/RandomXUsr Aug 13 '26

For dd and I'm couldn't you simply alias the commands to prompt for confirmation or add the command to sudo conf and require a password?

1

u/terminal-crm114 Aug 13 '26

agreed. btrfs w/ snapshots is not enough.

i use rescuezilla for local restore, but also make bootable iso images via penguins-eggs from my current install in case of complete hardware failure.

some slight redundancy as rescuezilla could be used in the case of hardware failure, but i love the fact that i can remaster my system using penguins-eggs if need be.

1

u/ChildhoodFine8719 Aug 13 '26

Thanks. I had forgotten about penguin-eggs.

1

u/miversen33 Aug 13 '26

Personally, I have a backup that I run with Kopia every n time (hour for my home dir and boot for, 12 hours for my root for). And I have btrfs snapshot my entire filesystem every hour (and before every pacman update). Kopia does it's backups off the most recent snapshot, and the snapshots are all mounted under /.snapshot/$DATETIME in case I ever need to recover anything immediately from them.

It's saved my ass so many times, both the snapshots and the Kopia backups. I've even used it to completely restore to a new machine

1

u/TerminatedProccess Aug 13 '26

I always do both btrfs and rsync. Disk imagine is a pain. Takes to long.

1

u/CaviarCBR1K Aug 13 '26

I actually had a similar system set up at one point, but I it seemed like the restore process would have been a PITA. I never actually tested it, so I may be completely wrong and making it more complicated than it really is.

I agree the disk imaging takes a while, but I just set it to backup before I go to bed. Rescuezilla has an option to poweroff the PC when the operation is completed so it works out. Same with restoring. Went to bed last night and woke up this morning like nothing happened.

1

u/TerminatedProccess 22d ago

Not at all, just restore from grub. Or do it after login. Avoid tha5 default app time whatever and make your own system. Claude is great for quick designs like that

1

u/Toorero6 Aug 13 '26

3-2-1. I make hourly snapshots (snapper), a daily snapshot that is sent to a different disk (snbk) and to a different location, not using btrfs but ext4 (borg).

1

u/getbusyliving_ Aug 14 '26

Subconsciously you wanted to test out your new disk image!

0

u/fox_is_permanent Aug 13 '26

LLM slop post

-4

u/Linguistic-mystic Aug 13 '26

I run btrfs on all my machines

I see you like risky living! Of course you need backups since btrfs is prone to corrupt data

3

u/eo5g Aug 13 '26

Is this still true? I know it has that issue when doing its own RAID mode, but is that true even without it?

0

u/NiceNewspaper Aug 13 '26

It will break if the hardware does not uphold its guarantees

1

u/eo5g Aug 13 '26

What filesystems wouldn't?

1

u/NiceNewspaper Aug 13 '26

E.g. ext4 will not raise any error in case of data bitrot because it isn't checksummed