CrackOps
Interview PrepTracksLinuxAWS LabSoonInterview RoomSoon
Sign inStart free
CrackOps

Interview prep for the people who keep production up.

[email protected]
ProductInterview PrepTracksDashboardInterview Room
RolesDevOpsSREPlatformCloud
CompanyAboutContactPrivacyTerms
© CrackOps
Linux / Archiving & Compression / tar

tar

Bundle files into an archive and extract them

Beginneressentialarchivebackup

tar packs a whole directory tree, with permissions, owners and timestamps, into one archive file and unpacks it again. Combined with gzip, bzip2, xz or zstd it is the standard way to ship releases, move data between servers and take file-level backups on Linux.

Syntaxtar -c|-x|-t [-z|-j|-J|--zstd] [-v] -f ARCHIVE [-C DIR] [FILE...]

Watch it run

You want to hand over the whole app directory as one file and check what went into it.

devops@devops-lab: ~ — zsh — 96×28
➜ ~
Step 1 of 3
tar -czf shop-api.tar.gz app && ls -lh shop-api.tar.gz

c creates, z gzips, f names the file. tar is silent on success. 312M of files became a 61M archive.

Anatomy of a command

$
commandtar

Tape archiver: turns a tree of files into one stream and back.

How it works

A tar archive is a simple sequence: for each file a 512-byte header (name, mode, uid/gid and user/group names, size, mtime, type, link target, checksum), then the file's contents padded to a multiple of 512 bytes, and two zero blocks at the end. Long names and big files use extra pax or GNU headers. tar walks the tree with lstat, opens and reads each regular file, and writes headers and data in 10 KiB records. Compression is not part of tar: with -z, tar starts gzip as a child process and pipes the stream through it (which is why errors mention 'tar (child)' and 'Child returned status'). A .tar.gz is therefore one compressed stream with no index: listing it or extracting one file means decompressing from the start. On extraction tar recreates each entry, restores modes and mtimes, and restores ownership only when run as root; it strips a leading / from names so an archive can't overwrite system files by absolute path.

tar turns a directory tree into one stream of headers and data; gzip, running as a child process, compresses that stream.

lstat + readper filepipewriteapp/312M, 4,102 files4,102 entriestar-c: build stream512-byte headername, mode, sizegzipchild processshop-api.tar.gzon diskweb-02tar -x from stdin
1/7
Walk the tree

tar visits every entry under app/ with lstat to learn its type, mode, owner, size and mtime, and opens regular files to read their contents.

← → to step

Options you'll actually use

-c / -x / -tCreate / extract / list (table of contents)
-f FILEArchive file; - means stdout (create) or stdin (extract)
-z / -j / -J / --zstdgzip / bzip2 / xz / zstd compression
-aPick the compressor from the archive name suffix when creating
-vVerbose; with -t, -v shows permissions, owner, size and date
-C DIRChange to DIR first: extract into DIR, or archive relative to DIR
--exclude=PATTERNSkip matching files or directories
--strip-components=NRemove N leading path parts when extracting
-pPreserve permissions exactly (default for root)
--numeric-ownerStore and restore uid/gid numbers, not names
-PKeep absolute paths (leading /); rarely what you want
-r / -uAppend / update files in an uncompressed archive

Common mistakes

tar -czfv backup.tar.gz app

f takes the next argument as the archive name, so tar tries to create a file called v and then fails.

tar -czvf backup.tar.gz app (f last in the bundle)
tar -czf backup.tar.gz /var/www and extracting it with -C / without checking

Extracting over a live tree overwrites newer files with old ones and leaves files that weren't in the archive.

tar -xzf backup.tar.gz -C /tmp/restore, compare, then copy what you need
Creating the archive inside the directory you're archiving

tar archives the growing archive itself ('file changed as we read it', and it can loop until the disk fills).

tar -czf /tmp/app.tar.gz -C ~ app
Extracting an untrusted archive as root

Archives can contain ../ paths, symlinks pointing outside, or setuid files with root ownership.

tar -tvf it first and extract as a normal user into an empty directory

Interview questions

Practice

Try these on a Linux machine of your own. Each task has a hint and a solution.

  1. 1

    Create a gzip-compressed archive of ~/app called app.tar.gz in your home directory.

  2. 2

    List the contents of app.tar.gz with permissions and sizes, without extracting.

  3. 3

    Extract app.tar.gz into /tmp/restore.

  4. 4

    Archive ~/logs as an xz-compressed tarball, leaving out files ending in .gz.

Related commands

gzipCompress and decompress single files with gzipxzCompress files to the smallest size with xzzipCreate ZIP archives that open everywheretar --listed-incrementalFull and incremental backups with GNU tarrsyncSync files and directories efficiently
PreviousiostatNextgzip
Linux / Archiving & Compression / tar

tar

Bundle files into an archive and extract them

Beginneressentialarchivebackup

tar packs a whole directory tree, with permissions, owners and timestamps, into one archive file and unpacks it again. Combined with gzip, bzip2, xz or zstd it is the standard way to ship releases, move data between servers and take file-level backups on Linux.

Syntaxtar -c|-x|-t [-z|-j|-J|--zstd] [-v] -f ARCHIVE [-C DIR] [FILE...]

Watch it run

You want to hand over the whole app directory as one file and check what went into it.

devops@devops-lab: ~ — zsh — 96×28
➜ ~
Step 1 of 3
tar -czf shop-api.tar.gz app && ls -lh shop-api.tar.gz

c creates, z gzips, f names the file. tar is silent on success. 312M of files became a 61M archive.

Anatomy of a command

$
commandtar

Tape archiver: turns a tree of files into one stream and back.

How it works

A tar archive is a simple sequence: for each file a 512-byte header (name, mode, uid/gid and user/group names, size, mtime, type, link target, checksum), then the file's contents padded to a multiple of 512 bytes, and two zero blocks at the end. Long names and big files use extra pax or GNU headers. tar walks the tree with lstat, opens and reads each regular file, and writes headers and data in 10 KiB records. Compression is not part of tar: with -z, tar starts gzip as a child process and pipes the stream through it (which is why errors mention 'tar (child)' and 'Child returned status'). A .tar.gz is therefore one compressed stream with no index: listing it or extracting one file means decompressing from the start. On extraction tar recreates each entry, restores modes and mtimes, and restores ownership only when run as root; it strips a leading / from names so an archive can't overwrite system files by absolute path.

tar turns a directory tree into one stream of headers and data; gzip, running as a child process, compresses that stream.

lstat + readper filepipewriteapp/312M, 4,102 files4,102 entriestar-c: build stream512-byte headername, mode, sizegzipchild processshop-api.tar.gzon diskweb-02tar -x from stdin
1/7
Walk the tree

tar visits every entry under app/ with lstat to learn its type, mode, owner, size and mtime, and opens regular files to read their contents.

← → to step

Options you'll actually use

-c / -x / -tCreate / extract / list (table of contents)
-f FILEArchive file; - means stdout (create) or stdin (extract)
-z / -j / -J / --zstdgzip / bzip2 / xz / zstd compression
-aPick the compressor from the archive name suffix when creating
-vVerbose; with -t, -v shows permissions, owner, size and date
-C DIRChange to DIR first: extract into DIR, or archive relative to DIR
--exclude=PATTERNSkip matching files or directories
--strip-components=NRemove N leading path parts when extracting
-pPreserve permissions exactly (default for root)
--numeric-ownerStore and restore uid/gid numbers, not names
-PKeep absolute paths (leading /); rarely what you want
-r / -uAppend / update files in an uncompressed archive

Common mistakes

tar -czfv backup.tar.gz app

f takes the next argument as the archive name, so tar tries to create a file called v and then fails.

tar -czvf backup.tar.gz app (f last in the bundle)
tar -czf backup.tar.gz /var/www and extracting it with -C / without checking

Extracting over a live tree overwrites newer files with old ones and leaves files that weren't in the archive.

tar -xzf backup.tar.gz -C /tmp/restore, compare, then copy what you need
Creating the archive inside the directory you're archiving

tar archives the growing archive itself ('file changed as we read it', and it can loop until the disk fills).

tar -czf /tmp/app.tar.gz -C ~ app
Extracting an untrusted archive as root

Archives can contain ../ paths, symlinks pointing outside, or setuid files with root ownership.

tar -tvf it first and extract as a normal user into an empty directory

Interview questions

Practice

Try these on a Linux machine of your own. Each task has a hint and a solution.

  1. 1

    Create a gzip-compressed archive of ~/app called app.tar.gz in your home directory.

  2. 2

    List the contents of app.tar.gz with permissions and sizes, without extracting.

  3. 3

    Extract app.tar.gz into /tmp/restore.

  4. 4

    Archive ~/logs as an xz-compressed tarball, leaving out files ending in .gz.

Related commands

gzipCompress and decompress single files with gzipxzCompress files to the smallest size with xzzipCreate ZIP archives that open everywheretar --listed-incrementalFull and incremental backups with GNU tarrsyncSync files and directories efficiently
PreviousiostatNextgzip