Proxmox Backup Server: VM and Container Backup Strategy on Linux

Proxmox Backup Server (PBS) is a dedicated backup solution for Proxmox VE environments. It stores incremental, deduplicated backups of virtual machines and LXC containers with strong encryption options and fast restore capabilities. Unlike generic file-level backups, PBS understands QEMU and LXC disk formats — which means smaller backup windows, efficient storage use, and granular restore options including single-file extraction from VM disks.

This guide covers a standalone PBS installation on a dedicated Linux host, connecting one or more Proxmox VE nodes, scheduling backup jobs with retention policies, and running restore drills. Whether you run a homelab or a small production cluster, PBS should be on separate hardware from your hypervisors — backups on the same disk as your VMs do not survive disk or host failure.

Architecture Overview

• Proxmox VE nodes — hypervisors running VMs and LXC containers.
• PBS host — dedicated server with fast storage for backup datastores.
• Backup jobs — scheduled from PVE datacenter view, executed against PBS datastore.
• Incremental chain — first backup is full, subsequent runs store only changed blocks.
• Garbage collection — PBS reclaims space after retention prunes old backup snapshots.

Prerequisites

• Dedicated server or VM for PBS (avoid running PBS on the same host you back up)
• Fast storage: SSD or NVMe recommended, sized at 2–3× total VM disk usage
• One or more Proxmox VE 7.x or 8.x nodes on the same network
• Static IP and hostname for the PBS server (e.g. pbs.example.com)

Step 1: Install Proxmox Backup Server

Download the official ISO from proxmox.com and install on bare metal, or add the PBS apt repository to an existing Debian 12 system. ISO install is recommended for dedicated backup appliances.

# On Debian 12 (alternative to ISO install):
echo "deb http://download.proxmox.com/debian/pbs bookworm pbs-no-subscription" | sudo tee /etc/apt/sources.list.d/pbs.list
wget -qO- https://enterprise.proxmox.com/debian/proxmox-release-bookworm.gpg | sudo tee /etc/apt/trusted.gpg.d/proxmox-release-bookworm.gpg
sudo apt update
sudo apt install -y proxmox-backup

# Access web UI: https://pbs-ip:8007

Step 2: Create a Datastore

# Via CLI on PBS host:
sudo proxmox-backup-manager datastore create backups /mnt/backup-data

# Verify:
sudo proxmox-backup-manager datastore list

# Set GC schedule (web UI: Datastore → backups → Prune & GC → Schedule)

Step 3: Add PBS Storage to Proxmox VE

On each Proxmox VE node, add the PBS server as remote storage. Create an API token on PBS with DatastoreBackup and DatastoreRestore permissions scoped to your datastore.

# On PBS: create token via CLI
sudo proxmox-backup-manager user create pve-backup@pbs
sudo proxmox-backup-manager acl update /datastore/backups DatastoreBackup,DatastoreRestore --auth-id pve-backup@pbs
sudo proxmox-backup-manager user generate-token pve-backup@pbs pve-token
# On Proxmox VE node (Datacenter → Storage → Add → Proxmox Backup Server):
# Server: pbs.example.com
# Username: pve-backup@pbs
# Token: pve-token (paste secret)
[...]

Step 4: Schedule Backup Jobs

Create backup jobs at the datacenter level to cover all VMs, or per-VM for different schedules. Use Snapshot mode for running VMs (requires QEMU guest agent for consistency on Windows).

# Example backup job settings (Datacenter → Backup → Add):
# Storage: pbs-backups (your PBS storage ID)
# Schedule: daily at 02:00
# Selection mode: All
# Mode: Snapshot
# Compression: ZSTD
# Retention:
#   Keep Daily: 7
[...]

Step 5: Verify Backup Completion

# On Proxmox VE:
# Datacenter → Backup → check last run status

# On PBS CLI:
sudo proxmox-backup-manager tasks list --limit 10
sudo proxmox-backup-manager backup list backups

Step 6: Restore Drill — Full VM Restore

Run restore drills monthly. A backup you have never restored is an assumption, not a guarantee.

# In Proxmox VE web UI:
# Select VM → Backup → choose PBS snapshot → Restore
# Target: new VM ID (e.g. 999) on a test node
# Start VM and verify application health

# Or via CLI on PVE:
qmrestore pbs-backups:vm/100/2026-07-02T02:00:00Z 999 --storage local-lvm

Step 7: Single-File Restore from VM Backup

PBS supports file-level restore without booting the entire VM. Useful for recovering a single config file or database dump from a disk image.

# PBS web UI: Content → select backup → File Restore
# Mount the disk image and browse files in browser
# Download the needed file

# CLI:
sudo proxmox-backup-manager backup list backups vm/100

Step 8: Enable Client-Side Encryption (Optional)

Encrypt backups on the Proxmox VE node before transmission. PBS stores encrypted blobs it cannot read without the encryption key — useful when PBS runs on less trusted infrastructure.

# Generate encryption key on PVE node:
openssl rand -base64 32 > /root/pbs-encryption.key
chmod 600 /root/pbs-encryption.key

# Add to backup job: Encryption Key File = /root/pbs-encryption.key
# Store key separately from PBS — losing the key means losing the backup

Troubleshooting

• Backup stuck at 0% — check PBS connectivity, fingerprint mismatch, or token permissions.
• Datastore full — run garbage collection, review retention, expand storage volume.
• Snapshot mode fails — install and enable QEMU guest agent in the VM.
• Slow backups — use ZSTD compression, ensure 10 Gbps network between PVE and PBS.

Production Checklist

• Run PBS on dedicated hardware separate from hypervisors.
• Schedule restore drills monthly and document RTO/RPO results.
• Monitor datastore free space — alert at 80% capacity.
• Store encryption keys off-server in a secrets manager.
• Replicate PBS datastores to a second location for off-site disaster recovery.

"VM backups are only real after a successful restore drill — schedule them before you need them under incident pressure."