Install Proxmox Backup Server in 2026: Incremental VM Backups

Proxmox Backup Server (PBS) is Proxmox’s open source backup solution. It backs up Proxmox VE virtual machines (VMs) and LXC containers, and also Linux hosts through proxmox-backup-client. There is no “incremental” option to turn on. Data is split into chunks and deduplicated in a datastore: only chunks the server doesn’t already have are sent. For VMs, Proxmox VE also tracks changed blocks with a dirty bitmap, which makes later backups even faster.

In this tutorial, we install PBS on a dedicated machine running Debian 13 “Trixie”, the base of the current PBS release (4.x). We then create a datastore and a dedicated account, add the datastore as storage in Proxmox VE, and run and schedule backups.

Prerequisites

• A machine dedicated to PBS, preferably physical. The documentation advises against installing PBS directly on the hypervisor: if the host fails, you lose your backups too. Minimum for evaluation: a 64-bit (x86-64) CPU with 2 cores, 2 GB of RAM, more than 8 GB of disk. For production, the documentation recommends at least 4 cores, 4 GiB of RAM plus about 1 GiB per TiB of storage, and 32 GiB for the OS.
• An empty disk dedicated to backups. The documentation favours fast local storage with good random I/O (SSDs); with hard drives, it advises a metadata cache (for example a mirrored ZFS special device).
• Debian 13 (Trixie), installed and up to date, with root access (console or SSH on the local network). Another option is the official Proxmox Backup Server ISO, which installs everything in one go. In that case, skip to step 4.
• A working Proxmox VE host with at least one VM (ID 100 is used as an example here).
• TCP port 8007 on the PBS reachable from the Proxmox VE host, on the local network only. It is the PBS web UI and API port.

About the hardware mentioned in this article: the Dell PowerEdge T140 is an x86-64 tower server that can serve as a dedicated PBS machine. Check that your configuration (CPU, RAM, disks) meets the recommendations above. Proxmox VE Server Edition is not hardware: it is the hypervisor whose VMs PBS backs up. The software is free, and the subscription only gives access to the enterprise repository and support.

Step-by-step installation

Step 1: Check the Debian version

cat /etc/os-release | grep -E 'VERSION_CODENAME|PRETTY_NAME'
apt update && apt full-upgrade -y

Check: the output must contain VERSION_CODENAME=trixie. On any other release, the repositories below won’t work.

Step 2: Add the Proxmox Backup Server repository

Download the Proxmox archive signing key, then check its checksum:

wget https://enterprise.proxmox.com/debian/proxmox-archive-keyring-trixie.gpg \
  -O /usr/share/keyrings/proxmox-archive-keyring.gpg
sha256sum /usr/share/keyrings/proxmox-archive-keyring.gpg

Check: the checksum must be 136673be77aba35dcce385b28737689ad64fd785a797e57897589aed08db6e45, the value published in the documentation at the time of writing. If it differs, stop and check the official documentation.

Then create the no-subscription repository in deb822 format:

cat > /etc/apt/sources.list.d/proxmox.sources << 'EOF'
Types: deb
URIs: http://download.proxmox.com/debian/pbs
Suites: trixie
Components: pbs-no-subscription
Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg
EOF
apt update

Check: apt update must list download.proxmox.com/debian/pbs trixie with no signature error. If you have no subscription and a file /etc/apt/sources.list.d/pbs-enterprise.sources exists, add the line Enabled: false to it; otherwise apt update will return a 401 error.

Step 3: Install the proxmox-backup-server package

apt install -y proxmox-backup-server

This package keeps the Debian kernel. The proxmox-backup meta-package instead installs the ISO equivalent: the Proxmox kernel with ZFS support, plus common tools.

Check:

systemctl is-active proxmox-backup proxmox-backup-proxy
ss -tlnp | grep 8007

Both services must report active, and a process must be listening on port 8007. Open https://PBS-IP:8007 from a machine on the local network. The certificate starts out self-signed: accept the warning, then log in as root with the “Linux PAM” realm.

Step 4: Create the datastore on a dedicated disk

⚠️ Warning: the next command formats the selected disk and destroys all its data. First identify the right disk by its size, model and serial number:

lsblk -o NAME,SIZE,MODEL,SERIAL,MOUNTPOINTS
proxmox-backup-manager disk list

Make sure the target disk (here sdb, replace it with yours) is neither the system disk nor a mounted disk. Then create the filesystem and the store1 datastore with a single command:

proxmox-backup-manager disk fs create store1 --disk sdb --filesystem ext4 --add-datastore true

The datastore is mounted under /mnt/datastore/store1. In the web UI, the equivalent path is Administration → Storage / Disks → Directory → Create: Directory, with “Add as Datastore” ticked. If you already have a mounted volume, use proxmox-backup-manager datastore create store1 /path/to/store1 instead.

Check:

proxmox-backup-manager datastore list
cat /etc/proxmox-backup/datastore.cfg
df -h /mnt/datastore/store1

store1 must appear with its path, and df must show the capacity of the new disk (not the system disk).

Step 5: Create a dedicated account and its API token

Don’t use root@pam in Proxmox VE. Create a user in the pbs realm and an API token, then give them the DatastoreBackup role on the datastore. This role lets them create and restore their own backups. A token’s effective permissions never go beyond its user’s, so grant the role to both.

proxmox-backup-manager user create backup@pbs
proxmox-backup-manager user generate-token backup@pbs pve
proxmox-backup-manager acl update /datastore/store1 DatastoreBackup --auth-id backup@pbs
proxmox-backup-manager acl update /datastore/store1 DatastoreBackup --auth-id 'backup@pbs!pve'

Copy the secret (value) printed by generate-token right away: it will never be shown again. If you want Proxmox VE to apply retention itself (removing old backups), grant the DatastorePowerUser role instead, which also allows pruning.

Next, note the PBS certificate fingerprint:

proxmox-backup-manager cert info | grep -i fingerprint

Check: proxmox-backup-manager acl list must show both entries on /datastore/store1.

Step 6: Add PBS as storage in Proxmox VE

On the Proxmox VE host, replace the IP address and fingerprint with yours. The --password option without a value prompts for the secret interactively: paste the token secret.

pvesm add pbs pbs-store1 \
  --server 192.168.1.50 \
  --datastore store1 \
  --username 'backup@pbs!pve' \
  --fingerprint 'AA:BB:...:FF' \
  --password

In the web UI, the equivalent path is Datacenter → Storage → Add → Proxmox Backup Server. Optionally, --encryption-key autogen turns on client-side encryption. The key is then stored in /etc/pve/priv/storage/pbs-store1.enc. Back it up somewhere else: without it, your encrypted backups cannot be restored.

Check:

pvesm status | grep pbs-store1

The storage must show as active. If it doesn’t, see the Troubleshooting section.

Step 7: Run a first backup and see the incremental behaviour

vzdump 100 --storage pbs-store1 --mode snapshot

snapshot mode backs up the VM without stopping it. stop mode gives the best consistency, at the cost of a short interruption.

Check:

pvesm list pbs-store1

The vm/100/... backup must appear. On the PBS side, it shows up under Datastore → store1 → Content. Run the same vzdump command again: this time the log reports the dirty bitmap status, and much less data is sent, as long as the VM wasn’t stopped in between. That is PBS’s incremental behaviour.

Step 8: Schedule the backup job

In Proxmox VE: Datacenter → Backup → Add. Choose the pbs-store1 storage, a schedule (for example 21:00), Snapshot mode, and the VMs and containers to include. Jobs are saved in /etc/pve/jobs.cfg and run by the pvescheduler service.

Check:

cat /etc/pve/jobs.cfg
systemctl is-active pvescheduler

The job must appear with storage pbs-store1. The Run now button in the job list lets you test it straight away.

Step 9: Retention, cleanup and verification on PBS

Deleted backups only free up space after garbage collection (GC). Schedule it:

proxmox-backup-manager datastore update store1 --gc-schedule 'daily'
proxmox-backup-manager datastore show store1

In the PBS web UI, then set retention in Datastore → store1 → Prune & GC with a prune job (for example 7 daily, 4 weekly, 6 monthly). Add regular integrity checks in the Verify Jobs tab. To measure CPU performance (hashing, compression, encryption), use:

proxmox-backup-client benchmark

Check: datastore show store1 must show gc-schedule. The benchmark prints a table of throughput figures: these measurements are specific to your machine.

Verification checks

systemctl status proxmox-backup proxmox-backup-proxy
proxmox-backup-manager task list
journalctl -u proxmox-backup-proxy -n 50

Both services must be active (running). task list shows recent tasks (backups, GC, verifications) and their status. The same history is visible in the web UI, in the Tasks panel at the bottom of the screen.

Security and best practices

• Never expose port 8007 (or SSH) to the Internet. For remote access, go through a VPN (WireGuard, for example) or an isolated management network.
• Replace the self-signed certificate if needed (Configuration → Certificates). After any certificate change, update the fingerprint in Proxmox VE.
• Turn on two-factor authentication for root@pam in the access management section of the web UI (check the exact menu name in your version).
• Use API tokens with minimal permissions (DatastoreBackup) instead of the root account.
• Turn on client-side encryption and keep the key outside both the PBS and the Proxmox VE host.
• Follow the 3-2-1 rule: a single PBS is not enough. Add an off-site copy with a Sync Job to a second PBS, or to tape or a removable disk.
• Regularly test a full restore (PVE host → pbs-store1 storage → Backups → Restore). A backup you have never restored is not a verified backup.
• Keep the system updated with apt update && apt full-upgrade.

Troubleshooting common errors

Error: “fingerprint mismatch” or certificate error

Symptom: pvesm status shows the storage as inactive, with a certificate error. Cause: the fingerprint you entered is wrong, or the PBS certificate has changed. Fix: run proxmox-backup-manager cert info again on the PBS, then pvesm set pbs-store1 --fingerprint 'NEW:FINGERPRINT' on Proxmox VE.

Error: “permission check failed”

Symptom: the backup fails at startup, or retention fails. Cause: missing ACL for the user or the token, or the DatastoreBackup role while Proxmox VE is trying to delete old backups. Fix: check with proxmox-backup-manager acl list. Grant the role to the user and the token. Handle retention on the PBS side, or switch to the DatastorePowerUser role.

Error: insufficient disk space

Symptom: the backup fails because the storage is out of space. Cause: no retention policy, or GC has never run. Fix: set up a prune job, then click Start Garbage Collection in Prune & GC. As a safety measure, GC only removes chunks that have been unused for a while (about one day; see the documentation for your version), so space is not freed immediately.

Error: web UI unreachable

Symptom: the browser gets no response at https://IP:8007. Cause: stopped service, an http:// URL, or a firewall. Fix: run systemctl restart proxmox-backup-proxy, then journalctl -u proxmox-backup-proxy -n 50. Check ss -tlnp | grep 8007 and make sure you are using https://.

FAQ

Does backup only work for Proxmox VMs?

PBS natively backs up Proxmox VE VMs and containers, plus files or Linux hosts with proxmox-backup-client (for example proxmox-backup-client backup root.pxar:/ --repository backup@pbs@PBS-IP:store1). It does not natively back up VMs from other hypervisors.

How do I enable incremental backups?

There is nothing to enable. With PBS-type storage, every backup is deduplicated: only new chunks are sent. For running VMs, the dirty bitmap also avoids re-reading unchanged blocks. It is lost when the VM process stops: the next backup then reads the whole disk again, but still only sends chunks the server doesn’t already have.

Is Proxmox Backup Server free?

Yes. It is open source software (AGPLv3 licence), free to use with the pbs-no-subscription repository. An optional subscription gives access to the enterprise repository and support.

Can I install PBS on the same host as Proxmox VE?

It is technically possible: add the same repository, then run apt install proxmox-backup-server. The documentation advises against it, though, because a host failure would take the backups down with it.

Do I need technical knowledge to set up Proxmox Backup Server?

You need to be comfortable with the Linux command line, disks and networking. Once it is set up, almost all day-to-day administration happens in the web UI.

Read also

• Tutoriel frigate google coral home assistant
• Tutoriel home assistant docker
• Tutoriel caddy reverse proxy https

Host this yourself

No hardware to manage? This kind of service runs on a managed VPS, ready in minutes. See PlanetHoster plans