Proxmox Backup Server, how it works and how to set up a copy
Opselis
PBS is the copy server for Proxmox VE. A snapshot stays on the same disk. Here: datastore, backup job, prune, verify and restore of a VM or a single file.
Proxmox Backup Server (PBS) is a separate product for copies of machines and containers from Proxmox VE. It stores guest disks as chunks with deduplication. The web panel shows datastores, jobs, retention and transfer. A snapshot in VE lives on the same storage as the VM. PBS sits on another host and another disk, so a production node failure does not delete the copy.
What it is for
You use PBS when you need an RPO in hours and a restore of a whole VM, CT or a single file. Prune keeps e.g. 7 daily, 4 weekly, 3 monthly copies. Verify checks chunks. Leave snapshots for a patch (rollback in minutes on the same volume). PBS does not replace a logical database dump if you want one table without the whole VM. Then you add a dump to the same datastore or a separate mysqldump job.
How it works
On PVE you add storage of type Proxmox Backup Server (user, datastore, TLS fingerprint). A backup job reads the VM disk (usually via the QEMU guest agent, fs-freeze) and sends chunks to PBS. The next copy sends only changed fragments. Prune on the datastore removes old copy snapshots on a schedule. Garbage collection frees space after deleted chunks. Restore: a new VM from the copy, or file restore (a file tree from the guest disk).
How to set it up
Install the PBS ISO on a separate server, not on the production node. In the PBS panel: Datastore, Add, a directory on a disk used only for copies. Create an API user (Datastore.Backup, Datastore.Allocate, Datastore.Audit), not root.
In Proxmox VE: Datacenter, Storage, Add, Proxmox Backup Server. PBS address, datastore, user, fingerprint from the PBS panel. On the VM: Backup, Backup now (test), then a Backup Job: off-peak schedule, snapshot or suspend mode, retention on the job aligned with prune on PBS.
Prune: on the PBS datastore set keep-daily 7, keep-weekly 4, keep-monthly 3. Verify Job: daily on the latest copy. Mail or webhook on failed. Restore test: Restore to another VMID, a test bridge, not the production vmbr. Check boot and the application, delete the test VM.
A second path (separate disk, another site or datastore sync) keeps ransomware on production off the only copy. Copy layer: data security.