Back to Articles
TrueNAS10 min read
ZFS Snapshots Explained for Beginners (with Real Examples)
Learn what ZFS snapshots are, how they work, and how to create, browse, roll back, and clone snapshots with real command examples for your homelab.
Learn what ZFS snapshots are, how they work, and how to create, browse, roll back, and clone snapshots with real command examples for your homelab.
If you run a homelab, a TrueNAS server, or any Linux system with ZFS, you have one of the most powerful filesystem features ever created at your fingertips: ZFS snapshots. Snapshots let you capture the exact state of your data at a moment in time — instantly, with almost no disk space penalty — and browse, restore, or even clone that data later.
This guide explains what ZFS snapshots are, how they work under the hood, and walks through practical examples you can run right now on your own system.
A ZFS snapshot is a read-only, point-in-time copy of a ZFS filesystem or volume. According to the official OpenZFS documentation and the Ubuntu ZFS snapshot tutorial, a snapshot records the state of a filesystem at a specific moment. Snapshots are not full copies of your data. Instead, ZFS uses a copy-on-write (COW) mechanism: when data changes after a snapshot is taken, ZFS writes the new data to a new block while retaining the old blocks referenced by the snapshot.
This means:
Before following along, you need:
To check your existing ZFS datasets, run:
sudo zfs listIf you do not have a dataset yet, create one for testing:
sudo zfs create rpool/exampleCreating a snapshot uses the zfs snapshot command (or zfs snap for short). The syntax is:
sudo zfs snapshot <dataset>@<snapshotname>Let's create a simple document and take a snapshot:
echo "version 1" > /rpool/example/document.txt
sudo zfs snapshot rpool/example@ep3_v1Now modify the file and take another snapshot:
echo "version 2" > /rpool/example/document.txt
sudo zfs snapshot rpool/example@ep3_v2You have just captured two point-in-time versions of your dataset. To list all snapshots:
sudo zfs list -t snapshotOutput example:
NAME USED AVAIL REFER MOUNTPOINT
rpool/example@ep3_v1 9.88M - 170G -
rpool/example@ep3_v2 0B - 171G -Note: TheUSEDcolumn shows space consumed by blocks that have changed since the snapshot was taken. TheREFERcolumn shows the total referenced space of the dataset at snapshot time.
If your dataset has child datasets, you can snapshot them all at once with the -r (recursive) flag:
sudo zfs snapshot -r rpool/example@daily_backupThis creates snapshots of rpool/example and all of its descendent filesystems.
One of the coolest features of ZFS is the hidden .zfs/snapshot directory. Every dataset with snapshots has this directory at its root. You can browse it directly:
ls /rpool/example/.zfs/snapshot/You will see directories named after your snapshots:
ep3_v1 ep3_v2You can read files directly from a snapshot as if it were a live directory:
cat /rpool/example/.zfs/snapshot/ep3_v1/document.txtThis outputs version 1 — the original content. No restore command needed. The .zfs directory is mounted on demand and requires no manual configuration.
If something goes wrong — a bad config change, accidental deletion, or corrupted file — you can roll back your dataset to an earlier snapshot using the zfs rollback command.
Important: You cannot roll back to a snapshot if there are newer snapshots that would be destroyed. You must either destroy the intermediate snapshots or use the -r flag to force destroy them.sudo zfs rollback rpool/example@ep3_v1If intermediate snapshots exist, ZFS will refuse. You can force the rollback and destroy those snapshots with:
sudo zfs rollback -r rpool/example@ep3_v1This restores the dataset exactly to the state it was in when ep3_v1 was taken.
To delete a snapshot, use zfs destroy:
sudo zfs destroy rpool/example@ep3_v1To destroy all snapshots recursively (including child datasets):
sudo zfs destroy -r rpool/example@daily_backupYou can also do a dry run with the -n and -v flags to see what would be destroyed without actually destroying anything:
sudo zfs destroy -nv rpool/example@old_snapshotNote: You cannot delete a snapshot that has clones. The clones must be destroyed first.
A clone is a writable copy of a snapshot. Unlike a full copy, a clone initially shares all its data blocks with the snapshot (and the original dataset). As you write new data to the clone, ZFS allocates new blocks only for the changes.
sudo zfs clone rpool/example@ep3_v1 rpool/cloneNow /rpool/clone is a fully writable filesystem that started as an exact copy of the snapshot. You can modify files in the clone without affecting the original dataset or snapshot.
To delete a clone:
sudo zfs destroy rpool/cloneManually creating snapshots is fine for learning, but in production you want automation. Sanoid is a policy-driven snapshot management tool for ZFS that handles creating, pruning, and rotating snapshots automatically.
Sanoid uses a configuration file (usually at /etc/sanoid/sanoid.conf) where you define how many hourly, daily, weekly, monthly, and yearly snapshots to keep for each dataset. For example:
[rpool/example]
hourly = 24
daily = 30
weekly = 8
monthly = 6Sanoid then runs periodically (via cron or a systemd timer) and prunes snapshots that exceed the retention policy.
Note: Sanoid is widely used in the homelab community and works on Linux, FreeBSD, and TrueNAS.
Here are some practical scenarios where ZFS snapshots shine in a homelab:
.zfs/snapshot directory to recover a lost config file.zfs send and zfs receive to replicate snapshots to a remote backup server — an efficient way to handle offsite backups.ZFS prevents you from destroying a snapshot that has active clones. Destroy the clones first with zfs destroy <clone-name>, then delete the snapshot.
Use zfs rollback -r <dataset>@<snapshot> to destroy intermediate snapshots and roll back. Be careful — this is destructive.
Ensure the snapshot exists with zfs list -t snapshot. If the .zfs directory is not visible, you can enable it with:
sudo zfs set snapdir=visible <dataset>ZFS snapshots are one of the most valuable features for anyone running a homelab, TrueNAS system, or Linux server with ZFS. They give you instant, space-efficient point-in-time copies of your data, browsable snapshots through the .zfs/snapshot directory, and the ability to roll back or clone data in seconds.
Start by creating a few test snapshots today. Add automation with Sanoid. Explore the .zfs/snapshot directory on your system. Once you get comfortable with snapshots, the ZFS command line becomes one of the most powerful tools in your homelab toolkit.
For more advanced topics, check the official OpenZFS documentation or the Ubuntu tutorial on using ZFS snapshots and clones.