tar over SSH: Streaming a Tree to a Remote Host
tar over ssh streams a directory from one host to another in a single pipeline.
For deploys and backups, piping tar through ssh moves a whole tree with permissions intact and no intermediate file. The errors are mostly ssh and pipe issues, not tar format problems.
What it does
tar -cf - on the source writes the archive to stdout; ssh carries that stream to the remote host, where tar -xf - reads it from stdin and extracts. Nothing touches disk as a separate file, and file modes and structure are preserved end to end. Add -z to compress over the wire.
Common usage
# Push a local tree to a remote directory
tar -czf - -C build . | ssh deploy@host 'tar -xzf - -C /var/www'
# Pull a remote tree down locally
ssh deploy@host 'tar -czf - -C /var/log app' | tar -xzf - -C ./logs
# Preserve perms on extract
tar -cf - -C build . | ssh host 'tar -xpf - -C /opt/app'Options
| Form | What it does |
|---|---|
| tar -cf - | ssh host 'tar -xf -' | Push a tree to the remote |
| ssh host 'tar -cf -' | tar -xf - | Pull a tree from the remote |
| -z | Compress the stream over the network |
| -p on remote extract | Preserve permissions on the destination |
| ssh -o BatchMode=yes | Fail fast instead of prompting in CI |
In CI
For a no-registry deploy, stream build output to the server in one step. Use ssh -o BatchMode=yes with a deploy key so the connection never blocks on a prompt, and add the host to known_hosts ahead of time so it does not fail on first contact.
Common errors in CI
Host key verification failed means the remote host is not in known_hosts; pre-seed it with ssh-keyscan host >> ~/.ssh/known_hosts. tar: -: Cannot write: Broken pipe means the ssh side died (auth failure, remote disk full, or the remote tar errored); check the ssh exit status and the remote logs. A non-zero pipeline exit can hide behind tar, so set pipefail in the shell.