A Game Server Backup Is Proven by a Restore, Not a File Count
Published and official references checked 2026-08-29 · SameOS operator
A new tar file every morning is not proof of recovery. A world copied mid-write, missing configuration, or stored only beside the original disk often reveals its failure for the first time after an incident. This drill restores Minecraft, Palworld, or Satisfactory data into a separate directory and port, leaving the production world untouched until the copy has booted and a client has verified it.
Put Numbers on Recovery First
RPO is the amount of recent progress you can afford to lose; RTO is the time allowed to make the server joinable again. A small friends-only server might choose an RPO of one hour and an RTO of sixty minutes. Those numbers determine snapshot frequency, retained generations, and how often a restore should be rehearsed.
Define success as archive extraction, required files present, process start, connection on a different port, and the expected world and players—not merely exit code zero from tar. Log creation time, game build, source and archive sizes, and SHA-256. Do not put passwords or API tokens in the backup log.
- RPO: maximum gameplay progress that may be lost.
- RTO: target from selecting an archive to a successful player join.
- Retention: hourly, daily, and weekly generations plus another device.
- Proof: archive integrity, required files, boot log, and client join.
Capture a Consistent, Quiesced Copy
The conservative method issues the game save operation, performs a graceful stop, and only then copies files. A no-downtime workflow needs a game-specific save hold or filesystem snapshot. Blindly running rsync against a live world is not a consistent snapshot unless the game explicitly guarantees that behavior.
For Minecraft, flush the world and pause writes or stop normally. For Palworld, save through an administrator command or the loopback REST API, stop, and retain all of Pal/Saved. The official bIsUseBackupSaveData setting creates multiple internal recovery points, but an external copy of that data is still needed. Stop Satisfactory cleanly and keep its SaveGames plus required configuration.
# Examples: stop cleanly, then archive the entire data root
# Installations differ; verify the real volume before running anything
sudo systemctl stop minecraft
sudo tar -C /srv/minecraft -czf /srv/game-backups/minecraft-$(date +%F-%H%M).tar.gz data
sudo systemctl start minecraft
# The core of a SteamCMD/official Palworld install is all of Pal/Saved
sudo systemctl stop palworld
sudo tar -C /srv/palworld -czf /srv/game-backups/palworld-$(date +%F-%H%M).tar.gz Pal/Saved
sudo systemctl start palworldThese paths are illustrative. Never guess the live volume; inspect the systemd WorkingDirectory or Docker Mounts for your own installation first.
Test the Archive Before the Game
During recovery, choose the newest archive that has passed validation, not simply the newest filename. Read the tar index, test compression to the end, and compare SHA-256 before and after copying it to another device. A file beside its source world is only a second copy until that disk fails.
Keep a small manifest next to the archive so the game and build are not guesses on recovery day. Record the build, creation time, world name, clean-stop result, data root, and checksum. Leave out administrator secrets, public addresses, and player identifiers.
cd /srv/game-backups
gzip -t minecraft-YYYY-MM-DD-HHMM.tar.gz
tar -tzf minecraft-YYYY-MM-DD-HHMM.tar.gz | sed -n '1,30p'
sha256sum minecraft-YYYY-MM-DD-HHMM.tar.gz \
> minecraft-YYYY-MM-DD-HHMM.tar.gz.sha256
sha256sum -c minecraft-YYYY-MM-DD-HHMM.tar.gz.sha256
# Confirm that core files are not missing
tar -tzf minecraft-YYYY-MM-DD-HHMM.tar.gz | grep -E \
'level.dat|server.properties|whitelist.json|ops.json'Extract Away From Production
The central rule of a drill is never to extract over live data. Create an empty date-stamped directory and unpack as an unprivileged game account. Inspect unexpected absolute paths, parent traversal, and ownership before a test process sees the files.
Use a port distinct from production and bind the test instance to 127.0.0.1 or an isolated LAN. Disable public listing, web administration, and RCON. First boot with exactly the same game build because a newer process may convert the save; test upgrades only after making another copy of the restored directory.
sudo install -d -o gameserver -g gameserver \
/srv/restore-drills/minecraft-YYYY-MM-DD
sudo -u gameserver tar -xzf \
/srv/game-backups/minecraft-YYYY-MM-DD-HHMM.tar.gz \
-C /srv/restore-drills/minecraft-YYYY-MM-DD
# Compare file count and size with the backup record
find /srv/restore-drills/minecraft-YYYY-MM-DD -type f | wc -l
du -sh /srv/restore-drills/minecraft-YYYY-MM-DD
# In the copied config only: alternate port, loopback bind, no public listing
# Exact setting names differ by gameWhat to Inspect in Each Game
For Minecraft, check that level.dat loads, Nether and End data exist, and the allowlist and operator list match the intended state. A successful process can still have created a new empty world, so compare the logged level name and a known in-game coordinate or build.
For Palworld, look beyond Level.sav: Players, LevelMeta.sav, and world settings must travel together. A newly created character or empty guild and Palbox means the restore is partial. In Satisfactory, load the intended session and recent autosave, then compare a known factory location, play time, and power network.
- No corruption, conversion, or build-mismatch error in the boot log.
- A real client can join on the isolated test port.
- The expected world name and save time are visible.
- Players, permissions, allowlists, and known structures remain.
- After one save and graceful restart, the same state returns.
Turn Drill Friction Into a Better Backup
Record elapsed time and every point that blocked the drill. If locating the matching game build took longer than extraction, add the binary or image tag to the manifest. If permissions were absent, expand the backup set. Each failure should become the next automatic validation, not a detail hidden from the runbook.
Restored archives contain world and player information. Keep them outside the web root and public download folders. Public documentation should use invented paths and redacted logs; real addresses, tokens, cookies, and player IDs belong only in private operational records.
Verification scope and official references
Required data was cross-checked against the official Minecraft server guidance, Palworld 1.0.3 backup settings, and official Satisfactory save locations. The examples use generic paths and never inspect or disclose a SameOS production world, account, or token.