Proxmox Backup Server with Tape-Out to Cold Storage: when LTO still makes sense

Tape was supposed to be dead. At least that was the consensus three years ago. Since the hyperscalers raised egress pricing, since ransomware operators learned how to compromise cloud buckets with S3 Object-Lock, and since cyber insurers started explicitly asking for air-gap concepts, we are seeing a very real move back to tape in the field. Not as the primary backup. But as the third leg of a 3-2-1-1 strategy: offline, offsite, immutable.

In this article we show how Proxmox Backup Server combined with an LTO autoloader or a tape library builds a genuine cold-storage archive. We speak from the experience of customer setups between Ingolstadt and Augsburg, where we have been running PBS in production since version 2.x and where tape-out has been added incrementally since PBS 3.0.

Why tape is relevant again in 2026

The arguments for tape are not new, but they have gained weight:

Air-gap is physically guaranteed. A tape that has been ejected from the drive and placed in a safe is unreachable for any attacker. No network protocol, no compromised credentials, no backdoor sitting dormant for months. This physical separation cannot be reached by software alone — not through S3 Object-Lock, not through WORM snapshots on a NAS. Anyone who has watched attackers quietly collect backup credentials over three months and then wipe every reachable target at once understands the difference.

Durability is unmatched. LTO cartridges are specified for 30 years under controlled storage. No disk, no SSD, no NAS gets anywhere close. For archives where retention requirements run beyond ten years — accounting, construction data, regulatory documentation — this matters.

TCO works again. For large volumes that are rarely read but must be retained for a long time, tape sits well below cold cloud tiers in cost per terabyte and year, once egress, transfer and API charges are added in. Reliable numbers depend heavily on the specific setup — we work it through per customer and refer to our cloud vs TrueNAS storage cost analysis when framing it.

Insurers ask for it. Cyber insurance policies increasingly require proof of true offline backups. Snapshot policies and immutable S3 buckets are no longer accepted everywhere during audits. A documented tape rotation plan provides that proof without further discussion.

LTO-9 and LTO-10: current status

For new investments we currently recommend LTO-9 as the entry point and LTO-10 for environments planning from 2026/2027 that have the budget. LTO-9 holds 18 TB native per cartridge, LTO-10 goes up to 36 TB native. The vendor-published compressed figures should be treated as marketing — in production with PBS, which already delivers deduplicated and compressed data, hardware compression gains almost nothing. We always plan with native values and never add any padding.

For the drives themselves: LTO-10 drives read and write LTO-10 and LTO-9, no further backward support. Anyone still running LTO-8 cartridges and planning to upgrade to LTO-10 needs either a parallel LTO-9 drive to migrate the archive or an orderly phase-out of LTO-8. That is a point easily overlooked in planning and a frequent source of friction later.

Hardware pricing is moving. A single external LTO-9 SAS drive sits in the low four-figure range. A small 8-slot autoloader is in the upper four-figure range. A real library with two drives and 24 slots for mid-market environments starts in the low five-figure range. We quote on request, tailored to the actual data volume and rotation plan.

Proxmox Backup Server tape-out: how the pieces actually work together

PBS treats tape as an independent backup destination, not as an extension of a disk datastore. The workflow has three stages and deliberately decouples primary backup from the tape archive:

1. VMs, containers and host backups run as usual into one or more disk datastores. Deduplication and verification happen here. These are the operational restore points for day-to-day work — what happened in the last two to four weeks.
2. Media Pools define rules for which backups are written to which tape groups and how often tapes can be reused. This is where actual rotation management lives.
3. Tape backup jobs run on a schedule and write new snapshots from the disk datastore to tape. Old tapes are released for overwrite after a defined retention or kept permanently as archive.

A point often lost in the docs: PBS re-reads the data from the disk datastore for each tape job and decrypts it server-side. That means the PBS host needs enough CPU and solid throughput between datastore and drive. In practice, an LTO-9 drive without streaming capability quickly ends up in shoeshine mode — the tape shuttles back and forth, throughput collapses, drive wear accelerates. We therefore consistently recommend NVMe SSDs or at least fast ZFS mirrors as the datastore when tape-out is operated seriously. Which ZFS layout fits when is covered in more depth in our piece on using ZFS dataset quotas and reservations.

Planning media pools cleanly

A typical mid-sized setup we run looks like this:

• Pool “weekly” — written every week, 4 tapes in cycle, rotation after four weeks. These tapes stay on site but in the server room safe or in a different fire compartment.
• Pool “monthly” — written once a month, 12 tapes, rotated or archived after twelve months. These tapes go external — bank vault, second site or into the DATAZONE data center.
• Pool “yearly” — written once a year, permanent archive, never overwritten. These tapes are the actual compliance evidence.

Per pool, PBS defines which VMs and datastores feed in, how long retention runs and whether new backups are encrypted. Encryption on tape is mandatory as soon as tapes leave the building — even though physical transport itself already acts as an access control.

Verification and restore drills

The most hated topic in tape, for good reason: a backup that was not tested is not a backup. PBS offers automated tape verification that reads selected snapshots back from tape and checks them against the checksum. We run that verification on a sample set monthly — full verification of every tape would block rotation.

On top of that we run a real fire-drill restore every quarter: a randomly selected VM backup from an arbitrary monthly tape is restored in full, started in an isolated test environment and validated. This exercise fits alongside the other operational hardening work we cover in the winter server room check — temperature, humidity and UPS runtime are in scope in November just as much as restore drills.

Rotation and offsite transport in practice

This is where most tape plans fail. Not on the technology, on process discipline. A few points we consistently push with customers:

Documented tape handover. Who takes which tape where and when? Handover record, barcode scan, signature. It sounds bureaucratic but it saves hours in an incident. If a tape is missing or ready for exchange, it must be visible in the log within two minutes.

Two separate fire compartments. The server room and the tape depot should not sit behind the same fire door. A tape sitting in the autoloader does not count as an offsite backup when it matters.

Transport in certified data transport cases. No normal envelopes, no backpacks. Magnetic fields, temperature swings and physical shocks are real risks. For regular transport between customer sites and our data center we use padded, antistatic hard cases with temperature logger.

Storage under controlled conditions. 15 to 25 degrees Celsius, 20 to 60 percent relative humidity, no direct sunlight, no proximity to high-voltage equipment. A normal office basement usually meets that; a damp utility room without climate control does not.

Where tape is not the right fit

Honesty is part of the partner approach: tape is not the best answer for every scenario. Concretely, tape is not suited when:

• Restore speed is critical. A file server with 20 TB coming back out of the vault takes between four and twelve hours depending on tape count and drive availability — and that does not even include transport time to the data center. For primary backups with an RTO under one hour, this is not an option.
• Data volumes are small. Under ten TB total, the hardware investment often does not justify itself. A second TrueNAS with air-gap replication or into a hyperscaler S3 target is the more efficient path.
• Internal processes are not solid. Without reliable tape rotation the most expensive LTO drive is useless. If it is clear that nobody in the operation will consistently exchange and log tapes, cloud or managed backup is the more honest choice. Here we also offer tape rotation as a managed service through DATAZONE IT services.

Our recommendation for mid-market environments

For a typical mid-market environment with 20 to 80 TB of production data, a Proxmox cluster of two to five nodes and an existing TrueNAS instance as PBS datastore, our standard recommendation looks like this:

1. Primary backup to PBS with NVMe or fast ZFS datastore — daily backups with two to four weeks of retention.
2. Replication to a second PBS or TrueNAS target — either at a secondary site or into our TrueNAS managed service.
3. Tape-out above a defined threshold — usually weekly for operational fallback, monthly for medium-term archives, yearly for compliance.
4. Documented rotation and quarterly restore drills.

Which specific components make sense depends on data volume, network connectivity and compliance scope. We work it through per setup and also check whether a TrueNAS configuration as the primary PBS datastore is a better foundation than a standalone backup target.

FAQ on Proxmox PBS tape-out and LTO cold storage

Is LTO-9 still worth it in 2026 or should we go straight to LTO-10?

For new investments we lean towards LTO-10 if the budget allows. Doubling capacity per cartridge reduces operational effort over time — fewer tapes to rotate, fewer slots used, fewer transports. Anyone still running LTO-8 or earlier generations can take the LTO-9 intermediate step, because LTO-10 drives no longer read LTO-8 cartridges.

How long do LTO tapes actually last?

The specification is 30 years under controlled storage. In practice we see no meaningful data loss on correctly stored tapes from the early 2000s. What matters is less the age of the tape and more whether the matching drive generation will still be available in 15 years. That is why we recommend migrating the archive to a current tape generation every eight to ten years.

Can PBS tape-out run without an autoloader?

Technically yes, with a single drive and manual tape swaps. Practically that only makes sense for very small environments with someone reliably swapping a tape daily or weekly. For mid-market setups with more than 10 TB of backup volume per tape set the autoloader pays off quickly — just by automating rotation and reducing human error.

What happens if a tape is physically damaged?

PBS writes data to tape in a datalog format with checksums per chunk. A damaged section does not render the entire tape unusable but leads to loss of individual chunks. Whether that is critical for a restore depends on which snapshots are affected. For critical pools we always write to at least two parallel tapes — that costs double the capacity but significantly improves resilience.

Are WORM snapshots on TrueNAS not enough instead of tape?

As a second leg yes, as the third leg of a 3-2-1-1 strategy not quite. WORM snapshots protect against encryption via compromised credentials but not against an attacker holding admin rights long enough to manipulate dataset retention policies. Air-gap through physical separation is a different trust layer. In regulated industries and in larger cyber policies we see that separation increasingly required.

Does DATAZONE also operate tape rotation as a service?

Yes. For customers who want the technology but not the process, we offer rotation as a service: tapes are collected on a schedule, stored securely in our data center and brought back on request. Restore drills are run quarterly and documented in an audit-ready way. Details are worked out in an IT services conversation.