tar does one job: it wraps many files into one stream. gzip, bzip2, xz and zstd do the second job: they squeeze that stream. A .tar.gz is both jobs stapled together, and knowing they are separate explains almost every quirk.

The letters -z -j -J just pick the squeezer. And because the squeezer runs over the whole stream, you cannot update or delete inside a compressed archive. Unwrap first, edit, re-squeeze.

Two tools, one filename. That's the whole idea.

Everything starts with one letter. c creates an archive, t lists what's inside, x extracts it. One operation per command: you never pack and peek in the same breath.

The classic confusion, remembering which letter, dissolves when you read them as verbs: create, lisT, eXtract. The rest of the command line just modifies whichever verb you picked.

c writes, t reads, x writes back out. Pick the verb first, everything else follows.

-f means: the next word is the archive. That's why it's -cf backup.tar and not -c backup.tar. Forget -f and tar reaches for a tape drive, or the TAPE variable, a leftover from when archives literally lived on tape.

So the folk mnemonic unfolds: c the verb, f the file, then the files. The order matters because f's argument is whatever follows it, immediately.

-f is not decoration. It's the difference between backup.tar and /dev/rmt0.

tar -tf costs nothing and tells you everything: the layout, the top folder, whether stray files sit at the root. Extracting is the expensive direction, because it writes to your disk exactly where the names say.

A tarbomb is an archive whose members have no shared top folder, so it scatters across your working directory. Reading the listing first is the entire defence, and it's free.

t is a window. x is a door. Look through the window first.

tar -xf writes members out relative to where you stand, not where the archive lives. Names stored relative come out relative: that's why the tarball seems to explode into your directory if you weren't looking.

Missing directories are created on arrival. Nothing is fetched from anywhere special; the archive is just a list of names and bytes, replayed here.

cd first, extract second. The command has no other idea of place.

.tgz and .tar.gz are the same thing: the short form is a historical filename squeeze, the format identical. Same for .tbz2 and .txz. Read the suffix right to left: the last extension names the squeezer.

Create in the same spirit with -a: tar -caf backup.tgz sees the suffix and picks gzip for you. The filename becomes the instruction.

The suffix is documentation the tools already read. Name files honestly and -a does the rest.

Every tarball seems to have that one wrapper folder, project-1.2, that nests wrong. --strip-components=1 drops the first path segment from every member on the way out, so the contents land directly where you stand.

Count carefully: the number is how many leading parts to remove, applied to every member uniformly. A mixed-depth archive strips badly; check with t first.

One flag dissolves the wrapper folder. Look before you strip, because depth must be uniform.

You never have to unpack the whole thing. tar -xf archive.tar path/to/one-file lifts out exactly that member, using the name exactly as t printed it. No leading ./ fudging, no guessing.

Want it without even touching the disk? -O pours the member to stdout: pipe it into less, diff, or another command. The archive becomes a lookup, not an unpack.

List, copy the name, extract it. Three commands, one file, zero mess.