Snapshot Before You Break It
The most important thing a beginner can learn. One command before any risky change. If anything breaks, undo it in seconds.
Think of it as Ctrl+Z for your entire computer. A snapshot freezes the exact state of your system right now. If you upgrade something and it breaks, or delete files you needed, or misconfigure a service — you roll back to the snapshot and it's as if none of it happened.
Snapshots are instant, use almost no disk space until things change, and can't corrupt your running system.
What is a snapshot?
A snapshot is a frozen record of a ZFS dataset at a specific moment in time. It doesn't copy any data — it just remembers which blocks existed at that moment. If you later change or delete data, the snapshot holds onto the old version of those blocks.
How much space does it use?
A fresh snapshot costs almost nothing — just a tiny amount of metadata. It only grows as you make changes after the snapshot. If you haven't changed anything, the snapshot is nearly free. If you change 500 MB of files, the snapshot holds onto those 500 MB of old blocks.
The one habit to build
Before you do anything risky — upgrade, delete, edit configs, run an untested script — run this one command:
# The kldload way
ksnap create rpool/ROOT/kldload-node# The native ZFS way (same thing)
zfs snapshot rpool/ROOT/kldload-node@snap-20260326-0900Breaking down the command
ksnap create — the kldload snapshot tool. It auto-generates the timestamp (the part after @) for you, so you never have to think about naming. It also checks that the dataset exists before running and prints a clear confirmation.
zfs snapshot — the native ZFS command that ksnap calls underneath. You must supply the full snapshot name yourself, including the @timestamp suffix. Both commands produce an identical result.
rpool/ROOT/kldload-node — the dataset path. Let’s break it down:
rpool— the ZFS pool name (short for “root pool”). This is the physical disk.ROOT— a convention. This dataset holds boot environments — your operating system lives here.kldload-node— your machine’s hostname. During install, kldload names the root dataset after your computer so every machine has a unique identity inside the pool. If you named your machinewebserver, this would berpool/ROOT/webserver.
The @ separates the dataset name from the snapshot name — think of it as what@when. ksnap fills in the when part automatically.
That’s it. One command. It takes about half a second. Now go do the risky thing. If it works, great. If it breaks, you roll back.
You can also snapshot individual datasets, not just the whole system root:
# The kldload way — timestamp is automatic
ksnap create rpool/home/admin
ksnap create rpool/data
ksnap create # snapshots everything at once# The native ZFS way — you supply the snapshot name
zfs snapshot rpool/home/admin@manual-20260326-1400
zfs snapshot rpool/data@manual-20260326-1400
zfs snapshot -r rpool@manual-20260326-1400 # recursive: all datasets at onceWhat ksnap adds over plain zfs snapshot
• Auto-timestamp — no need to invent a name every time
• Dataset validation — tells you clearly if the dataset doesn’t exist instead of a cryptic ZFS error
• ksnap create (no args) — snapshots all kldload-managed datasets in one shot
• Consistent naming convention — all manual snapshots use manual-YYYYMMDD-HHMM so ksnap list can sort them cleanly alongside sanoid auto-snapshots
Do something dangerous
Let's walk through a real example. You want to upgrade your system. This could break things. First: snapshot.
# Step 1: Take a snapshot of the OS root
# The kldload way
ksnap create rpool/ROOT/kldload-node
# The native ZFS way (same result)
zfs snapshot rpool/ROOT/kldload-node@pre-upgrade-20260326-1400Created snapshot: rpool/ROOT/kldload-node@manual-20260326-140000# Step 2: Do the upgrade
kupgradeCreating boot environment: pre-upgrade-20260326-140012
Running system upgrade...
[... lots of package output ...]
Verifying ZFS DKMS modules... ok
Upgrade complete.Everything worked. You're done. The snapshot just sits there taking up almost no space until you delete it.
But what if the upgrade broke something?
Roll back if it breaks
Say the upgrade broke a service, and you need to undo everything immediately:
# The kldload way — shows all snapshots with human-friendly age and size
ksnap list# The native ZFS way
zfs list -t snapshot -o name,creation,used -s creation -r rpoolDATASET SNAPSHOT AGE SIZE
rpool/ROOT/kldload-node manual-20260326-140000 5m ago 192K
rpool/ROOT/kldload-node pre-upgrade-20260326-140012 4m ago 512K
rpool/home/admin manual-20260326-130000 1h ago 4.2M# The kldload way — roll back (confirms the action before running)
ksnap rollback rpool/ROOT/kldload-node@manual-20260326-140000
# The native ZFS way (same thing, no confirmation prompt)
zfs rollback rpool/ROOT/kldload-node@manual-20260326-140000Rolling back rpool/ROOT/kldload-node to manual-20260326-140000...
Done. Reboot to apply.What ksnap rollback adds over zfs rollback
• Confirmation prompt — asks “are you sure?” before destroying changes. zfs rollback runs immediately.
• Reboot reminder — tells you a reboot is needed for OS datasets to take effect.
• Intermediate snapshot handling — if newer snapshots exist between the current state and the target, ksnap rollback automatically adds -r to remove them. zfs rollback will fail without that flag.
rebootThe system comes back exactly as it was before the upgrade. The broken packages, changed configs, everything — gone. It's as if the upgrade never happened.
Rollback destroys changes made after the snapshot
When you roll back, any changes made after the snapshot are gone. Files created, packages installed, configs edited — all of it disappears. That's the point. If you want to keep some of those changes, browse the snapshot first (see below) and copy out what you need before rolling back.
Browse old files without rolling back
Sometimes you don't want to roll back the whole system — you just want to recover one file you accidentally deleted. ZFS makes this easy. Every snapshot is browsable as a hidden directory:
# List snapshots for the home directory
ls /rpool/home/admin/.zfs/snapshot/manual-20260326-130000 autosnap_2026-03-26_12:00:00_hourly# Browse the snapshot — it looks like a normal directory
ls /rpool/home/admin/.zfs/snapshot/manual-20260326-130000/Documents Downloads projects .bashrc .ssh# Recover a specific file — just copy it out
cp /rpool/home/admin/.zfs/snapshot/manual-20260326-130000/projects/important.txt \
/rpool/home/admin/projects/important.txtThat's it. The file is recovered. No rollback needed, no downtime, no drama.
Automatic snapshots — sanoid
kldload comes with sanoid already configured and running. It automatically takes and manages snapshots on a schedule:
# Check that sanoid is running
systemctl status sanoid.timersanoid.timer - Run sanoid every 15 minutes
Loaded: loaded (/lib/systemd/system/sanoid.timer; enabled)
Active: active (waiting)
Trigger: Thu 2026-03-26 14:15:00 UTC; 3min 42s left# See all the automatic snapshots it has taken
zfs list -t snapshot -r rpool | head -20NAME USED AVAIL REFER
rpool/ROOT/kldload-node@autosnap_2026-03-26_12:00:00_hourly 0B - 8.21G
rpool/ROOT/kldload-node@autosnap_2026-03-26_13:00:00_hourly 0B - 8.21G
rpool/home/admin@autosnap_2026-03-26_12:00:00_hourly 0B - 1.23G
rpool/home/admin@autosnap_2026-03-26_13:00:00_hourly 0B - 1.23GSanoid keeps hourly snapshots for 24 hours, daily for 30 days, and weekly for a year. Old snapshots are deleted automatically so your disk doesn't fill up. You already have a time machine running — you may not even have known it.
Boot environments — if the whole OS breaks
Sometimes an upgrade or config change is serious enough to prevent the system from booting at all. For this, kldload has boot environments. A boot environment is a snapshot of the entire OS that you can select at boot time.
# The kldload way — one command creates a boot-selectable snapshot
kbe create before-kernel-upgrade
# The native ZFS way (same thing — kbe is a convenience wrapper around this)
zfs snapshot rpool/ROOT/kldload-node@before-kernel-upgradeCreated boot environment: before-kernel-upgrade# The kldload way — shows boot environments in a readable table
kbe list
# The native ZFS way
zfs list -t snapshot -r rpool/ROOTNAME ACTIVE MOUNTPOINT CREATION
kldload-node yes / 2026-03-20 09:12
before-kernel-upgrade no - 2026-03-26 14:00
pre-upgrade-20260321 no - 2026-03-21 14:30If the system won't boot after a change, restart the machine. At the ZFSBootMenu screen (the boot menu that appears before the OS loads), use the arrow keys to select the old boot environment and press Enter. You're back.
ZFSBootMenu appears automatically when you have multiple boot environments. It looks like a simple text menu. Arrow keys to move, Enter to select. You have a few seconds to choose before it boots the default.
# The kldload way
kbe activate before-kernel-upgrade
kbe rollback kldload-node
# The native ZFS way — set the bootfs property to the snapshot you want to boot
zpool set bootfs=rpool/ROOT/kldload-node@before-kernel-upgrade rpoolWhat kbe adds over raw ZFS boot environment management
• Simplified naming — kbe create name vs manually crafting a zfs snapshot path
• kbe list — shows which environment is active and mount status. Raw zfs list shows snapshot data but not the active boot context.
• kbe activate — updates the ZFS bootfs pool property in one step instead of calling zpool set bootfs=... manually
• Integration with ZFSBootMenu — kbe names snapshots in the format ZFSBootMenu recognises and displays
Quick reference — the commands you need
Snapshot before anything risky
One command. Takes half a second.
List your snapshots
See what you have and when each was taken.
Roll back a dataset
Undo everything after the snapshot. Requires reboot for OS datasets.
Browse old files
No rollback needed — just copy the file out.
Boot environment before major changes
Protects the whole OS, selectable at boot if the system won't start.
kbe activate my-checkpoint
Safe system upgrade (does all of this for you)
Takes a boot environment snapshot, upgrades, verifies DKMS.
kldload vs native — quick reference table
| Task | kldload | Native ZFS | What k* adds |
|---|---|---|---|
| Take a snapshot | ksnap create rpool/data | zfs snapshot rpool/data@name | Auto-timestamp, dataset validation |
| Snapshot everything | ksnap create | zfs snapshot -r rpool@name | No name required; snapshots kldload-managed datasets |
| List snapshots | ksnap list | zfs list -t snapshot -r rpool | Human-friendly age and size columns |
| Roll back a dataset | ksnap rollback rpool/data@snap | zfs rollback -r rpool/data@snap | Confirmation prompt, reboot reminder, auto -r flag |
| Create boot environment | kbe create name | zfs snapshot rpool/ROOT/host@name | Consistent path, ZFSBootMenu-compatible naming |
| List boot environments | kbe list | zfs list -t snapshot -r rpool/ROOT | Shows active/inactive status and mountpoints |
| Activate boot environment | kbe activate name | zpool set bootfs=rpool/ROOT/host@name rpool | Shorter syntax, less error-prone |
The rule
Build one habit: before you do anything you're not sure about, run ksnap create. It costs nothing, takes no time, and will save you hours of pain at least once.
The second thing to know: sanoid is already taking automatic snapshots. Even if you forget to snapshot manually, you probably have an hourly automatic snapshot from an hour ago. Check ksnap list — your safety net is already there.