Proxmox Backup Server 4.2: What’s New and What it means for TAC GLOBAL

As of April 29, 2026, Proxmox has released version 4.2 of Proxmox Backup Server (PBS), which is a popular open-source backup solution used to backup virtual machines, containers, physical hosts and files in Proxmox Virtual Environments or Linux based Servers. This update is based on Debian 13.4 "Trixie" and ships with Linux kernel 7.0 as the new stable default, along with ZFS 2.4 for reliable, enterprise-grade storage. The new release brings meaningful improvements across backup organization, sync security, sync performance, and S3-backed storage

The highlighted features in this release include:

• Server-Side Encryption for Sync Jobs

• S3-compatible Object Stores Now Officially Supported

• Moving Groups and Namespaces

Server-Side Encryption for Sync Jobs

PBS sync jobs are used to sync backups from your PBS instance to another remote instance and this update is a big value add for our users.

PBS has always supported encryption, but it was handled entirely on the client side. This means the encryption key lives with the user and they were wholly responsible key management (rotating keys for security and privacy reasons, ensuring the key isn’t lost and making sure the key doesn’t get into the wrong hands). While our system monitors and checks to ensure your backups are encrypted, the only way we could force this was by sending email reminders that your unencrypted backups were at risk of deletion. This was to ensure that whenever we sync your data to an offsite PBS location or remote datastore your data still stayed encrypted.

With this new update, push sync jobs can now be configured to encrypt snapshots before sending them to remote datastores/our offsite PBS instance. Similarly, pull sync jobs can now decrypt backups that were encrypted on remote datastores. This means encryption can now be enforced on the server level during sync jobs instead of solely relying on the client and allows users further security and privacy. Even if your files are unencrypted, when they sync to another PBS instance they will be encrypted on the server side.

s3-Compatible Object Stores Now officially Supported

In earlier versions of PBS, support for S3-compatible object storage was available as a "technology preview" which meant that it worked, but wasn't officially supported for production use. As of 4.2, it's now a fully supported, first-class backup storage backend.

At a high level, S3-compatible object storage is a way of storing data in the cloud (or on-premises) that is typically cost-effective, highly durable, and designed for long-term storage. Rather than writing to a physical disk attached to the server, backups can be stored in services like Backblaze B2, Cloudflare R2, or a self-hosted solution like MinIO, all of which speak the same S3 API that PBS now officially supports.

Along with official support, 4.2 adds the ability for S3-backed datastores to track request counts and traffic statistics, which gives better visibility into how much data is moving in and out of object storage. This is useful for catching unexpected traffic spikes early and keeping storage costs predictable.

We'll be sharing more about how we plan to use S3-backed storage as part of our infrastructure in a future post.

Moving Groups and Namespaces

Backup groups and namespaces can now be moved to different locations within the same datastore through the GUI. Before 4.2, this was only possible through using the PBS client or proxmox-backup-client tool. For users who may not be familiar with the client, moving your backup groups or namespaces on the datastore was tedious an time consuming. With this update, it allows users to easily re-organize their datastore without having to plan beforehand. Similar to drag and dropping your folders on a PC, users will have that same control here.

What this Means for TAC GLOBAL Users

TAC GLOBAL users will benefit from the extra security and quality of life improvements that come in 4.2. Most notably, the server-side encryption improvements mean that protecting your data in transit to offsite locations is no longer dependent on individual key management, we can handle that on the server side. In the following days, we are working to switch over to version 4.2 and be live with these new updates!