Linux Archiving Tools Compared: tar, cpio, and zip/unzip

The core difference between the two classic Unix archivers is where the file list comes from: tar archives the files and directories you name as command-line arguments, while cpio reads its list of files from standard input — which is why cpio is almost always seen on the right side of a pipe from find. The third tool in the family, zip/unzip, handles the cross-platform .zip format; unzip photos.zip extracts an archive’s contents into the current directory. XK0-006 expects you to recognize the correct invocation of all three.

tar: the default archiver

tar (tape archive) bundles a directory tree into a single .tar file and, with one extra flag, compresses it in the same step. Its grammar is a mode letter plus modifiers:

• Modes (exactly one): -c create, -x extract, -t list contents.
• Compression: -z gzip (.tar.gz/.tgz), -j bzip2 (.tar.bz2), -J xz (.tar.xz). Modern GNU tar also auto-detects compression on extraction, so -x alone usually suffices.
• Common companions: -f archive names the archive file (must come last before the filename), -v lists files as they are processed, -C dir changes directory before acting.

The three invocations to know cold:

tar -czvf etc-backup.tar.gz /etc        # create gzip-compressed archive
tar -tzvf etc-backup.tar.gz             # list contents without extracting
tar -xzvf etc-backup.tar.gz -C /tmp     # extract into /tmp

Note what tar does not do: it has no built-in way to take its file list from a pipe, beyond the -T file (read names from a file, where -T - means stdin) escape hatch. Its natural input is “this path and everything under it.”

cpio: the pipe-native archiver

cpio (copy in/out) was designed around streams. It never walks directories itself — something else (usually find) produces the list of pathnames, one per line, and cpio consumes it on standard input. That inversion is exactly what makes cpio the right tool when you need to archive a filtered set of files rather than a whole subtree.

cpio has three modes, selected by a required flag:

• Copy-out (-o) — read filenames from stdin, write an archive stream to stdout:

  find /etc -name '*.conf' | cpio -ov > confs.cpio

  This is the pattern the exam cares about: find selects the files, the pipe carries the names, cpio -o builds the archive, and shell redirection captures the stream into a file. Variants add -H newc to select the portable “new” header format, and gzip can be appended to the pipeline for compression — cpio itself does not compress.

• Copy-in (-i) — read an archive from stdin and extract:

  cpio -idv < confs.cpio

  -d creates leading directories as needed (without it, extraction fails when a parent directory is missing) and -v lists files. cpio -itv < confs.cpio lists contents without extracting.

• Pass-through (-p) — no archive file at all; copy a file list directly to another directory tree, preserving structure:

  find . -depth | cpio -pdm /backup/projects

  (-m preserves modification times.) This is effectively a filtered recursive copy.

cpio also has a claim to fame beyond backups: the initramfs image every modern Linux system boots from is a compressed cpio archive — see how initramfs works for why that matters at boot time.

tar vs cpio at a glance

	tar	cpio
File list source	Command-line arguments (recurses into directories)	Standard input, one pathname per line
Typical pairing	Used standalone	Piped from find
Built-in compression	Yes (-z, -j, -J)	No — pipe through gzip/xz
Create syntax	tar -cf out.tar dir/	find dir | cpio -o > out.cpio
Extract syntax	tar -xf out.tar	cpio -id < out.cpio
Everyday role	Backups, software distribution	Filtered archives, initramfs images

Neither is “better” — tar is the everyday standard, and cpio wins precisely when the file list is the output of a search — usually find, whose strengths against locate are covered in finding files on Linux.

zip and unzip

The .zip format is the interchange format: Windows and macOS create and open it natively, and each member file is compressed individually. On Linux the tools are separate binaries:

• zip -r project.zip project/ creates an archive recursively (-r is required for directories — without it zip archives only the empty directory entry).
• unzip photos.zip extracts everything into the current working directory, recreating any internal folder structure.
• unzip -l photos.zip lists the contents without extracting; unzip -d ~/pictures photos.zip extracts into a different target directory.

The scenario version is deliberately simple: a colleague emails you photos.zip, and the command that unpacks it where you stand is plain unzip photos.zip — no mode letters, no -f flag, no tar involvement. Distractors usually dress the answer up with tar-style syntax (unzip -xvf) that unzip does not use.

How the XK0-006 exam tests this

• A pipeline-construction pattern: an admin must archive a specific list of files produced by find using cpio, and you pick the correctly formed command — the credited answer pipes find’s output into cpio -o (often with -v) and redirects stdout to the archive file. Distractors pass filenames as cpio arguments (cpio takes none) or use -i (extract) where -o (create) belongs.
• A simple extraction question: which command unpacks a .zip file into the current directory — unzip archive.zip, against distractors borrowing flags from tar or gzip.
• Flag-decoding for tar: match -c/-x/-t and -z/-j/-J to a described task, such as “list the contents of a .tar.gz without extracting.”
• A tool-selection pattern: given “archive only files matching a search,” recognize that cpio’s stdin design (or tar -T) fits, whereas plain tar arguments would sweep in entire directories.

Archiving commands like these belong to the System Management domain — the full XK0-006 study guide breaks down every domain and its weight. When the flags feel automatic, test yourself against XK0-006 practice questions.

Quick reference

• tar -czvf out.tar.gz dir/ creates; tar -xzvf out.tar.gz extracts; -t lists; -C picks the destination.
• tar compression flags: -z gzip, -j bzip2, -J xz; extraction auto-detects on modern GNU tar.
• cpio reads filenames from stdin: find … | cpio -ov > archive.cpio to create.
• Extract cpio with cpio -idv < archive.cpio — -d builds missing parent directories.
• cpio -p (pass-through) copies a find-selected tree to another location without an intermediate archive.
• cpio does not compress; add gzip to the pipeline. The initramfs is a compressed cpio archive.
• unzip file.zip extracts to the current directory; -l lists, -d target/ redirects output.
• zip -r out.zip dir/ is required to capture a directory’s contents recursively.