Odpověď jsem našel zde:

Backing up Hetzner snapshots locally

Hetzner is a nice, cheap host for server. Unfortunately they do not let you download backups and snapshots of cloud servers locally. So you are kind of locked in with them.

Here is how I create full disk backups for e.g. standard CX11 servers with default images.

Make sure you understand everything before you attempt this. Pay special attention to your own partitions and make sure you archive what you really need. Consider imaging the whole device instead of just a partition.

Create a backup

Create a new snapshot of your server
Create a new server from it
Boot said server in rescue mode
Use good old dd and gzip to image the main disk to a local archive

ssh root@SERVERIP "dd if=/dev/sda1 bs=1M status=progress | gzip -" | dd of=SERVERIP.sda1.dd.gz bs=1M

The bs=1M is fairly random by me, worked well, didn’t care to optimize
gzip (with the default compression level) kind of maxed out the server CPU but still enabled me to almost max out my download bandwidth. Of course the ratio between remote CPU compression speed vs download bandwidth depends on your specific situation. You might want to use xz or zstd instead.
Don’t be stupid, do it twice and compare the checksums
If you do not need your server to be live during backup, you can skip the snapshotting and second server of course, just boot your server in rescue mode instead.

Build a new server from a backup

Create a new server using the same or a similar configuration as the backed up one
Boot said server in rescue mode

cat SERVERIP.sda1.dd.gz | ssh root@SERVERIP "gunzip -c | dd of=/dev/sda1 bs=1M status=progress conv=fsync"

Reboot to leave rescue mode
If you want to restore your server because of a breakage, just boot it into rescue mode and do the same as above otherwise.

Full Hetzner Server Backup to Local Machine (Rescue Mode Method)

This guide creates a complete, bootable disk image of a Hetzner server and downloads it locally.

The result is a compressed raw disk image that can later be restored to any compatible machine.

⸻

Overview

This method:
• Boots the server into Hetzner Rescue mode
• Streams the entire disk over SSH
• Compresses it using zstd
• Verifies integrity with SHA256

The backup includes:
• Partition table (GPT/MBR)
• Bootloader
• EFI partition
• All filesystems
• All data and secrets

⸻

1. Enable Rescue Mode

In Hetzner Console:
1. Select the server
2. Go to Rescue
3. Enable Linux rescue system
4. Select SSH key or note temporary password
5. Reboot the server

Wait until it comes up in rescue mode.

⸻

1. Connect to Rescue System

From your local machine:

ssh root@SERVER_IP

⸻

1. Identify the Disk Device

Inside rescue system:

lsblk -o NAME,SIZE,TYPE,FSTYPE,MOUNTPOINTS

Typical output:

sda     38G disk
├─sda1  37G part ext4
├─sda14   1M part
└─sda15 256M part vfat

You must image the whole disk:
• /dev/sda
• or /dev/vda (virtio systems)

Do NOT image only a partition unless you explicitly intend to.

⸻

1. Ensure Disk Is Not Mounted

mount | grep -E '^/dev/sd'

If nothing is returned, you are safe.

⸻

1. Prepare Local Machine (macOS)

Install required tools:

brew install zstd pv coreutils

Create backup directory:

mkdir -p ~/backups/hetzner/SERVER_NAME
cd ~/backups/hetzner/SERVER_NAME

⸻

1. Stream the Disk Image

On your local machine:

export OUT="SERVER_NAME-$(date +%Y-%m-%d)-full-disk.img.zst"

ssh root@SERVER_IP "dd if=/dev/sda bs=16M status=progress | zstd -T0 -3" \
| pv \
> "$OUT"

Replace /dev/sda if your disk is different.

Notes:
• bs=16M improves performance
• zstd -T0 -3 uses all cores with moderate compression
• Use -1 instead of -3 if CPU is the bottleneck

Expected duration: depends on disk size and network speed.

⸻

1. Verify Integrity

Generate checksum:

gsha256sum "$OUT" > "$OUT.sha256"

Verify checksum:

gsha256sum -c "$OUT.sha256"

Expected result:

filename.img.zst: OK

Test compressed file integrity:

zstd -t "$OUT"

Expected: no errors.

⸻

1. Store Backup Securely

This image contains all system secrets.

Recommended:
• Store in encrypted backup system (Borg, Restic, etc.)
• Or encrypt manually (age / gpg)
• Keep checksum file alongside image

⸻

1. Decommission Server

Once verification is complete:
1. Power off server
2. Optionally keep snapshot temporarily
3. Delete server

Backup is now portable and restorable anywhere.

⸻

Restore Procedure (Future Use)

Boot target system into rescue or live Linux environment.

Restore disk:

pv SERVER_NAME-YYYY-MM-DD-full-disk.img.zst \
| zstd -d \
| dd of=/dev/sda bs=16M status=progress conv=fsync

Reboot after completion.

If target disk is larger, expand partitions/filesystems after boot.

⸻

Notes & Warnings
• Always verify device name before running dd
• Restoring will overwrite entire target disk
• Image size after compression depends on used space
• This method creates an exact clone of the original server