SILO: Community-Maintained MinIO Fork by Pigsty on SILO

SILO 20260618 Released

Thu, 18 Jun 2026 00:00:00 +0000

Published: 2026-06-18 · Version: RELEASE.2026-06-18T00-00-00Z

This release is a security and dependency-maintenance update for the pgsty/minio fork. It hardens LDAP STS throttling, completes S3 Select oversized-record enforcement, removes the obsolete ReadMultiple internode storage-REST API, upgrades the Go build baseline to 1.26.4, and refreshes Go module dependencies to pick up additional third-party security fixes.

Note

Known issue: this release — like every earlier community release since RELEASE.2025-12-03T12-00-00Z — carries a silent streaming-flush regression inherited from upstream that breaks mc watch / bucket-notification listeners and S3 Select keep-alives. There is no workaround; the fix is merged on master and ships in the next release. See Security Note entry SN-2026-001 for the full analysis.

MinIO Fork, Promise Kept

Fri, 17 Apr 2026 00:00:00 +0000

Two months after forking MinIO, pgsty/minio ships patches for four CVEs and related security issues. No new features — just working builds, a restored console, and timely security fixes.

CVE-2026-32285: The jsonparser Advisory That Required No Patch

Wed, 15 Apr 2026 00:00:00 +0000

Status: Closed without a code change
GitHub issue: pgsty/minio#26

Security maintenance is not always a sequence of “find a vulnerability, then ship a patch.” The initial assessment of CVE-2026-32285 was that the repository might still carry a vulnerable jsonparser; replacing the dependency or maintaining another fork was even considered. Checking the resolved module version and actual reachability changed the conclusion: the tree already used v1.1.2, which contained the fix, and govulncheck found no reachable vulnerable symbol.

Active Directory / LDAP Settings

Mon, 01 Jan 0001 00:00:00 +0000

This page documents settings for enabling external identity management using an Active Directory or LDAP service. See Configure MinIO for Authentication using Active Directory / LDAP for a tutorial on using these settings.

Important

New in version RELEASE.2023-05-26T23-31-54Z:

mc idp ldap commands are preferred over using configuration settings to configure MinIO to use Active Directory or LDAP for identity management.

MinIO recommends using the mc idp ldap commands for LDAP management operations. These commands offer better validation and additional features, while providing the same settings as the identity_ldap configuration key. See Configure MinIO for Authentication using Active Directory / LDAP for a tutorial on using mc idp ldap.

AMQP Notification Settings

Mon, 01 Jan 0001 00:00:00 +0000

This page documents settings for configuring an AMQP service as a target for Bucket Notifications. See Publish Events to AMQP (RabbitMQ) for a tutorial on using these settings.

You can establish or modify settings by defining:

an environment variable on the host system prior to starting or restarting the MinIO Server. Refer to your operating system’s documentation for how to define an environment variable.
a configuration setting using mc admin config set.

If you define both an environment variable and the similar configuration setting, MinIO uses the environment variable value.

AssumeRoleWithCustomToken

Mon, 01 Jan 0001 00:00:00 +0000

The MinIO Security Token Service (STS) AssumeRoleWithCustomToken API endpoint generates a token for use with the MinIO External Identity Management Plugin.

Request Endpoint

The AssumeRoleWithCustomToken endpoint has the following form:

POST https://minio.example.net?Action=AssumeRoleWithCustomToken[&ARGS]

The following example uses all supported arguments. Replace the minio.example.net hostname with the appropriate URL for your MinIO cluster:

POST https://minio.example.net?Action=AssumeRoleWithCustomToken
&Token=TOKEN
&Version=2011-06-15
&DurationSeconds=86000
&RoleArn="external-auth-provider"

Request Query Parameters

This endpoint supports the following query parameters:

Parameter

Type

Batch Replication

Mon, 01 Jan 0001 00:00:00 +0000

Added: MinIO

RELEASE.2022-10-08T20-11-00Z

The Batch Framework was introduced with the replicate job type in the mc RELEASE.2022-10-08T20-11-00Z.

The MinIO Batch Framework allows you to create, manage, monitor, and execute jobs using a YAML-formatted job definition file (a “batch file”). The batch jobs run directly on the MinIO deployment to take advantage of the server-side processing power without constraints of the local machine where you run the MinIO Client.

The replicate batch job replicates objects from one MinIO deployment (the source deployment) to another MinIO deployment (the target deployment). Either the source or the target must be the local deployment.

Bucket Versioning

Mon, 01 Jan 0001 00:00:00 +0000

Overview

MinIO supports keeping multiple “versions” of an object in a single bucket.

When enabled, versioning allows MinIO to keep multiple iterations of the same object. Write operations which would normally overwrite an existing object instead result in the creation of a new versioned object. MinIO versioning protects from unintended overwrites and deletions while providing support for “undoing” a write operation. Bucket versioning is a prerequisite for configuring object locking and retention rules.

cert-manager for Operator

Mon, 01 Jan 0001 00:00:00 +0000

MinIO Operator manages TLS certificate issuing for the services hosted in the minio-operator namespace.

This page describes how to manage the Operator’s TLS certificates with cert-manager.

Prerequisites

A supported version of Kubernetes.
kustomize installed
kubectl access to your k8s cluster
Completed the steps to set up cert-manager
The MinIO Operator must not yet be installed.

1) Create a CA Issuer for the `minio-operator` namespace

This guide disables the automatic generation of certificates in MinIO Operator and issues certificates using cert-manager instead.

Configure MinIO for Authentication using Active Directory / LDAP

Mon, 01 Jan 0001 00:00:00 +0000

Overview

MinIO supports configuring a single Active Directory / LDAP Connect for external management of user identities.

The procedure on this page provides instructions for:

For MinIO Tenants deployed using the MinIO Kubernetes Operator, this procedure covers:

Configuring a MinIO Tenant to use an external AD/LDAP provider
Accessing the Tenant Console using AD/LDAP Credentials.
Using the MinIO AssumeRoleWithLDAPIdentity Security Token Service (STS) API to generate temporary credentials for use by applications.

For MinIO deployments on baremetal infrastructure, this procedure covers:

Deploy a MinIO Tenant

Mon, 01 Jan 0001 00:00:00 +0000

This procedure documents deploying a MinIO Tenant using the MinIO Operator.

Deploying Single-Node topologies requires additional configurations not covered in this documentation. You can alternatively use a simple Kubernetes YAML object to describe a Single-Node topology for local testing and evaluation as necessary. MinIO does not recommend nor support single-node deployment topologies for production environments.

This documentation assumes familiarity with all referenced Kubernetes concepts, utilities, and procedures. While this documentation may provide guidance for configuring or deploying Kubernetes-related resources on a best-effort basis, it is not a replacement for the official Kubernetes Documentation.

Deploy MinIO on RedHat Linux

Mon, 01 Jan 0001 00:00:00 +0000

This page documents deploying MinIO on RedHat Linux operating systems, including distributions that are binary-compatible with RHEL. This page makes no distinction or special remarks between RHEL and those distributions, and guidance given for RHEL can typically be applied to those distributions.

MinIO strongly recommends that production deployments use RHEL versions in the Full Support or Maintenance Support phases of the Red Hat life cycle. At the time of writing, that includes:

Deploy Operator With Helm

Mon, 01 Jan 0001 00:00:00 +0000

Overview

Helm is a tool for automating the deployment of applications to Kubernetes clusters. A Helm chart is a set of YAML files, templates, and other files that define the deployment details. The following procedure uses a Helm Chart to install the MinIO Kubernetes Operator to a Kubernetes cluster.

Prerequisites

See the Operator Prerequisites for a baseline of requirements. Helm installations have the following additional requirements:

Helm (Use the Version appropriate for your Kubernetes API version)
yq

For more about Operator installation requirements, including supported Kubernetes versions and TLS certificates, see the Operator deployment prerequisites.

Deployment Architecture

Mon, 01 Jan 0001 00:00:00 +0000

This page provides an overview of MinIO deployment architectures from a production perspective. For information on specific hardware or software configurations, see:

Distributed MinIO Deployments

A production MinIO deployment consists of at least 4 MinIO hosts with homogeneous storage and compute resources.

MinIO aggregates these resources together as a pool and presents itself as a single object storage service.

Each MinIO host in this pool has matching compute, storage, and network configurations

MinIO provides best performance when using locally-attached storage, such as NVMe or SSD drives attached to a PCI-E controller board on the host machine.

Drive Failure Recovery

Mon, 01 Jan 0001 00:00:00 +0000

MinIO supports hot-swapping failed drives with new healthy drives. MinIO detects and heals those drives without requiring any node or deployment-level restart. MinIO healing occurs only on the replaced drive(s) and in most cases has minimal or negligible impact on deployment performance.

MinIO healing ensures consistency and correctness of all data restored onto the drive.

Exclusive access to drives

MinIO requires exclusive access to the drives or volumes provided for object storage. No other processes, software, scripts, or persons should perform any actions directly on the drives or volumes provided to MinIO or the objects or files MinIO places on them.

Enable TLS for MinIO

Mon, 01 Jan 0001 00:00:00 +0000

MinIO supports Transport Layer Security (TLS) 1.2+ encryption of incoming and outgoing traffic.

The MinIO Operator supports the following approaches to enabling TLS on a MinIO Tenant:

Automatic TLS provisioning using Kubernetes Cluster Signing Certificates
User-specified TLS using Kubernetes secrets
Certmanager-managed TLS certificates

MinIO automatically detects TLS certificates in the configured or default directory and starts with TLS enabled.

Encrypting Files

Mon, 01 Jan 0001 00:00:00 +0000

Description

You can encrypt the output of the mc support inspect command for enhanced security when transmitting the files to MinIO SUBNET.

Encryption

You can choose to encrypt the output zip file for enhanced security with the --encrypt flag. MinIO provides a binary to decrypt the file.

When the encryption flag, the output provides a decryption key. The output resembles the following:

$ mc support inspect --encrypt play/test123/test*/*/part.*
mc: Encrypted file data successfully downloaded as inspect.ad2b43d8.enc
mc: Decryption key: ad2b43d847fdb14e54c5836200177f7158b3f745433525f5d23c0e0208e50c9948540b54

mc: The decryption key will ONLY be shown here. It cannot be recovered.
mc: The encrypted file can safely be shared without the decryption key.
mc: Even with the decryption key, data stored with encryption cannot be accessed.

As the output says, MinIO only displays the encryption key this one time, and it cannot be displayed or recovered later.

Hardware Checklist

Mon, 01 Jan 0001 00:00:00 +0000

Use the following checklist when planning the hardware configuration for a production, distributed MinIO deployment.

Considerations

When selecting hardware for your MinIO implementation, take into account the following factors:

Expected amount of data in tebibytes to store at launch
Expected growth in size of data for at least the next two years
Number of objects by average object size
Average retention time of data in years
Number of sites to be deployed
Number of expected buckets

License

Mon, 01 Jan 0001 00:00:00 +0000

Silo carries two separate licenses. The software and the documentation are distributed under different terms, and each inherits the license its upstream work already used.

What	License	Where
`silo` server	GNU AGPLv3	`pgsty/minio`
`mcli` client	GNU AGPLv3	`pgsty/mc`
This documentation	CC BY 4.0	`pgsty/silo-docs`

Software: AGPLv3

Silo is a fork of MinIO, which has been distributed under the GNU Affero General Public License v3.0 since 2021. That license is irrevocable for code already released under it — the legal basis on which this fork exists. Silo keeps the same license: no relicensing, no added restrictions, no open-core carve-outs.

Managing Your Deployment

Mon, 01 Jan 0001 00:00:00 +0000

You can use the MinIO Console to perform many of the deployment monitoring and management functions available in MinIO, such as:

Monitor the deployment activity and health by viewing a dashboard of metrics, server or audit logs, trace history, S3 events, or drive health.
Configure alerts by adding or managing a notification target.
Set up site replication to synchronize datacenters for timely access across geographically dispersed workforces or for disaster preparedness.
Configure deployment settings.

Important

mc admin accesskey create

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc admin accesskey create command adds a new access key and secret key pair for an existing MinIO user.

Access keys for OpenID Connect or AD/LDAP users

This command is for access keys for users created directly on the MinIO deployment and not managed by a third party solution.

To generate access keys for Active Directory/LDAP users, use mc idp ldap accesskey create.

The following command creates a new access key associated to an existing MinIO user:

mc admin cluster bucket import

Mon, 01 Jan 0001 00:00:00 +0000

Description

Added: RELEASE.2022-06-17T02-52-50Z

The mc admin cluster bucket import command imports bucket metadata as created by the mc admin cluster bucket export command.

You can use this command to manually restore the metadata to the specified bucket on a MinIO deployment.

If you specify only the deployment as the target, this command applies the metadata objects to all matching buckets on the target.

The following command imports the specified metadata to the myminio deployment.

mc admin cluster iam import

Mon, 01 Jan 0001 00:00:00 +0000

Description

Added: RELEASE.2022-06-17T02-52-50Z

The mc admin cluster iam import command imports IAM metadata as created by the mc admin cluster iam export command.

You can use this command to manually restore IAM metadata settings for a MinIO deployment.

Added: mc

RELEASE.2024-09-09T07-53-10Z

The command outputs the results of the import, including the following:

count of individual entities imported by entity type
list of policies imported by entity type they imported to
list of entities that failed to import

The following command imports the IAM metadata of the specified file onto the myminio deployment.

mc admin policy attach

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

Attaches one or more IAM policies to either a MinIO-managed user or a group.

Changed: RELEASE.2023-05-27T05-56-19Z

To successfully attach a policy, the referenced user or group must exist.

Exactly one --user or one --group is required.

The following command attaches the readonly policy to the user james on the deployment at alias myminio.

mc admin policy attach myminio readonly --user james

The command has the following syntax:

mc admin prometheus generate

Mon, 01 Jan 0001 00:00:00 +0000

Description

The mc admin prometheus generate command generates a metrics scraping configuration file for use with Prometheus.

For more complete documentation on using MinIO with Prometheus, see How to monitor MinIO server with Prometheus

Starting with MinIO Server RELEASE.2024-07-15T19-02-30Z and MinIO Client RELEASE.2024-07-11T18-01-28Z, metrics version 3 (v3) provides additional endpoints and metrics. To generate a v3 scrape configuration use the --api_version v3 option.

MinIO recommends new deployments use version 3 (v3). Existing deployments can continue to use metrics version 2

mc admin scanner status

Mon, 01 Jan 0001 00:00:00 +0000

Description

The mc admin scanner status command displays a real-time summary of scanner information for a MinIO Server.

This command has an alias of mc admin scanner info.

Use mc admin on MinIO Deployments Only

MinIO does not support using mc admin commands with other S3-compatible services, regardless of their claimed compatibility with MinIO deployments.

The following example returns information about the current state of the scanner process.

mc admin user add

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc admin user add command adds a new MinIO user to the target MinIO deployment.

To manage external Identity Provider users, see OIDC or AD/LDAP.

The following command creates a new user newuser on the myminio MinIO deployment:

mc admin user add myminio newuser newusersecret

The command has the following syntax:

mc admin user svcacct add

Mon, 01 Jan 0001 00:00:00 +0000

Important

This command has been replaced and will be deprecated in a future MinIO Client release.

As of MinIO Client RELEASE.2024-10-08T09-37-26Z, use the mc admin accesskey create command to add access keys for built-in MinIO IDP users.

To add access keys for AD/LDAP users, use the mc idp ldap accesskey create command.

Syntax

The mc admin user svcacct add command adds a new access key to an existing MinIO or AD/LDAP user.

mc alias list

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc alias list command lists all aliases in the local mc configuration.

The command output includes the configured access key and secret key associated to each alias.

The following command lists all aliases configured on the local host machine:

mc alias list

The mc alias list command has the following syntax:

mc anonymous set

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc anonymous set command sets anonymous (i.e. unauthenticated or public) access policies for a bucket.

Buckets with anonymous policies allow clients to access the bucket contents and perform actions consistent with the specified policy without authentication.

To set anonymous bucket policies using an IAM JSON policy, use the mc anonymous set-json command.

The following command sets anonymous access policies for several buckets on the myminio MinIO deployment:

mc batch cancel

Mon, 01 Jan 0001 00:00:00 +0000

Added: mc

RELEASE.2023-03-20T17-17-53Z

Syntax

The mc batch cancel stops an ongoing batch job.

You must specify the job ID. To find the job ID, use mc batch list.

The following command outputs the job definition for the job identified as KwSysDpxcBU9FNhGkn2dCf.

mc batch cancel myminio KwSysDpxcBU9FNhGkn2dCf

The command has the following syntax:

mc encrypt clear

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc encrypt clear command removes the current default encryption settings for a bucket.

The following command removes the default encryption settings for the mydata bucket on the MinIO deployment associated with the myminio alias:

mc encrypt clear myminio/mydata

The command has the following syntax:

mc [GLOBALFLAGS] encrypt clear ALIAS

Brackets [] indicate optional parameters.
Parameters sharing a line are mutually dependent.
Parameters separated using the pipe | operator are mutually exclusive.

Copy the example to a text editor and modify as-needed before running the command in the terminal/shell.

mc event add

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc event add command adds event notification triggers to a bucket.

MinIO automatically sends triggered events to the configured notification target.

The following command creates a new event notification trigger for all PUT and DELETE operations for the mydata bucket on the myminio MinIO deployment:

mc event add --event "put,delete" myminio/mydata arn:aws:sqs::primary:target

The specified ARN corresponds to a configured bucket notification target on the myminio deployment.

mc idp ldap accesskey disable

Mon, 01 Jan 0001 00:00:00 +0000

Description

mc idp ldap accesskey disable disables the specified access key on the MinIO deployment.

The following example disables the access key mykey on the minio deployment:

mc idp ldap accesskey disable minio mykey

The command has the following syntax:

mc [GLOBALFLAGS] idp ldap accesskey disable \
 ALIAS \
 KEY

Replace ALIAS with the alias of a MinIO deployment configured for AD/LDAP integration.

mc idp ldap add

Mon, 01 Jan 0001 00:00:00 +0000

Description

The mc idp ldap add command creates an AD/LDAP IDP server configuration.

MinIO supports no more than one (1) AD/LDAP provider per deployment.

The following example sets the AD/LDAP configuration settings for the myminio deployment.

mc idp ldap add \
 myminio \
 server_addr=myldapserver:636 \
 lookup_bind_dn=cn=admin,dc=min,dc=io \
 lookup_bind_password=somesecret \
 user_dn_search_base_dn=dc=min,dc=io \
 user_dn_search_filter="(uid=%s)" \
 group_search_base_dn=ou=swengg,dc=min,dc=io \
 group_search_filter="(&(objectclass=groupofnames)(member=%d))"

The command has the following syntax:

mc idp ldap policy attach

Mon, 01 Jan 0001 00:00:00 +0000

Description

The mc idp ldap policy attach command attaches one or more polices to an entity.

The following example attaches the policy userpolicy to the user bobfisher on the myminio deployment:

mc idp ldap policy attach myminio \
 userpolicy \
 --user='uid=bobfisher,ou=people,ou=hwengg,dc=min,dc=io'

The command has the following syntax:

mc [GLOBALFLAGS] idp ldap policy attach \
 POLICYNAME \
 [POLICY2] ... \
 ALIAS \
 [--user=`USER`] \
 [--group=`GROUP`]

Replace ALIAS with the alias of a MinIO deployment to configure for AD/LDAP integration.

mc ilm add

Mon, 01 Jan 0001 00:00:00 +0000

Changed: RELEASE.2022-12-24T15-21-38Z

mc ilm add replaced by mc ilm rule add.

Syntax

The mc ilm add command adds an object lifecycle management rule to a bucket.

The command supports adding both Transition (Tiering) and Expiration lifecycle management rules.

The following command adds new lifecycle management rules to the mydata bucket on the myminio deployment:

mc ilm add --expire-days 90 --noncurrent-expire-days 30 myminio/mydata

mc ilm add --expire-delete-marker myminio/mydata

mc ilm add --transition-days 30 --transition-tier "COLDTIER" myminio/mydata

mc ilm add --noncurrent-transition-days 7 --noncurrent-transition-tier "COLDTIER"

The configured rules have the following effect:

mc ilm restore

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc ilm restore command creates a temporary copy of an object archived on a remote tier. The copy automatically expires after 1 day by default.

Use this command to allow applications to access a tiered object through the MinIO deployment (e.g. “hot tier”). The archived object remains on the remote tier, while the temporary copy becomes HEAD for that object.

Added: mc

RELEASE.2023-04-12T02-21-51Z

Use mc stat to display whether a restored object reads from the local temporary copy or the remote tier. Objects currently in the process of restoration from the remote tier show a status of Ongoing : true.

mc ilm rule add

Mon, 01 Jan 0001 00:00:00 +0000

Changed: RELEASE.2022-12-24T15-21-38Z

mc ilm rule rm replaces mc ilm add.

Syntax

The mc ilm rule add command adds an object lifecycle management rule to a bucket.

The command supports adding both Transition (Tiering) and Expiration lifecycle management rules.

The following command adds new lifecycle management rules to the mydata bucket on the myminio deployment:

mc ilm tier add

Mon, 01 Jan 0001 00:00:00 +0000

Changed: RELEASE.2022-12-24T15-21-38Z

mc ilm tier add replaces mc admin tier add.

Description

The mc ilm tier add command creates a new remote storage tier to a supported storage services.

See Object Transition for a complete list.

Supported S3 Services

mc ilm tier add supports only the following S3-compatible services as a remote target for object tiering:

MinIO
Amazon S3
Google Cloud Storage
Azure Blob Storage

Permissions

MinIO requires the following administrative permissions on the cluster in which you create remote tiers for object transition lifecycle management rules:

mc legalhold clear

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc legalhold clear command removes the current legal hold setting for an object or objects.

Removing the legal hold on object(s) does not remove any other GOVERNANCE Mode and COMPLIANCE Mode retention settings in place for the object(s)

The following command removes the legal hold on all objects in the mydata bucket on the myminio MinIO deployment:

mc license info

Mon, 01 Jan 0001 00:00:00 +0000

Description

The mc license info command displays information about the MinIO deployment’s license status. Specifically, whether the deployment uses the AGPLv3 Open Source license of the MinIO Commercial License.

You must register your deployment with MinIO MinIO SUBNET to activate your commercial license.

For example, the command returns the following information for an unregistered deployment:

You are using GNU AFFERO GENERAL PUBLIC LICENSE Version 3 (https://www.gnu.org/licenses/agpl-3.0.txt)

If you are building proprietary applications, you may want to choose the commercial license
included as part of the Standard and Enterprise subscription plans. (https://min.io/signup?ref=mc)

Applications must otherwise comply with all the GNU AGPLv3 License & Trademark obligations.

Use mc license register to associate your deployment with your SUBNET account. If you are not already signed up for SUBNET, see the Registration page.

mc quota clear

Mon, 01 Jan 0001 00:00:00 +0000

Changed: RELEASE.2022-12-13T00-23-28Z

mc quota clear replaced mc admin bucket quota --clear.

Changed: RELEASE.2024-07-31T15-58-33Z

mc quota clear is deprecated.

Description

The mc quota clear command removes a configured storage quota for a bucket.

Examples

Clear Configured Bucket Quota

Use mc quota clear flag to remove the quota from a bucket.

mc quota clear TARGET/BUCKET

Replace TARGET with the alias of a configured MinIO deployment. Replace BUCKET with the name of the bucket on which to clear the quota.

Syntax

mc quota clear has the following syntax:

mc replicate add

Mon, 01 Jan 0001 00:00:00 +0000

Changed: RELEASE.2022-12-24T15-21-38Z

mc replicate add replaces the mc admin bucket remote add command.

MinIO automatically creates remote targets based on a given file path or resource location (such as an IP or DNS address). Users defining a remote target no longer need to determine an ARN for the remote bucket.

Syntax

The mc replicate add command creates a new server-side replication rule for a bucket on a MinIO deployment.

mc retention set

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc retention set command configures the Write-Once Read-Many (WORM) locking settings for an object or object(s) in a bucket. You can also set the default object lock settings for a bucket, where all objects without explicit object lock settings inherit the bucket default.

To lock an object under legal hold, use mc legalhold set.

mc retention set requires that the specified bucket has object locking enabled. You can only enable object locking at bucket creation. See mc mb --with-lock for documentation on creating buckets with object locking enabled.

mc share download

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc share download command generates a temporary presigned URL with integrated access credentials for downloading objects from a MinIO bucket. The temporary URL expires after a configurable time limit.

Applications can perform a GET to retrieve the object from the URL.
Users can open the URL in a browser to download the object.

For more information on shareable object URLs, see the Amazon S3 documentation on Pre-Signed URLs.

mc support callhome

Mon, 01 Jan 0001 00:00:00 +0000

Description

The mc support callhome command allows the enabling or disabling of diagnostic information from a deployment to MinIO SUBNET.

All mc support commands require an active SUBNET subscription.

When enabled, MinIO sends diagnostic information to SUBNET.

MinIO disables this functionality by default, regardless of registration status. You must explicitly enable the callhome function to begin information upload.

SUBNET Registration Required

The mc support commands are designed for MinIO deployments registered with MinIO SUBNET to ensure optimal outcome of diagnostics and performance testing. Deployments not registered with SUBNET cannot use the mc support commands.

mc support top api

Mon, 01 Jan 0001 00:00:00 +0000

SUBNET Registration Required

Syntax

The mc support top api command summarizes the real-time API events on a MinIO deployment server.

The following command displays the current in-progress S3 API calls on the alias myminio.

mc tag set

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc tag set command sets one or more tags to a bucket or object.

MinIO supports adding up to 10 custom tags to an object.

The following command sets tags for the mydata bucket on the myminio MinIO deployment:

mc tag set myminio/mydata "tag1=value1&tag2=value2"

The command has the following syntax:

mc version enable

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc version enable command enables versioning on the specified bucket.

The following command enables versioning for the mybucket bucket on the myminio MinIO deployment:

 mc version enable myminio/mybucket

The command has the following syntax:

mc [GLOBALFLAGS] version enable ALIAS \
 --exclude-folders \
 --excluded-prefixes

Brackets [] indicate optional parameters.
Parameters sharing a line are mutually dependent.
Parameters separated using the pipe | operator are mutually exclusive.

Copy the example to a text editor and modify as-needed before running the command in the terminal/shell.

MinIO Client Settings

Mon, 01 Jan 0001 00:00:00 +0000

This page covers settings for the MinIO Client.

You can establish or modify settings by defining:

an environment variable on the host system prior to starting or restarting the MinIO Server. Refer to your operating system’s documentation for how to define an environment variable.
a configuration setting using mc admin config set.

If you define both an environment variable and the similar configuration setting, MinIO uses the environment variable value.

Some settings have only an environment variable or a configuration setting, but not both.

MinIO Custom Resource Definition

Mon, 01 Jan 0001 00:00:00 +0000

The MinIO Operator installs a Custom Resource Definition (CRD) that describes a MinIO Tenant object. The Operator uses this CRD for provisioning and managing Tenant resources within a Kubernetes cluster.

This page documents the CRD reference for use in customizing Operator-deployed Tenants. This documentation assumes familiarity with all referenced Kubernetes concepts, utilities, and procedures.

Operator CRD v2 Reference

Package v2 - This page provides a quick automatically generated reference for the MinIO Operator Operator CRD v2 Reference CRD. For more complete documentation on the MinIO Operator CRD, see MinIO Kubernetes Documentation.

Monitoring and Alerting using Prometheus

Mon, 01 Jan 0001 00:00:00 +0000

MinIO publishes cluster, node, bucket, and resource metrics using the Prometheus Data Model. The procedure on this page documents the following:

Configuring a Prometheus service to scrape and display metrics from a MinIO deployment
Configuring an Alert Rule on a MinIO Metric to trigger an AlertManager action

These instructions use version 2 metrics. For more about metrics API versions, see Metrics and alerts.

Publish Events to AMQP (RabbitMQ)

Mon, 01 Jan 0001 00:00:00 +0000

MinIO supports publishing bucket notification events to a AMQP 0-9-1 service endpoint such as RabbitMQ.

MinIO relies on the https://github.com/streadway/amqp project for AMQP connectivity. The project is primarily tested against RabbitMQ deployments, though other AMQP 0-9-1-compatible services may also work. The procedures on this page assume a RabbitMQ deployment using the AMQP 0-9-1 protocol as the service endpoint.

Add an AMQP Endpoint to a MinIO Deployment

The following procedure adds a new AMQP service endpoint for supporting bucket notifications in a MinIO deployment.

Requirements to Set Up Bucket Replication

Mon, 01 Jan 0001 00:00:00 +0000

Bucket replication uses rules to synchronize the contents of a bucket on one MinIO deployment to a bucket on a remote MinIO deployment.

Replication can be done in any of the following ways:

Active-Passive Eligible objects replicate from the source bucket to the remote bucket. Any changes on the remote bucket do not replicate back.
Active-Active Changes to eligible objects of either bucket replicate to the other bucket in a two-way direction.
Multi-Site Active-Active Changes to eligible objects on any bucket set up for bucket replication replicate to all of the other buckets.

Ensure you meet the following prerequisites before you set up any of these replication configurations.

Server-Side Encryption with Per-Bucket Keys (SSE-KMS)

Mon, 01 Jan 0001 00:00:00 +0000

MinIO Server-Side Encryption (SSE) protects objects as part of write operations, allowing clients to take advantage of server processing power to secure objects at the storage layer (encryption-at-rest). SSE also provides key functionality to regulatory and compliance requirements around secure locking and erasure.

MinIO SSE uses the MinIO Key Encryption Service (KES) and a supported external Key Management Service (KMS) for performing secured cryptographic operations at scale. MinIO also supports client-managed key management, where the application takes full responsibility for creating and managing encryption keys for use with MinIO SSE.

Server-Side Object Encryption with KES

Mon, 01 Jan 0001 00:00:00 +0000

This procedure assumes you have access to a Kubernetes cluster with an active MinIO Operator installation. For instructions on running KES, see the KES docs.

As part of this procedure, you will:

Create or modify a MinIO deployment with support for SSE using KES. Defer to the Deploy Distributed MinIO tutorial for guidance on production-ready MinIO deployments.
Use the MinIO Operator Console to create or manage a MinIO Tenant.
Access the Encryption settings for that tenant and configure SSE using a supported Key Management System.
Create a new EK for use with SSE.
Configure automatic bucket-default SSE-KMS.

This procedure provides guidance for deploying MinIO configured to use KES and enable Server Side Encryption. For instructions on running KES, see the KES docs.

Transition Objects to Remote MinIO Deployment

Mon, 01 Jan 0001 00:00:00 +0000

The procedure on this page creates a new object lifecycle management rule that transitions objects from a bucket on a primary MinIO deployment to a bucket on a remote MinIO deployment. This procedure supports cost-management strategies such as tiering objects from a “hot” MinIO deployment using NVMe storage to a “warm” MinIO deployment using SSD.

Requirements

Install and Configure `mc`

This procedure uses mc for performing operations on the MinIO cluster. Install mc on a machine with network access to both source and destination clusters. See the mc Installation Quickstart for instructions on downloading and installing mc.

User Management

Mon, 01 Jan 0001 00:00:00 +0000

Overview

A MinIO user consists of a unique access key (username) and corresponding secret key (password). Clients must authenticate their identity by specifying both a valid access key (username) and the corresponding secret key (password) of an existing MinIO user.

Each user can have one or more assigned policies that explicitly list the actions and resources to which that user has access. Users can also inherit policies from the groups in which they have membership.

Using MinIO with Veeam

Mon, 01 Jan 0001 00:00:00 +0000

When using Veeam Backup and Replication, you can use S3 compatible object storage such as MinIO as a capacity tier for backups. This disaggregates storage for the Veeam infrastructure and allows you to retain control of your data. With the ease of use of setup and administration of MinIO, it allows a Veeam backup admin to easily deploy their own object store for capacity tiering.

Prerequisites

One or both of Veeam Backup and Replication with support for S3 compatible object store (e.g. 9.5.4) and Veeam Backup for Office365 (VBO)
MinIO object storage set up per https://silo.pigsty.io/index.html#procedure
Veeam requires TLS connections to the object storage. This can be configured per https://silo.pigsty.io/operations/network-encryption.html
The S3 bucket, Access Key and Secret Key have to be created before and outside of Veeam.
Configure the MinIO Client for the Veeam MinIO endpoint - https://silo.pigsty.io/reference/minio-mc.html

Setting up an S3 compatible object store for Veeam Backup and Replication

Create a bucket for Veeam backups

Create a bucket for Veeam Backup, e.g.,

SILO 20260417 Released

Fri, 17 Apr 2026 00:00:00 +0000

Published: 2026-04-17 · Version: RELEASE.2026-04-17T00-00-00Z

This release focuses on security hardening and compatibility tightening. It bundles fixes across OIDC, LDAP STS, S3 Select, replication metadata handling, unsigned-trailer flows, the Snowball upload path, and multiple dependency- and Go toolchain-related security issues, while also incorporating the LDAP TLS regression fix and a cleanup of community-fork documentation.

Major Changes

Tighten the identity-authentication flow: OIDC / WebIdentity now accepts only asymmetrically signed ID Token values backed by the IdP JWKS; symmetrically signed tokens such as HS256 are no longer accepted. LDAP STS also now hides the distinction between unknown-user and bad-password failures to reduce username-enumeration risk.
Update LDAP STS rate limiting: limits now apply to both source IP and normalized username, and successful requests no longer consume quota incorrectly. By default MinIO now uses only the socket peer address as the source and no longer trusts X-Forwarded-For, X-Real-IP, or Forwarded; to rate-limit by real client IP, configure MINIO_IDENTITY_LDAP_STS_TRUSTED_PROXIES explicitly.
Make upload and write paths stricter: presigned query parameters can no longer be combined with unsigned-trailer PUT or multipart uploads. Snowball auto-extract now also performs full signature validation on the unsigned-trailer path and rejects anonymous or forged-signature requests.
Prevent replication metadata spoofing: internal X-Minio-Replication-* headers attached to ordinary PUT / COPY requests are now rejected or ignored, and only trusted replication flows may write the related internal metadata.
Clarify S3 Select error semantics: oversized CSV and line-delimited JSON records now return OverMaxRecordSize directly instead of the generic InternalError; clients or alerting rules that depend on the old error code should be adjusted.
Upgrade the runtime and dependency baseline: fix the regression where ldaps:// did not correctly apply TLS settings, replace minio/pkg/v3 with pgsty/minio-pkg/v3, and pin several critical dependencies that are prone to breaking changes. The release also upgrades go-jose, go.opentelemetry.io, and Go 1.26.2 to unify the build and release baseline.
Refresh documentation and security guidance: update SECURITY.md, VULNERABILITY_REPORT.md, docs/sts/ldap.md, and related documents, add a security advisory index, and switch upstream minio/minio references in the security guidance over to pgsty/minio.

Fixed CVEs

CVE-2026-34986: upgrade go-jose to v4.1.4 and fix known security issues in the JWT / JOSE dependency chain.
CVE-2026-39883: upgrade the go.opentelemetry.io dependency stack to fix the PATH-hijacking risk.
CVE-2026-33322: restore the strict JWKS-only OIDC JWT verification path to block keyring injection and algorithm-confusion risk.
CVE-2026-33419: systematically harden LDAP STS authentication, rate limiting, source-address identification, and accounting logic across four follow-up fixes.
CVE-2026-34204: reject injection of X-Minio-Replication-* metadata by untrusted requests to prevent objects from being written with invalid replication state.
CVE-2026-39414: reject oversized S3 Select records early to avoid continued buffering and parsing of abnormal inputs.
GHSA-hv4r-mvr4-25vw: close the unsigned-trailer query-auth bypass.
GHSA-9c4q-hq6p-c237: harden unsigned-trailer authentication and signature validation in Snowball auto-extract scenarios.
CVE-2026-32280, CVE-2026-32281, and CVE-2026-32283: upgrade Go to 1.26.2 and absorb the upstream toolchain and stdlib security fixes.

c878ca0: fix: pin deps with breaking changes and fix LDAP TLS regression (#15)
e970ec5: fix: upgrade go-jose to v4.1.4 to patch CVE-2026-34986
a206510: fix: CVE-2026-39883 upgrade go.opentelemetry.io
fd65f11: merge: PR #18 upgrade go-jose to v4.1.4 for CVE-2026-34986
bc087e4: merge: PR #19 upgrade go.opentelemetry.io for CVE-2026-39883
f1f2239: fix: CVE-2026-33322 restore JWKS-only OIDC JWT verification
6619d0c: fix: CVE-2026-33419 harden LDAP STS auth
fcb8f24: fix: CVE-2026-34204 reject untrusted replication metadata
c5765dc: fix: CVE-2026-39414 reject oversized S3 Select records
fa7c579: fix: GHSA-hv4r-mvr4-25vw block unsigned-trailer query auth bypass
b50ab58: fix: GHSA-9c4q-hq6p-c237 harden Snowball unsigned-trailer auth
9a4b3cd: fix: CVE-2026-32280/CVE-2026-32281/CVE-2026-32283 upgrade Go to 1.26.2
c55b52c: fix: CVE-2026-33419 preserve LDAP STS rate limits on success
817a457: fix: CVE-2026-33419 harden LDAP STS rate-limit source IP
084a154: fix: CVE-2026-33419 tighten LDAP STS rate-limit accounting
16e34f9: docs: refresh security guidance and fork references

CVE-2026-33322: OIDC JWT Algorithm Confusion

Wed, 15 Apr 2026 00:00:00 +0000

Status: Released
First containing release: RELEASE.2026-04-17T00-00-00Z
Affected entry points: AssumeRoleWithWebIdentity, AssumeRoleWithClientGrants
GitHub issue: pgsty/minio#22

The old implementation placed the OIDC client secret in the JWT verifier keyring while also accepting HMAC signing methods. An attacker who knew that client secret could therefore mint an HS-signed token and exchange it through STS for temporary credentials. The final fix restored asymmetric, JWKS-only verification. It deliberately broke HS256/384/512 compatibility instead of keeping an option that would reintroduce ambiguous trust semantics.

MinIO Is Dead, Long Live MinIO

Sat, 14 Feb 2026 00:00:00 +0000

MinIO’s repo is officially archived and abandoned. And how AI Agents helped bring it back from the dead. This post explains how a community fork restores the admin console and ships binaries via CI/CD pipeline.

AssumeRoleWithLDAPIdentity

Mon, 01 Jan 0001 00:00:00 +0000

The MinIO Security Token Service (STS) AssumeRoleWithLDAPIdentity API endpoint generates temporary access credentials using Active Directory or LDAP user credentials. This page documents the MinIO server AssumeRoleWithLDAPIdentity endpoint. For instructions on implementing STS using an S3-compatible SDK, defer to the documentation for that SDK.

The MinIO STS AssumeRoleWithLDAPIdentity API endpoint is modeled after the AWS AssumeRoleWithWebIdentity endpoint and shares certain request/response elements. This page documents the MinIO-specific syntax and links out to the AWS reference for all shared elements.

Availability and Resiliency

Mon, 01 Jan 0001 00:00:00 +0000

This page provides an overview of MinIO’s availability and resiliency design and features from a production perspective.

Note

The contents of this page are intended as a best-effort guide to understanding MinIO’s intended design and philosophy behind availability and resiliency. It cannot replace the functionality of MinIO SUBNET, which allows for coordinating with MinIO Engineering when planning your MinIO deployments.

Community users can seek support on the MinIO Community Slack. Community Support is best-effort only and has no SLAs around responsiveness.

Batch Key Rotation

Mon, 01 Jan 0001 00:00:00 +0000

Added: MinIO

RELEASE.2023-04-07T05-28-58Z

The keyrotate batch job type cycles the sse-s3 or sse-kms keys for encrypted objects on a MinIO deployment.

cert-manager for Tenants

Mon, 01 Jan 0001 00:00:00 +0000

The following procedures create and apply the resources necessary to use cert-manager for the TLS certificates within a tenant.

Note

The procedures use tenant-1 as the name of the tenant.

Replace the string tenant-1 throughout the procedures to reflect the name of your tenant.

Prerequisites

kustomize installed
kubectl access to your k8s cluster
Completed the steps to set up cert-manager
The MinIO Operator installed and set up for cert-manager.

1) Create the tenant namespace CA Issuer

Before deploying a new tenant, create a Certificate Authority and Issuer for the tenant’s namespace.

Configure MinIO for Authentication using Keycloak

Mon, 01 Jan 0001 00:00:00 +0000

Overview

This procedure configures MinIO to use Keycloak as an external IDentity Provider (IDP) for authentication of users via the OpenID Connect (OIDC) protocol.

This page has procedures for configuring OIDC for MinIO deployments in Kubernetes and Baremetal infrastructures.

Select the tab corresponding to your infrastructure to switch between instruction sets.

For MinIO Tenants deployed using the MinIO Kubernetes Operator, this procedure covers:

Core Settings

Mon, 01 Jan 0001 00:00:00 +0000

This page covers settings that control core behavior of the MinIO process.

You can establish or modify settings by defining:

an environment variable on the host system prior to starting or restarting the MinIO Server. Refer to your operating system’s documentation for how to define an environment variable.
a configuration setting using mc admin config set.

If you define both an environment variable and the similar configuration setting, MinIO uses the environment variable value.

Deploy a MinIO Tenant with Helm Charts

Mon, 01 Jan 0001 00:00:00 +0000

Overview

This procedure requires the Kubernetes cluster have a valid Operator deployment. You cannot use the MinIO Operator Tenant chart to deploy a Tenant independent of the Operator.

Deploy MinIO on Ubuntu Linux

Mon, 01 Jan 0001 00:00:00 +0000

This page documents deploying MinIO on Ubuntu Linux operating systems.

MinIO officially supports Ubuntu Long Term Support (LTS) releases in the Standard or Ubuntu Pro support phases of the Ubuntu life cycle. MinIO strongly recommends only those releases that include the Linux 5.X kernel and above for best performance. At the time of writing, that includes:

Ubuntu 24.04+ LTS (Noble Numbat) (Recommended)
Ubuntu 22.04+ LTS (Jammy Jellyfish)
Ubuntu 20.04+ LTS (Focal Fossa)
Ubuntu 18.04.5 LTS (Bionic Beaver) (Ubuntu Pro Only)

The above list assumes your organization has the necessary service contracts with Ubuntu to ensure end-to-end supportability throughout the release’s lifespan.

Disaggregated HDP Spark and Hive with MinIO

Mon, 01 Jan 0001 00:00:00 +0000

1. Cloud-native Architecture

Kubernetes manages stateless Spark and Hive containers elastically on the compute nodes. Spark has native scheduler integration with Kubernetes. Hive, for legacy reasons, uses YARN scheduler on top of Kubernetes.

All access to MinIO object storage is via S3/SQL SELECT API. In addition to the compute nodes, MinIO containers are also managed by Kubernetes as stateful containers with local storage (JBOD/JBOF) mapped as persistent local volumes. This architecture enables multi-tenant MinIO, allowing isolation of data between customers.

Elasticsearch Notification Settings

Mon, 01 Jan 0001 00:00:00 +0000

This page documents settings for configuring an Elasticsearch service as a target for Bucket Notifications. See Publish Events to Elasticsearch for a tutorial on using these settings.

You can establish or modify settings by defining:

an environment variable on the host system prior to starting or restarting the MinIO Server. Refer to your operating system’s documentation for how to define an environment variable.
a configuration setting using mc admin config set.

If you define both an environment variable and the similar configuration setting, MinIO uses the environment variable value.

Enable Multiple Domain TLS for MinIO

Mon, 01 Jan 0001 00:00:00 +0000

MinIO supports Transport Layer Security (TLS) 1.2+ encryption of incoming and outgoing traffic.

The MinIO Operator supports the following approaches to enabling TLS on a MinIO Tenant:

Automatic TLS provisioning using Kubernetes Cluster Signing Certificates
User-specified TLS using Kubernetes secrets
Certmanager-managed TLS certificates

The MinIO Operator supports attaching user-specified TLS certificates when deploying or modifying the MinIO Tenant.

Enable One-Way Server-Side Bucket Replication

Mon, 01 Jan 0001 00:00:00 +0000

The procedure on this page creates a new bucket replication rule for one-way synchronization of objects from one MinIO bucket to another MinIO bucket. The buckets can be on the same MinIO deployment or on separate MinIO deployments.

To configure two-way “active-active” replication between MinIO buckets, see Enable Two-Way Server-Side Bucket Replication.
To configure multi-site “active-active” replication between MinIO deployments, see Enable Multi-Site Server-Side Bucket Replication

Note

Group Management

Mon, 01 Jan 0001 00:00:00 +0000

Overview

A group is a collection of users. Each group can have one or more assigned policies that explicitly list the actions and resources to which group members are allowed or denied access.

For example, consider the following groups. Each group is assigned a built-in policy or supported policy action. Each group also has one or more assigned users. Each user’s total set of permissions consists of their explicitly assigned permission and the inherited permissions from each of their assigned groups. MinIO by default denies access to any resource or operation not explicitly allowed by a user’s assigned or inherited policies.

Managing Objects

Mon, 01 Jan 0001 00:00:00 +0000

You can use the MinIO Console to perform several of the bucket and object management and interaction functions available in MinIO. Depending on the permissions and IAM policies for the authenticated user, you can:

Browse, upload, revert, manage, and interact with objects.
Browse, create, and manage buckets.
Create or monitor remote tiers for object transition rules.

Object Browser

The Object Browser lists the buckets and objects the authenticated user has access to on the deployment.

mc admin accesskey disable

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc admin accesskey disable command disables an existing access key for a MinIO IDP user.

The following command disables the specified access key:

mc admin accesskey disable myminio myuserserviceaccount

The command has the following syntax:

mc [GLOBALFLAGS] admin accesskey disable \
 ALIAS \
 SERVICEACCOUNT

Brackets [] indicate optional parameters.
Parameters sharing a line are mutually dependent.
Parameters separated using the pipe | operator are mutually exclusive.

Copy the example to a text editor and modify as-needed before running the command in the terminal/shell.

mc admin cluster bucket export

Mon, 01 Jan 0001 00:00:00 +0000

Description

Added: RELEASE.2022-06-17T02-52-50Z

The mc admin cluster bucket export command exports bucket metadata for use with the mc admin cluster bucket import command.

You can use this command to manually back up the metadata for the specified MinIO bucket. The command always saves the output as cluster-metadata.zip.

If you specify only the deployment as the target, this command backs up all bucket metadata on the target deployment.

The following command exports all bucket metadata for the myminio deployment.

mc admin cluster iam export

Mon, 01 Jan 0001 00:00:00 +0000

Description

Added: RELEASE.2022-06-26T18-51-48Z

The mc admin cluster iam export command exports IAM metadata for use with the mc admin cluster iam import command.

The command saves the output as ALIAS-iam-metadata.zip, where ALIAS is the alias of the MinIO deployment.

The following command exports all IAM metadata for the myminio deployment.

mc admin cluster iam export myminio

The command has the following syntax:

mc admin policy create

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

Creates a new policy on the target MinIO deployment.

MinIO deployments include the following built-in policies by default:

Consider the following JSON policy document saved at a file called /tmp/listmybuckets.json:

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "s3:ListAllMyBuckets"
 ],
 "Resource": [
 "arn:aws:s3:::*"
 ]
 }
 ]
}

The following command creates a new policy called listmybuckets on the alias myminio using the policy found at the file /tmp/listmybuckets.json.

mc admin prometheus metrics

Mon, 01 Jan 0001 00:00:00 +0000

Description

The mc admin prometheus metrics command prints Prometheus metrics for a cluster.

The output includes additional information about each metric, such as if its value is a counter or gauge.

For more complete documentation on using MinIO with Prometheus, see How to monitor MinIO server with Prometheus

Starting with MinIO Server RELEASE.2024-07-15T19-02-30Z and MinIO Client RELEASE.2024-07-11T18-01-28Z, metrics version 3 (v3) provides additional endpoints and metrics. To print v3 metrics use the --api_version v3 option.

mc admin scanner trace

Mon, 01 Jan 0001 00:00:00 +0000

Description

The mc admin scanner trace command displays scanner-specific API operations occurring on the target MinIO deployment.

Use mc admin on MinIO Deployments Only

MinIO does not support using mc admin commands with other S3-compatible services, regardless of their claimed compatibility with MinIO deployments.

The following example returns a list of API operations related to the scanner on the myminio deployment.

mc admin user disable

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc admin user disable command disables a MinIO user on the target MinIO deployment.

Clients cannot use the user credentials to authenticate to the MinIO deployment. Disabling a user does not remove that user from the deployment. Use mc admin user enable to enable a disabled user on a MinIO deployment.

To manage external Identity Provider users, see OIDC or AD/LDAP.

The following command disables user myuser on the myminio MinIO deployment:

mc admin user svcacct disable

Mon, 01 Jan 0001 00:00:00 +0000

Important

This command has been replaced and will be deprecated in a future MinIO Client release.

As of MinIO Client RELEASE.2024-10-08T09-37-26Z, use the mc admin accesskey disable command to disable an access key for a built-in MinIO IDP user.

To disable access keys for AD/LDAP users, use the mc idp ldap accesskey disable command.

Syntax

The mc admin user svcacct disable command disables an existing access key.

The following command disables the specified access key:

mc alias remove

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc alias remove removes an existing alias from the local mc configuration.

The following command removes the myminio alias for a MinIO deployment from the host machine:

mc alias remove myminio

The mc alias remove command has the following syntax:

mc [GLOBALFLAGS] alias remove ALIAS

Brackets [] indicate optional parameters.
Parameters sharing a line are mutually dependent.
Parameters separated using the pipe | operator are mutually exclusive.

Copy the example to a text editor and modify as-needed before running the command in the terminal/shell.

mc anonymous get

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc anonymous get command gets the anonymous (i.e. unauthenticated or public) access policies for a bucket.

Buckets with anonymous policies allow clients to access the bucket contents and perform actions consistent with the specified policy without authentication.

To get the JSON policy assigned to the bucket, use the mc anonymous get-json command.

The following command retrieves the anonymous access policy for the mydata bucket on the myminio MinIO deployment:

mc batch describe

Mon, 01 Jan 0001 00:00:00 +0000

Changed: MinIO

RELEASE.2022-10-08T20-11-00Z or later

Syntax

The mc batch describe command outputs the job definition for a specified job ID.

You must specify the job ID. To find the job ID, use mc batch list.

The following command outputs the job definition for the job identified as KwSysDpxcBU9FNhGkn2dCf.

mc batch describe myminio KwSysDpxcBU9FNhGkn2dCf

The command has the following syntax:

mc encrypt info

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc encrypt info command returns the current default encryption settings for a bucket.

The following command returns the default encryption setting for the mydata bucket on the myminio MinIO deployment.

mc encrypt info myminio/mydata

The command has the following syntax:

mc [GLOBALFLAGS] encrypt info ALIAS

Brackets [] indicate optional parameters.
Parameters sharing a line are mutually dependent.
Parameters separated using the pipe | operator are mutually exclusive.

Copy the example to a text editor and modify as-needed before running the command in the terminal/shell.

mc event ls

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc event ls command lists all event notification triggers for a bucket.

The alias mc event list has equivalent functionality to mc event ls.

The following command lists all configured event notifications for the specified bucket notification target for the mydata bucket on the myminio MinIO deployment:

mc event ls myminio myminio/mydata arn:aws:sqs::primary:target

The command has the following syntax:

mc idp ldap accesskey edit

Mon, 01 Jan 0001 00:00:00 +0000

Description

mc idp ldap accesskey edit modifies the specified access key on the local server.

The following example modifies the secret for the access key mykey on the minio deployment:

mc idp ldap accesskey edit myminio/ mykey --secret-key 'xxxxxxx'

The command has the following syntax:

mc [GLOBALFLAGS] idp ldap accesskey rm \
 ALIAS \
 KEY \
 [--secret-key <string>] \
 [--policy <string>] \
 [--name <string>] \
 [--description <string>] \
 [--expiry-duration <string>] \
 [--expiry <string>]

Replace ALIAS with the alias of a MinIO deployment configured for AD/LDAP integration.

mc idp ldap disable

Mon, 01 Jan 0001 00:00:00 +0000

Description

The mc idp ldap disable command disables the currently configured AD/LDAP provider.

The following example disables the AD/LDAP configurations on the myminio deployment.

mc idp ldap disable \
 myminio

The command has the following syntax:

mc [GLOBALFLAGS] idp ldap disable \
 ALIAS

Replace ALIAS with the alias of a MinIO deployment to disable the AD/LDAP integration.

mc idp ldap policy detach

Mon, 01 Jan 0001 00:00:00 +0000

Description

The mc idp ldap policy detach command detaches one or more polices from an entity.

The following example detaches the policy userpolicy from the user bobfisher on the myminio deployment.

mc idp ldap policy detach myminio \
 userpolicy \
 --user='uid=bobfisher,ou=people,ou=hwengg,dc=min,dc=io'

The command has the following syntax:

mc [GLOBALFLAGS] idp ldap policy detach \
 POLICYNAME \
 [POLICY2] ... \
 ALIAS \
 [--user=`USER`] \
 [--group=`GROUP`]

Replace ALIAS with the alias of a MinIO deployment to configure for AD/LDAP integration.

mc ilm edit

Mon, 01 Jan 0001 00:00:00 +0000

Changed: RELEASE.2022-12-24T15-21-38Z

mc ilm edit replaced by mc ilm rule edit.

Syntax

The mc ilm edit command modifies an existing object lifecycle management rule on a MinIO bucket.

The following command modifies existing lifecycle management rules for the mydata bucket on the myminio deployment:

mc ilm edit --id "c79ntj94b0t6rukh6lr0" --expiry-days 90 mydata/myminio

mc ilm edit --id "c79nu2p4b0t6qko19rgg" --expired-object-delete-marker mydata/myminio

mc ilm edit --id "c79n19dn10dnab109fg1" --transition-days 30 --tier "COLDTIER"

The command modifies the specified rules as follows:

mc ilm rule edit

Mon, 01 Jan 0001 00:00:00 +0000

Changed: RELEASE.2022-12-24T15-21-38Z

mc ilm rule edit replaces mc ilm edit.

Syntax

The mc ilm rule edit command modifies an existing object lifecycle management rule on a MinIO bucket.

The following command modifies existing lifecycle management rules for the mydata bucket on the myminio deployment:

mc ilm rule edit --id "c79ntj94b0t6rukh6lr0" --expiry-days 90 myminio/mydata

mc ilm rule edit --id "c79nu2p4b0t6qko19rgg" --expired-object-delete-marker myminio/mydata

mc ilm rule edit --id "c79n19dn10dnab109fg1" --transition-days 30 --tier "COLDTIER"

The command modifies the specified rules as follows:

mc ilm tier check

Mon, 01 Jan 0001 00:00:00 +0000

Description

The mc ilm tier check command displays the configuration for remote tier on a deployment.

Syntax

The command has the following syntax:

The following example displays the configuration for an existing remote tier called WARM-TIER on the myminio deployment.

 mc ilm tier check myminio WARM-TIER

The command has the following syntax:

mc legalhold info

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc legalhold info command returns the current legal hold setting for an object or objects.

mc legalhold requires that the specified bucket has object locking enabled. You can only enable object locking at bucket creation. See mc mb --with-lock for documentation on creating buckets with object locking enabled.

The following command retrieves the current legalhold status for objects in the mydata bucket on the myminio MinIO deployment:

mc license register

Mon, 01 Jan 0001 00:00:00 +0000

Important

mc license register requires MinIO Client version RELEASE.2023-11-20T16-30-59Z or later. While not strictly required, best practice keeps the MinIO Client version in alignment with the MinIO Server version.

Description

The mc license register command connects your deployment with your MinIO SUBNET account.

After registration, you can upload deployment health reports directly to SUBNET using the mc support diag command.

The following example registers the minio alias with MinIO SUBNET:

mc quota info

Mon, 01 Jan 0001 00:00:00 +0000

Changed: RELEASE.2022-12-13T00-23-28Z

mc quota info replaced mc admin bucket quota.

Changed: RELEASE.2024-07-31T15-58-33Z

mc quota info is deprecated.

Description

The mc quota info command displays the currently configured quota for a bucket.

Examples

Retrieve Bucket Quota Configuration

Use mc quota info to retrieve the current quota configuration for a bucket:

mc quota info TARGET/BUCKET

Replace TARGET with the alias of a configured MinIO deployment. Replace BUCKET with the name of the bucket on which to retrieve the quota.

mc replicate backlog

Mon, 01 Jan 0001 00:00:00 +0000

Changed: mc.RELEASE.2023-07-18T21-05-38Z

mc replicate diff has been renamed mc replicate backlog. No functionality has changed.

Description

The mc replicate backlog shows a list of unreplicated new or deleted objects.

You can list the replication status of objects for a particular remote target. To do so, you must have the ARN of the remote target. You can use retrieve the remote targets configured for a bucket to find the ARN.

mc retention info

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc retention info command configures the Write-Once Read-Many (WORM) locking settings for an object or object(s) in a bucket. You can also set the default object lock settings for a bucket, where all objects without explicit object lock settings inherit the bucket default.

To lock an object under legal hold, use mc legalhold set.

mc retention info requires that the specified bucket has object locking enabled. You can only enable object locking at bucket creation. See mc mb --with-lock for documentation on creating buckets with object locking enabled.

mc share upload

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc share upload command generates a temporary presigned URL with integrated access credentials for uploading objects to a MinIO bucket. The temporary URL expires after a configurable time limit.

Applications can perform a PUT to upload an object using the URL.

For more information on shareable object URLs, see the Amazon S3 documentation on Pre-Signed URLs.

The following command generates a new presigned upload URL for the mydata bucket on the myminio MinIO deployment:

mc support diag

Mon, 01 Jan 0001 00:00:00 +0000

SUBNET Registration Required

Command History

The command used to create the diagnostic report has changed over time.

MinIO Client Release	Command	Notes
RELEASE.2022-02-13T23-26-13Z	`mc support diag`	Command moved to `mc support`
RELEASE.2020-11-17T00-39-14Z	`mc admin subnet health`	Command made a SUBNET subcommand
RELEASE.2020-10-03T02-54-56Z	`mc admin health`	Command renamed to health
Original Command	`mc admin obd`	Command renamed `mc admin health`

Description

The mc support diag command generates a health report for a MinIO deployment.

mc support top locks

Mon, 01 Jan 0001 00:00:00 +0000

SUBNET Registration Required

Syntax

The mc support top locks command lists the ten oldest locks on a MinIO deployment.

The command outputs the age of the lock, type of lock, owner, and resource. The output resembles the following:

mc tag list

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc tag list command lists all tags from a bucket or object.

The following command lists tags for the mydata bucket on the myminio MinIO deployment:

mc tag list myminio/mydata

The command has the following syntax:

mc [GLOBALFLAGS] tag set \
 [--rewind "string"] \
 [--versions] \
 [--version-id "string"]* \
 ALIAS

Brackets [] indicate optional parameters.
Parameters sharing a line are mutually dependent.
Parameters separated using the pipe | operator are mutually exclusive.

Copy the example to a text editor and modify as-needed before running the command in the terminal/shell.

mc version info

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc version info command returns the versioning status for the specified bucket.

The following command returns the versioning status for the mybucket bucket on the myminio MinIO deployment:

mc version info myminio/mybucket

The command has the following syntax:

mc [GLOBALFLAGS] version info ALIAS

Brackets [] indicate optional parameters.
Parameters sharing a line are mutually dependent.
Parameters separated using the pipe | operator are mutually exclusive.

Copy the example to a text editor and modify as-needed before running the command in the terminal/shell.

MinIO Object Locking

Mon, 01 Jan 0001 00:00:00 +0000

Overview

MinIO Object Locking (“Object Retention”) enforces Write-Once Read-Many (WORM) immutability to protect versioned objects from deletion. MinIO supports both duration based object retention and indefinite legal hold retention.

MinIO Object Locking provides key data retention compliance and meets SEC17a-4(f), FINRA 4511(C), and CFTC 1.31(c)-(d) requirements as per Cohasset Associates.

Bucket Without LockingMinIO versioning preserves the full history of object mutations. However, applications can explicitly delete specific object versions.

Bucket With LockingApplying a default 30 Day WORM lock to objects in the bucket ensures a minimum period of retention and protection for all object versions.

Delete Operations in Locked BucketDelete operations follow normal behavior in versioned buckets, where MinIO creates a DeleteMarker for the object. However, non-Delete Marker versions of the object remain under the retention rules and are protected from any specific deletion or overwrite attempts.

Versioned Delete Operations in Locked BucketMinIO blocks any attempt to delete a specific object version held under WORM lock. The earliest possible time after which a client may delete the version is when the lock expires.

MinIO object locking is feature and API compatible with AWS S3. This page summarizes Object Locking / Retention concepts as implemented by MinIO. See the AWS S3 documentation on How S3 Object Lock works for additional resources.

MinIO Operator Environment Variables

Mon, 01 Jan 0001 00:00:00 +0000

The MinIO Operator uses the following environment variables during startup to set configuration settings. Configure these variables in the minio-operator container.

Setting Environment Variables in Kubernetes

To set these environment variables, modify the operator container’s yaml at .spec.env or use the following kubectl command syntax:

kubectl set env -n minio-operator deployment/minio-operator <ENV_VARIABLE>=<value> ... <ENV_VARIABLE2>=<value2>

Replace:

minio-operator with the namespace for your Operator, if not using the default value.
deployment/minio-operator with the deployment for your Operator, if not the default value. (Most deployments use the default value.)
<ENV_VARIABLE> with the environment variable to set or modify.
<value> with the value to use for the environment variable.

You can set or modify multiple environment variables by separating each VARIABLE=value pair with a space.

Monitoring and Alerting using InfluxDB

Mon, 01 Jan 0001 00:00:00 +0000

MinIO publishes cluster and node metrics using the Prometheus Data Model. InfluxDB supports scraping MinIO metrics data for monitoring and alerting.

The procedure on this page documents the following:

Configuring an InfluxDB service to scrape and display metrics from a MinIO deployment
Configuring an Alert on a MinIO metric

Prerequisites

This procedure requires the following:

An existing InfluxDB deployment configured with one or more notification endpoints
An existing MinIO deployment with network access to the InfluxDB deployment
An mc installation on your local host configured to access the MinIO deployment

These instructions use version 2 metrics. For more about metrics API versions, see Metrics and alerts.

Node Failure Recovery

Mon, 01 Jan 0001 00:00:00 +0000

If a MinIO node suffers complete hardware failure (e.g. loss of all drives, data, etc.), the node begins healing operations once it rejoins the deployment. MinIO healing occurs only on the replaced hardware and does not typically impact deployment performance.

MinIO healing ensures consistency and correctness of all data restored onto the drive.

Exclusive access to drives

OpenID Connect Access Management

Mon, 01 Jan 0001 00:00:00 +0000

MinIO supports using an OpenID Connect (OIDC) compatible IDentity Provider (IDP) such as Okta, KeyCloak, Dex, Google, or Facebook for external management of user identities.

For identities managed by the external OpenID Connect (OIDC) compatible provider, MinIO can use either of two methods to assign policies to the authenticated user.

Use the JSON Web Token claim returned as part of the OIDC authentication flow to identify the policies to assign to the authenticated user.
Use the RoleArn specified in the authorization request to assign the policies attached to the provider’s RolePolicy.

MinIO by default denies access to all actions or resources not explicitly allowed by a user’s assigned or inherited policies. Users managed by an OIDC provider must specify the necessary policies as part of the JWT claim. If the user JWT claim has no matching MinIO policies, that user has no permissions to access any action or resource on the MinIO deployment.

OpenID Identity Management Settings

Mon, 01 Jan 0001 00:00:00 +0000

This page documents settings for enabling external identity management using an OpenID Connect (OIDC)-compatible provider. See OpenID Connect Access Management for a tutorial on using these settings.

You can establish or modify settings by defining:

an environment variable on the host system prior to starting or restarting the MinIO Server. Refer to your operating system’s documentation for how to define an environment variable.
a configuration setting using mc admin config set.

If you define both an environment variable and the similar configuration setting, MinIO uses the environment variable value.

Publish Events to MQTT

Mon, 01 Jan 0001 00:00:00 +0000

MinIO supports publishing bucket notification events to MQTT server/broker endpoint.

Add an MQTT Endpoint to a MinIO Deployment

The following procedure adds a new MQTT service endpoint for supporting bucket notifications in a MinIO deployment.

Prerequisites

MQTT 3.1 or 3.1.1 Server/Broker

This procedure assumes an existing MQTT 3.1 or 3.1.1 server/broker to which the MinIO deployment has connectivity. See the mqtt.org software listing for a list of MQTT-compatible server/brokers.

If the MQTT service requires authentication, you must provide an appropriate username and password during the configuration process to grant MinIO access to the service.

Publish Server or Audit Logs to an External Service

Mon, 01 Jan 0001 00:00:00 +0000

MinIO publishes all minio server operations to the system console. Reading these logs depends on how the server process is managed. For example, if the server is managed through a systemd script, you can read the logs using journalctl -u SERVICENAME.service. Replace SERVICENAME with the name of the MinIO service.

MinIO also supports publishing server logs and audit logs to an HTTP webhook.

Server logs contain the same minio server operations logged to the system console. Server logs support general monitoring and troubleshooting of operations.
Audit logs are more granular descriptions of each operation on the MinIO deployment. Audit logging supports security standards and regulations which require detailed tracking of operations.

MinIO publishes logs as a JSON document as a PUT request to each configured endpoint. The endpoint server is responsible for processing each JSON document. MinIO requires explicit configuration of each webhook endpoint and does not publish logs to a webhook by default.

Security Checklist

Mon, 01 Jan 0001 00:00:00 +0000

Use the following checklist when planning the security configuration for a production, distributed MinIO deployment.

Required Steps

Define group policies either on MinIO or the selected 3rd party Identity Provider (LDAP/Active Directory or OpenID)

Server-Side Encryption Per-Deployment Key (SSE-S3)

Mon, 01 Jan 0001 00:00:00 +0000

MinIO SSE uses the MinIO Key Encryption Service (KES) and an external Key Management Service (KMS) for performing secured cryptographic operations at scale. MinIO also supports client-managed key management, where the application takes full responsibility for creating and managing encryption keys for use with MinIO SSE.

Site Replication Overview

Mon, 01 Jan 0001 00:00:00 +0000

Site replication configures multiple independent MinIO deployments as a cluster of replicas called peer sites.

A site replication deployment with two peer sites. A load balancer manages routing operations to either of the two sites. Data written to one site automatically replicates to the other peer site.

Site replication assumes the use of either the included MinIO identity provider (IDP) or an external IDP. All configured deployments must use the same IDP. Deployments using an external IDP must use the same configuration across sites.

Trademark Notice

Mon, 01 Jan 0001 00:00:00 +0000

Warning

Every appearance of the MinIO name in this documentation is descriptive use, and implies no commercial relationship.

Silo is a fork maintained independently by the PIGSTY community. It is not affiliated with, endorsed by, or sponsored by MinIO, Inc.

What the project does to avoid confusion

The fork is published under its own name, Silo, not under MinIO’s.
Every page of this site carries a trademark disclaimer in the footer.
It is labeled a community fork across every distribution channel — repositories, container images, release artifacts, and this documentation.
No claim of affiliation, endorsement, certification, or commercial relationship with MinIO, Inc. is ever made.

Why the name still appears in this documentation

A license grants rights in copyright; it says nothing about names. AGPLv3 gives anyone the right to fork and redistribute the MinIO codebase, but trademark law is a separate matter that a license does not settle.

Transition Objects from MinIO to S3

Mon, 01 Jan 0001 00:00:00 +0000

The procedure on this page creates a new object lifecycle management rule that transition objects from a MinIO bucket to a remote storage tier on the Amazon Web Services S3 storage backend or an S3-compatible service. This procedure supports use cases such as tiering objects to low-cost or archival storage after a certain time period or calendar date.

Requirements

Install and Configure `mc`

Upgrade a MinIO Deployment

Mon, 01 Jan 0001 00:00:00 +0000

Important

For deployments older than RELEASE.2024-03-30T09-41-56Z running with AD/LDAP enabled, you must read through the release notes for RELEASE.2024-04-18T19-09-19Z before starting this procedure. You must take the extra steps documented in the linked release as part of the upgrade.

MinIO uses an update-then-restart methodology for upgrading a deployment to a newer release:

Update the MinIO binary with the newer release.
Restart the deployment using mc admin service restart.

This procedure does not require taking downtime and is non-disruptive to ongoing operations.

Upgrade MinIO Operator

Mon, 01 Jan 0001 00:00:00 +0000

You can upgrade the MinIO Operator at any time without impacting your managed MinIO Tenants.

As part of the upgrade process, the Operator may update and restart Tenants to support changes to the MinIO Custom Resource Definition (CRD). These changes require no action on the part of any operator or administrator, and do not impact Tenant operations.

This page describes how to upgrade from Operator 5.0.15 to 7.1.1. See Upgrade MinIO Operator 4.5.8 and Later to 5.0.15 for instructions on upgrading to Operator 5.0.15 before starting this procedure.

CVE-2026-33419: LDAP STS Enumeration and the Throttling Chain

Wed, 15 Apr 2026 00:00:00 +0000

Status: Released, followed by two rounds of corrections
First containing release: RELEASE.2026-04-17T00-00-00Z
Complete correction: RELEASE.2026-06-18T00-00-00Z
GitHub issue: pgsty/minio#23

The core vulnerability was straightforward: LDAP STS returned different results for “user does not exist” and “password is wrong,” creating a username oracle. The first fix unified the external authentication failure and added limits by source IP and username. Continued review then showed that success refunds, spoofable source headers, reservation accounting, and the shared username bucket could turn the security control itself into a new attack surface.

SILO 20260325 Released

Wed, 25 Mar 2026 00:00:00 +0000

Published: 2026-03-25 · Version: RELEASE.2026-03-25T00-00-00Z

This is a maintenance release centered on packaging, stability, and security disclosure. It improves the shipping artifacts, fixes an LDAP TLS regression, and explicitly documents the secure dependency set carried by the release.

Major Changes

Bundle mcli/mc into the Docker image and add checksum verification for a better out-of-the-box image experience.
Fix the LDAP TLS regression affecting ldaps:// deployments so TLS settings are correctly honored.
Remove inherited upstream CI/CD workflows that are no longer used in the community-maintained fork.
Pin several critical dependencies to avoid further fallout from upstream breaking changes.

Fixed CVEs

CVE-2026-24051: the release notes explicitly call out go.opentelemetry.io/otel/sdk v1.42.0, which avoids the macOS PATH-hijacking arbitrary code execution issue.
CVE-2025-10543: the release notes explicitly ship github.com/eclipse/paho.mqtt.golang v1.5.1, fixing incorrect MQTT packet encoding for oversized UTF-8 strings.
CVE-2025-58181: the release notes explicitly ship golang.org/x/crypto v0.49.0, fixing unbounded memory consumption in ssh GSSAPI authentication handling.

f2f9a40: add mcli/mc from pgsty/mc to Docker image
ce1c537: fix: pin deps with breaking changes and fix LDAP TLS regression (#15)
ee55e53: remove upstream CI/CD workflows inherited from minio/minio

MinIO Is Dead. Which Next?

Mon, 08 Dec 2025 00:00:00 +0000

MinIO just entered maintenance mode. What replaces it? Can RustFS step in? I tested the contenders so you don’t have to.

Active Directory / LDAP Access Management

Mon, 01 Jan 0001 00:00:00 +0000

MinIO supports configuring a single Active Directory or LDAP (AD/LDAP) service for external management of user identities. Enabling AD/LDAP external identity management disables the MinIO internal IDP.

For identities managed by the external AD/LDAP provider, MinIO uses the user’s Distinguished Name and attempts to map it against an existing policy.

If the AD/LDAP configuration includes the necessary settings to query the user’s AD/LDAP group membership, MinIO also uses those group Distinguished Names and attempts to map each against an existing policy.

AssumeRoleWithWebIdentity

Mon, 01 Jan 0001 00:00:00 +0000

The MinIO Security Token Service (STS) AssumeRoleWithWebIdentity API endpoint generates temporary access credentials using a JSON Web Token (JWT) returned from a configured OpenID IDentity Provider (IDP). This page documents the MinIO server AssumeRoleWithWebIdentity endpoint. For instructions on implementing STS using an S3-compatible SDK, defer to the documentation for that SDK.

The MinIO STS AssumeRoleWithWebIdentity API endpoint is modeled after the AWS AssumeRoleWithWebIdentity endpoint and shares certain request/response elements. This page documents the MinIO-specific syntax and links out to the AWS reference for all shared elements.

Attribution

Mon, 01 Jan 0001 00:00:00 +0000

Copyright

Both layers apply at once. A translated or modified page carries MinIO’s copyright in the underlying expression and the Silo project’s copyright in the translation and the changes; neither replaces the other.

AWS CLI with MinIO Server

Mon, 01 Jan 0001 00:00:00 +0000

AWS CLI is a unified tool to manage AWS services. It is frequently the tool used to transfer data in and out of AWS S3. It works with any S3 compatible cloud storage service.

In this recipe we will learn how to configure and use AWS CLI to manage data with MinIO Server.

1. Prerequisites

Install MinIO Server from here.

2. Installation

Install AWS CLI from https://aws.amazon.com/cli/

3. Configuration

To configure AWS CLI, type aws configure and specify the MinIO key information.

Batch Expiration

Mon, 01 Jan 0001 00:00:00 +0000

Added: MinIO

RELEASE.2023-12-02T10-51-33Z

The expire batch job applies Automatic Object Expiration behavior to a single bucket. The job determines expiration eligibility based on the provided configuration, independent of any configured expiration rules.

Configure MinIO for Authentication using OpenID

Mon, 01 Jan 0001 00:00:00 +0000

Overview

MinIO supports using an OpenID Connect (OIDC) compatible IDentity Provider (IDP) such as Okta, KeyCloak, Dex, Google, or Facebook for external management of user identities.

This page has procedures for configuring OIDC for MinIO deployments in Kubernetes and Baremetal infrastructures.

This procedure covers:

Configuring a MinIO cluster for an external OIDC provider.
Using the MinIO AssumeRoleWithWebIdentity Security Token Service (STS) API to generate temporary credentials for use by applications.

This procedure is generic for OIDC compatible providers. Defer to the documentation for the OIDC provider of your choice for specific instructions or procedures on authentication and JWT retrieval.

Deploy MinIO as a Container

Mon, 01 Jan 0001 00:00:00 +0000

This page documents deploying MinIO as a Container onto any operating system that supports containerized processes.

This documentation assumes installation of Docker, Podman, or a similar runtime which supports the standard container image format. MinIO images use Red Hat Universal Base Image 9 Micro.

Functionality and performance of the MinIO container may be constrained by the base OS.

The procedure includes guidance for deploying Single-Node Multi-Drive (SNMD) and Single-Node Single-Drive (SNSD) topologies in support of early development and evaluation environments.

Enable Two-Way Server-Side Bucket Replication

Mon, 01 Jan 0001 00:00:00 +0000

The procedure on this page creates a new bucket replication rule for two-way “active-active” synchronization of objects between MinIO buckets.

To configure replication between arbitrary S3-compatible services, use mc mirror.
To configure one-way “active-passive” replication between MinIO clusters, see Enable One-Way Server-Side Bucket Replication.
To configure multi-site “active-active” replication between MinIO clusters, see Enable Multi-Site Server-Side Bucket Replication.

This tutorial covers configuring Active-Active replication between two MinIO clusters. For a tutorial on multi-site replication between three or more MinIO clusters, see Enable Multi-Site Server-Side Bucket Replication.

Erasure Coding

Mon, 01 Jan 0001 00:00:00 +0000

Overview of MinIO Erasure Coding

MinIO implements Erasure Coding as a core component in providing data redundancy and availability. This page provides an introduction to MinIO Erasure Coding.

See Availability and Resiliency and Deployment Architecture for more information on how MinIO uses erasure coding in production deployments.

Erasure Coding Basics

Note

The diagrams and content in this section present a simplified view of MinIO erasure coding operations and are not intended to represent the complexities of MinIO’s full erasure coding implementation.

Expand a Distributed MinIO Deployment

Mon, 01 Jan 0001 00:00:00 +0000

MinIO supports expanding an existing distributed deployment by adding a new Server Pool. Each Pool expands the total available storage capacity of the cluster.

Expansion does not provide Business Continuity/Disaster Recovery (BC/DR)-grade protections. While each pool is an independent set of servers with distinct erasure sets for availability, the complete loss of one pool results in MinIO stopping I/O for all pools in the deployment. Similarly, an erasure set which loses quorum in one pool represents data loss of objects stored in that set, regardless of the number of other erasure sets or pools.

Healthcheck API

Mon, 01 Jan 0001 00:00:00 +0000

MinIO exposes unauthenticated endpoints for probing node uptime and cluster high availability for simple healthchecks. These endpoints return an HTTP status code indicating whether the underlying resource is healthy or satisfies read/write quorum. MinIO exposes no other data through these endpoints.

Node Liveness

Use the following endpoint to test if a MinIO server is online:

curl -I https://minio.example.net:9000/minio/health/live

Replace https://minio.example.net:9000 with the DNS hostname of the MinIO server to check.

Kafka Notification Settings

Mon, 01 Jan 0001 00:00:00 +0000

This page documents settings for configuring an Kafka service as a target for Bucket Notifications. See Publish Events to Kafka for a tutorial on using these settings.

You can establish or modify settings by defining:

an environment variable on the host system prior to starting or restarting the MinIO Server. Refer to your operating system’s documentation for how to define an environment variable.
a configuration setting using mc admin config set.

If you define both an environment variable and the similar configuration setting, MinIO uses the environment variable value.

mc admin policy detach

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

Remove one or more IAM policies from either a MinIO-managed user or a group.

Exactly one --user or one --group is required.

The following command detaches the policy readonly from the user james on the deployment at alias myminio.

mc admin policy detach myminio readonly --user james

The command has the following syntax:

mc admin user accesskey edit

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc admin accesskey edit command modifies the configuration of an access key associated to the specified user.

The command requires that at least one attribute of the access key change. Otherwise, the command exits with an error message.

The following command applies a new policy and secret key to the myuserserviceaccount access key on the myminio deployment:

mc admin user enable

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc admin user enable command enables a MinIO user on the target MinIO deployment.

Clients can only use enabled users to authenticate to the MinIO deployment. Users created using mc admin user add are enabled by default.

To manage external Identity Provider users, see OIDC or AD/LDAP.

The following command enables user myuser on the myminio MinIO deployment:

mc admin user svcacct edit

Mon, 01 Jan 0001 00:00:00 +0000

Important

This command has been replaced and will be deprecated in a future MinIO Client release.

As of MinIO Client RELEASE.2024-10-08T09-37-26Z, use the mc admin accesskey edit command to modify access keys for built-in MinIO IDP users.

To modify access keys for AD/LDAP users, use the mc idp ldap accesskey edit command.

Syntax

The mc admin user svcacct edit command modifies the configuration of an access key associated to the specified user.

mc alias set

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc alias set command adds or updates an alias to the local mc configuration.

The following command adds an alias for a MinIO deployment myminio running at the URL https://myminio.example.net. mc uses the specified username and password for authenticating to the MinIO deployment:

mc alias set myminio https://myminio.example.net minioadminuser minioadminpassword

If the myminio alias already exists, the command overwrites that alias with the new URL, access key, and secret key.

mc anonymous list

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc anonymous list retrieves all anonymous (i.e. unauthenticated or public) access policies for a bucket.

Buckets with anonymous policies allow clients to access the bucket contents and perform actions consistent with the specified policy without authentication.

The following command lists all anonymous access policies for the mydata bucket on the myminio MinIO deployment:

mc batch generate

Mon, 01 Jan 0001 00:00:00 +0000

Changed: MinIO

RELEASE.2022-10-08T20-11-00Z or later

Syntax

The mc batch generate command creates a basic YAML-formatted template file for the specified job type.

After MinIO creates the file, open it in your preferred text editor tool to further customize. You can define one job task definition per batch file.

See job types for the supported jobs you can generate.

The following command creates a basic YAML file for a replicate job on the mybucket bucket of the myminio alias.

mc encrypt set

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc encrypt set encrypt command sets or updates the default bucket Server-Side Encryption (SSE) mode. MinIO automatically encrypts objects written to that bucket using the specified SSE mode.

mc encrypt set only supports SSE-KMS and SSE-S3.

The following command sets the default SSE-KMS encryption key for the bucket mydata on the myminio MinIO deployment:

mc encrypt set sse-kms "minio-encryption-key" myminio/mydata

The command has the following syntax:

mc event rm

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc event rm command removes an event notification trigger from a bucket.

The mc event remove command has equivalent functionality to mc event rm.

The following command removes a configured event notifications for the specified bucket notification target for the mydata bucket on the myminio MinIO deployment:

mc event rm myminio/mydata arn:aws:sqs::primary:target

The command has the following syntax:

mc idp ldap accesskey enable

Mon, 01 Jan 0001 00:00:00 +0000

Description

The mc idp ldap accesskey enable enables the specified access key on the local server.

The following example enables the access key mykey from the minio deployment:

mc idp ldap accesskey enable minio/ mykey

The command has the following syntax:

mc [GLOBALFLAGS] idp ldap accesskey enable \
 ALIAS \
 KEY

Replace ALIAS with the alias of a MinIO deployment configured for AD/LDAP integration.

mc idp ldap enable

Mon, 01 Jan 0001 00:00:00 +0000

Description

The mc idp ldap enable command enables the currently configured AD/LDAP provider.

The following example enables the AD/LDAP configurations on the myminio deployment.

mc idp ldap enable \
 myminio

The command has the following syntax:

mc [GLOBALFLAGS] idp ldap enable \
 ALIAS

Replace ALIAS with the alias of a MinIO deployment to enable the AD/LDAP integration.

mc idp ldap policy entities

Mon, 01 Jan 0001 00:00:00 +0000

Description

The mc idp ldap policy entities command displays a list of mappings for a user, group, and/or policy.

The following example lists all mappings for a specific policy, a set of groups, and a selection of users on the myminio deployment.

Specifically, it lists:

Users mapped to the finteam-policy policy.
Policies assigned to the uid=bobfisher,ou=people,ou=hwengg,dc=min,dc=io user.
Policies assigned to the cn=projectb,ou=groups,ou=swengg,dc=min,dc=io group.

mc idp ldap policy entities myminio \
 --policy finteam-policy \
 --user 'uid=bobfisher,ou=people,ou=hwengg,dc=min,dc=io' \
 --group 'cn=projectb,ou=groups,ou=swengg,dc=min,dc=io'

The command has the following syntax:

mc ilm export

Mon, 01 Jan 0001 00:00:00 +0000

Changed: RELEASE.2022-12-24T15-21-38Z

mc ilm export replaced by mc ilm rule export.

Syntax

The mc ilm export command exports the object lifecycle management configuration for a MinIO bucket.

The mc ilm export command outputs to STDOUT by default. You can output the contents to a .json file for archival or ingestion using mc ilm import.

The following command exports the lifecycle management configuration of the mydata bucket on the myminio deployment to the mydata-lifecycle-config.json file:

mc ilm rule export

Mon, 01 Jan 0001 00:00:00 +0000

Changed: RELEASE.2022-12-24T15-21-38Z

mc ilm rule export replaces mc ilm export.

Syntax

The mc ilm rule export command exports the object lifecycle management configuration for a MinIO bucket.

The mc ilm rule export command outputs to STDOUT by default. You can output the contents to a .json file for archival or ingestion using mc ilm rule import.

The following command exports the lifecycle management configuration of the mydata bucket on the myminio deployment to the mydata-lifecycle-config.json file:

mc ilm tier info

Mon, 01 Jan 0001 00:00:00 +0000

Description

The mc ilm tier info command outputs statistics about a tier or all tiers for a deployment.

Required Permissions

MinIO requires the following permissions scoped to to the bucket or buckets for which you are creating lifecycle management rules.

MinIO also requires the following administrative permissions on the cluster in which you are creating remote tiers for object transition lifecycle management rules:

For example, the following policy provides permission for configuring object transition lifecycle management rules on any bucket in the cluster:.

mc legalhold set

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc legalhold set command enables legal hold Write-Once Read-Many (WORM) object locking on an object or objects.

The following command enables legalhold WORM locking on all existing objects in the mydata bucket on the myminio MinIO deployment:

mc license update

Mon, 01 Jan 0001 00:00:00 +0000

Description

Use the mc license update command to replace a license key for a deployment.

For deployments registered for MinIO SUBNET, MinIO automatically checks for and updates the license every month.

Examples

Update the License Key for a Deployment with Alias `minio1`

mc license update minio1 license.key

Syntax

The command has the following syntax:

mc [GLOBALFLAGS] license update \
 ALIAS \
 [LICENSE-FILE-WITH-PATH] \
 [--airgap]

Parameters

`ALIAS`

mc-cmd

Required

The alias of the MinIO deployment.

mc quota set

Mon, 01 Jan 0001 00:00:00 +0000

Changed: RELEASE.2022-12-13T00-23-28Z

mc quota set replaced mc admin bucket quota --hard.

Changed: RELEASE.2024-07-31T15-58-33Z

mc quota set is deprecated.

Description

The mc quota set assigns a hard quota limit to a bucket beyond which MinIO does not allow writes.

Units of Measurement

The mc quota set --size flag accepts the following case-insensitive suffixes to represent the unit of the specified size value:

Suffix	Unit Size
`k`	KB (Kilobyte, 1000 Bytes)
`m`	MB (Megabyte, 1000 Kilobytes)
`g`	GB (Gigabyte, 1000 Megabytes)
`t`	TB (Terabyte, 1000 Gigabytes)
`ki` or `kib`	KiB (Kibibyte, 1024 Bites)
`mi` or `mib`	MiB (Mebibyte, 1024 Kibibytes)
`gi` or `gib`	GiB (Gibibyte, 1024 Mebibytes)
`ti` or `tib`	TiB (Tebibyte, 1024 Gibibytes)

Omitting a suffix defaults to bytes.

mc replicate ls

Mon, 01 Jan 0001 00:00:00 +0000

Changed: RELEASE.2022-12-24T15-21-38Z

mc replicate ls replaces the mc admin bucket remote ls command.

Syntax

The mc replicate ls command lists all replication rules on a MinIO bucket.

The mc replicate list command has equivalent functionality to mc replicate ls.

The following command lists all enabled replication rules for the mydata bucket on the myminio MinIO deployment:

mc retention clear

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc retention clear command removes the Write-Once Read-Many (WORM) locking settings for an object or object(s) in a bucket. You can also remove the default object lock settings for a bucket.

To change the retention status of an object under legal hold, use mc legalhold clear.

The following command removes the default object lock configuration for the mydata bucket on the myminio MinIO deployment:

mc share ls

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc share ls command displays any unexpired presigned URLs generated by mc share upload or mc share download

The mc share list command has equivalent functionality to mc share ls.

Applications can perform a PUT to retrieve the object from the URL.

For more information on shareable object URLs, see the Amazon S3 documentation on Pre-Signed URLs.

The following command lists all upload and download presigned URLs respectively for the mydata bucket on the myminio MinIO deployment:

mc support inspect

Mon, 01 Jan 0001 00:00:00 +0000

SUBNET Registration Required

Description

The mc support inspect command collects the data and metadata associated to objects at the specified path.

MinIO assembles this data from each backend drive storing an erasure shard for each specified object. The command produces an encrypted zip file that includes all matching files with their respective host+drive+path.

mc support top disk

Mon, 01 Jan 0001 00:00:00 +0000

SUBNET Registration Required

Syntax

The mc support top disk command displays current drive statistics.

The following command displays the current in-progress S3 API calls on the alias myminio.

mc tag remove

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc tag remove command removes all tags from a bucket or object.

The following command removes tags for the mydata bucket on the myminio MinIO deployment:

mc tag remove myminio/mydata

The command has the following syntax:

mc [GLOBALFLAGS] tag remove \
 [--rewind "string"] \
 [--versions] \
 [--version-id "string"]* \

Brackets [] indicate optional parameters.
Parameters sharing a line are mutually dependent.
Parameters separated using the pipe | operator are mutually exclusive.

Copy the example to a text editor and modify as-needed before running the command in the terminal/shell.

mc version suspend

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc version suspend command disables versioning on the specified bucket.

The following command disables versioning for the mybucket bucket on the myminio MinIO deployment:

mc version suspend myminio/mybucket

The command has the following syntax:

mc [GLOBALFLAGS] version suspend ALIAS

Brackets [] indicate optional parameters.
Parameters sharing a line are mutually dependent.
Parameters separated using the pipe | operator are mutually exclusive.

Copy the example to a text editor and modify as-needed before running the command in the terminal/shell.

Metrics version 2

Mon, 01 Jan 0001 00:00:00 +0000

MinIO publishes cluster and node metrics using the Prometheus Data Model. You can use any scraping tool to pull metrics data from MinIO for further analysis and alerting.

Version 2 Endpoints

Metrics version 2 provides metrics organized into three categories:

Each v2 endpoint returns all metrics for its category. For example, scraping the following endpoint returns all cluster metrics:

http://HOSTNAME:PORT/minio/v2/metrics/cluster

The base endpoint alone, /minio/v2/metrics/, returns cluster metrics.

MinIO Identity Management Plugin Settings

Mon, 01 Jan 0001 00:00:00 +0000

This page documents settings for enabling external identity management using the MinIO Identity Management Plugin. See MinIO External Identity Management Plugin for a tutorial on using these settings.

You can establish or modify settings by defining:

an environment variable on the host system prior to starting or restarting the MinIO Server. Refer to your operating system’s documentation for how to define an environment variable.
a configuration setting using mc admin config set.

If you define both an environment variable and the similar configuration setting, MinIO uses the environment variable value.

Modify a MinIO Tenant

Mon, 01 Jan 0001 00:00:00 +0000

You can modify tenants after deployment to change mutable configuration settings. See MinIO Custom Resource Definition for a complete description of available settings in the MinIO Custom Resource Definition.

The method for modifying the Tenant depends on how you deployed the tenant:

For Kustomize-deployed Tenants, you can modify the base Kustomization resources and apply them using kubectl apply -k against the directory containing the kustomization.yaml object.

Object Deletion

Mon, 01 Jan 0001 00:00:00 +0000

Overview

This page summarizes how a DELETE operation affects objects depending on the configuration of the bucket that contains the object.

Any combination of the following factors may impact how DELETE operations function:

Permissions

MinIO uses a policy based access control system for access management. The user or service account must provide the correct policy action and conditions to allow a DELETE for the bucket and object.

Operator Helm Charts

Mon, 01 Jan 0001 00:00:00 +0000

MinIO publishes Helm Charts for the Helm Operator Charts and Helm Tenant Charts. You can use these charts to deploy the MinIO Operator and managed Tenants through Helm.

The following page documents the values.yaml chart for the MinIO Operator. For documentation on the chart for a MinIO Tenant, see Tenant Helm Charts

MinIO Operator Chart

operator

Publish Events to NATS

Mon, 01 Jan 0001 00:00:00 +0000

MinIO supports publishing bucket notification events to a NATS service endpoint.

NATS Streaming Deprecated

NATS Streaming is deprecated. Migrate to JetStream instead.

The related MinIO configuration options and environment variables are deprecated.

Add a NATS Endpoint to a MinIO Deployment

The following procedure adds a new NATS service endpoint for supporting bucket notifications in a MinIO deployment.

Prerequisites

MinIO `mc` Command Line Tool

This procedure uses the mc command line tool for certain actions. See the mc Quickstart for installation instructions.

Root Access Settings

Mon, 01 Jan 0001 00:00:00 +0000

This page covers settings that control root (superuser) access for the MinIO process. The root user has complete access and permissions to perform operations on the MinIO deployment.

Root User and Root Password are required even if you use the MinIO Key Encryption Service or other key management utility.

You can establish or modify settings by defining:

an environment variable on the host system prior to starting or restarting the MinIO Server. Refer to your operating system’s documentation for how to define an environment variable.
a configuration setting using mc admin config set.

If you define both an environment variable and the similar configuration setting, MinIO uses the environment variable value.

Security and Access

Mon, 01 Jan 0001 00:00:00 +0000

You can use the MinIO Console to perform several of the identity and access management functions available in MinIO, such as:

Create child access keys that inherit the parent’s permissions.
View, manage, and create access policies.
Create and manage user credentials or groups with the built-in MinIO IDP, connect to one or more OIDC provider, or add an AD/LDAP provider for SSO.

Access Keys

The Access Keys or Service Accounts section displays all Access Keys associated to the authenticated user. The summary list of access keys that already exist for a particular user includes the access key, expiration, status, name, and description.

Server-Side Encryption with Client-Managed Keys (SSE-C)

Mon, 01 Jan 0001 00:00:00 +0000

The procedure on this page configures and enables Server-Side Encryption with Client-Managed Keys (SSE-C). MinIO SSE-C supports client-driven encryption of objects before writing the object to the drive. Clients must specify the correct key to decrypt objects for read operations.

Site Failure Recovery

Mon, 01 Jan 0001 00:00:00 +0000

MinIO can make the loss of an entire site, while significant, a relatively minor incident. Site recovery depends on the replication option you use for the site.

Site Replication

Total restoration of IAM configurations, bucket configurations, and data from the healthy peer site(s)

Bucket Replication

Data restoration of objects and metadata from a healthy remote location for each bucket configured for replication

mc mirror

Data restoration of objects only from a healthy remote location with no versioning

Software Checklist

Mon, 01 Jan 0001 00:00:00 +0000

Use the following checklist when planning the software configuration for a production, distributed MinIO deployment.

MinIO Pre-requisites

Servers running a Linux operating system with a 6.6+ kernel. Red Hat Enterprise Linux (RHEL) 10 or Ubuntu LTS 22.04.01+ ship with these Kernel’s by default. Ensure the chosen OS uses LTS and in-support releases of a 6.6+ Linux kernel.

Transition Objects from MinIO to GCS

Mon, 01 Jan 0001 00:00:00 +0000

The procedure on this page creates a new object lifecycle management rule that transition objects from a MinIO bucket to a remote storage tier on the Google Cloud Storage backend. This procedure supports use cases like moving aged data to low-cost public cloud storage solutions after a certain time period or calendar date.

Requirements

Install and Configure `mc`

CVE-2026-34204: Replication Metadata Injection

Wed, 15 Apr 2026 00:00:00 +0000

Status: Released
First containing release: RELEASE.2026-04-17T00-00-00Z
GitHub issue: pgsty/minio#24

Ordinary PUT and COPY requests could smuggle X-Minio-Replication-* headers into internal X-Minio-Internal-* SSE metadata, creating objects whose replication state did not match the authorized path and could even make them unreadable. The final fix stopped accepting replication-only metadata by default, restored it only in a trusted flow authorized for ReplicateObjectAction, and sanitized CopyObject before any header consumer ran.

Threat model

An attacker needed only ordinary object-write permission, not internode credentials. The input came entirely from client-controlled X-Minio-Replication-* headers, but metadata extraction converted it into internal replication or SSE state.

SILO 20260321 Released

Sat, 21 Mar 2026 00:00:00 +0000

Published: 2026-03-21 · Version: RELEASE.2026-03-21T00-00-00Z

This maintenance release is built around the Go 1.26.1 upgrade and a broad dependency refresh. Beyond stricter compiler and linter compatibility fixes, it also delivers the most substantial security dependency refresh in the current release line.

Major Changes

Upgrade the build environment from Go 1.26.0 to Go 1.26.1.
Refresh direct and indirect dependencies to converge on the newer toolchain.
Fix linter and test issues exposed by the stricter Go 1.26.1 checks.

Fixed CVEs

CVE-2026-27137: Go stdlib 1.26.0 -> 1.26.1 fixes incomplete email-constraint enforcement in crypto/x509.
CVE-2026-27138: Go stdlib 1.26.0 -> 1.26.1 fixes a crypto/x509 panic triggered by malformed certificates.
CVE-2026-25679: Go stdlib 1.26.0 -> 1.26.1 fixes insufficient validation of IPv6 host literals in net/url.
CVE-2026-27139: Go stdlib 1.26.0 -> 1.26.1 fixes FileInfo metadata escaping the Root boundary in os.
CVE-2026-27142: Go stdlib 1.26.0 -> 1.26.1 fixes missing URL escaping in html/template for meta refresh content.
CVE-2026-26958: filippo.io/edwards25519 v1.1.0 -> v1.2.0 fixes incorrect or undefined MultiScalarMult behavior.
CVE-2025-10543: github.com/eclipse/paho.mqtt.golang v1.5.0 -> v1.5.1 fixes incorrect MQTT packet encoding for oversized UTF-8 strings.
CVE-2026-24051: go.opentelemetry.io/otel/sdk v1.38.0 -> v1.42.0 fixes the macOS PATH-hijacking arbitrary code execution issue.
CVE-2026-33186: google.golang.org/grpc v1.77.0 -> v1.79.3 fixes authorization bypass caused by a missing leading slash in the HTTP/2 :path pseudo-header.

5abd9a8: bump golang to 1.26.1 and update deps
377fc61: fix: satisfy stricter Go 1.26.1 linter checks

MinIO is Dead

Thu, 04 Dec 2025 00:00:00 +0000

MinIO announces it is entering maintenance mode, the dragon-slayer has become the dragon – how MinIO transformed from an open-source S3 alternative to just another commercial software company

Configure NGINX Proxy for MinIO Server

Mon, 01 Jan 0001 00:00:00 +0000

The following documentation provides a baseline for configuring NGINX to proxy requests to MinIO in a Linux environment. It is not intended as a comprehensive approach to NGINX, proxying, or reverse proxying in general. Modify the configuration as necessary for your infrastructure.

This documentation assumes the following:

An existing NGINX deployment
An existing MinIO deployment
A DNS hostname which uniquely identifies the MinIO deployment

There are two models for proxying requests to the MinIO Server API and the MinIO Console:

Decommission Server Pools

Mon, 01 Jan 0001 00:00:00 +0000

MinIO supports decommissioning and removing server pools from a deployment with two or more pools. To decommission, there must be at least one remaining pool with sufficient available space to receive the objects from the decommissioned pools.

Starting with RELEASE.2023-01-18T04-36-38Z, MinIO supports queueing multiple pools in a single decommission command. Each listed pool immediately enters a read-only status, but draining occurs one pool at a time.

Decommissioning is designed for removing an older server pool whose hardware is no longer sufficient or performant compared to the pools in the deployment. MinIO automatically migrates data from the decommissioned pools to the remaining pools in the deployment based on the ratio of free space available in each pool.

Deploy MinIO on MacOS

Mon, 01 Jan 0001 00:00:00 +0000

This page documents deploying MinIO onto Apple MacOS hosts.

MinIO officially supports MacOS operating systems in service status, which is typically 3 years from initial release. At the time of writing, that includes:

macOS 14 (Sonoma) (Recommended)
macOS 13 (Ventura)
macOS 12 (Monterey)

MinIO may run on older or out-of-support macOS releases, with limited support or troubleshooting from either MinIO or RedHat.

Enable Multi-Site Server-Side Bucket Replication

Mon, 01 Jan 0001 00:00:00 +0000

The procedure on this page configures automatic server-side bucket replication between multiple MinIO deployments. Multi-Site Active-Active replication builds on the Enable Two-Way Server-Side Bucket Replication procedure with additional considerations required to ensure predictable replication behavior across all sites.

To configure replication between arbitrary S3-compatible services, use mc mirror.
To configure one-way “active-active” replication between two MinIO deployments, see Enable Two-Way Server-Side Bucket Replication.
To configure one-way “active-passive” replication between MinIO deployments, see Enable One-Way Server-Side Bucket Replication.

Multi-Site Active-Active replication configurations can span multiple racks, datacenters, or geographic locations. Complexity of configuring and maintaining multi-site configurations generally increase with the number of sites and size of each site. Enterprises looking to implement multi-site replication should consider leveraging MinIO SUBNET support to access the expertise, planning, and engineering resources required for addressing that use case.

Erasure Code Settings

Mon, 01 Jan 0001 00:00:00 +0000

This page covers settings that configure the Erasure Code parity to use for objects written to the MinIO cluster. This impacts how MinIO uses the space on the drive(s) and how MinIO can recover objects stored on lost drives or similar issues.

You can establish or modify settings by defining:

an environment variable on the host system prior to starting or restarting the MinIO Server. Refer to your operating system’s documentation for how to define an environment variable.
a configuration setting using mc admin config set.

If you define both an environment variable and the similar configuration setting, MinIO uses the environment variable value.

mc admin accesskey enable

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc admin accesskey enable command enables an existing access key.

The following command enables the specified access key:

mc admin accesskey enable myminio myuserserviceaccount

The command has the following syntax:

mc [GLOBALFLAGS] admin accesskey enable \
 ALIAS \
 SERVICEACCOUNT

Brackets [] indicate optional parameters.
Parameters sharing a line are mutually dependent.
Parameters separated using the pipe | operator are mutually exclusive.

Copy the example to a text editor and modify as-needed before running the command in the terminal/shell.

mc admin config

Mon, 01 Jan 0001 00:00:00 +0000

Description

The mc admin config command manages configuration settings for the minio server.

Use mc admin on MinIO Deployments Only

MinIO does not support using mc admin commands with other S3-compatible services, regardless of their claimed compatibility with MinIO deployments.

Examples

Syntax

`mc admin config set`

mc-cmd

Sets a configuration key on the MinIO deployment. Configurations defined by environment variables override configurations defined by this command.

`mc admin config get`

mc-cmd

mc admin policy entities

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

List the entities associated with a policy, user, or group on a target MinIO deployment.

Changed: RELEASE.2023-05-27T05-56-19Z

This command only returns minio-managed users and groups.

To list entities associated with an Active Directory or LDAP (AD/LDAP) configuration, use mc idp ldap policy entities.

For example, you can list all of the users and groups attached to a policy or list all of the policies attached to a specific user or group.

mc admin user info

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc admin user info command returns detailed information of a MinIO user on the target MinIO deployment.

To manage external Identity Provider users, see OIDC or AD/LDAP.

The following command returns details of user myuser on the myminio MinIO deployment:

mc admin user info myminio myuser

The command has the following syntax:

mc admin user svcacct enable

Mon, 01 Jan 0001 00:00:00 +0000

Important

This command has been replaced and will be deprecated in a future MinIO Client release.

As of MinIO Client RELEASE.2024-10-08T09-37-26Z, use the mc admin accesskey enable command to enable an access key for a built-in MinIO IDP user.

To enable access keys for AD/LDAP users, use the mc idp ldap accesskey enable command.

Syntax

The mc admin user svcacct enable command enables an existing access key.

The following command enables the specified access key:

mc alias import

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc alias import command imports an alias configuration from a JSON document.

You can use mc alias export to create the necessary JSON for import.

The following command imports an alias configuration from a JSON document:

mc alias import newalias ./credentials.json

Use mc alias list newalias to confirm the import succeeded.

The mc alias import command has the following syntax:

mc anonymous links

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc anonymous links retrieves the HTTP URL for anonymous (i.e. unauthenticated or public) access to a bucket.

Buckets with anonymous policies allow clients to access the bucket contents and perform actions consistent with the specified policy without authentication.

The following command retrieves HTTP URLs for the mydata bucket on the myminio MinIO deployment:

mc batch list

Mon, 01 Jan 0001 00:00:00 +0000

Changed: MinIO

RELEASE.2022-10-08T20-11-00Z or later

Syntax

The mc batch list command outputs a list of the batch jobs currently in progress on a deployment.

The following command outputs a list of all jobs currently in progress on the myminio alias.

mc batch list myminio

The command has the following syntax:

mc idp ldap accesskey info

Mon, 01 Jan 0001 00:00:00 +0000

Description

The mc idp ldap accesskey info outputs information about the specified access key(s).

This command works against access keys created by an AD/LDAP user after authenticating to MinIO.

Create AD/LDAP service accounts with the mc idp ldap accesskey create command.

MinIO supports using AssumeRoleWithLDAPIdentity to generate temporary access keys using the Security Token Service.

The following example outputs details for the access key mykey from the minio deployment:

mc idp ldap info

Mon, 01 Jan 0001 00:00:00 +0000

Description

The mc idp ldap info command outputs the current configuration for an AD/LDAP provider on a specified MinIO deployment.

The following example outputs the AD/LDAP configuration settings on the myminio deployment.

mc idp ldap info \
 myminio

The command has the following syntax:

mc [GLOBALFLAGS] idp ldap info \
 ALIAS

Replace ALIAS with the alias of a MinIO deployment to retrieve info on the AD/LDAP integration.

mc ilm import

Mon, 01 Jan 0001 00:00:00 +0000

Changed: RELEASE.2022-12-24T15-21-38Z

mc ilm import replaced by mc ilm rule import.

Syntax

The mc ilm import command imports an object lifecycle management configuration and applies it to a MinIO bucket.

The mc ilm import command imports from STDIN by default. You can input the contents from a .json file, such as one produced by mc ilm export.

The following command imports the lifecycle management configuration from mydata-lifecycle-config.json and applies it to the mydata bucket on the myminio deployment:

mc ilm rule import

Mon, 01 Jan 0001 00:00:00 +0000

Changed: RELEASE.2022-12-24T15-21-38Z

mc ilm rule import replaces mc ilm import.

Syntax

The mc ilm rule import command imports an object lifecycle management configuration and applies it to a MinIO bucket.

The mc ilm rule import command imports from STDIN by default. You can input the contents from a .json file, such as one produced by mc ilm rule export.

The following command imports the lifecycle management configuration from mydata-lifecycle-config.json and applies it to the mydata bucket on the myminio deployment:

mc ilm tier ls

Mon, 01 Jan 0001 00:00:00 +0000

Changed: RELEASE.2022-12-24T15-21-38Z

mc ilm tier ls replaces mc admin tier ls.

Description

The mc ilm tier ls command shows the remote tiers configured on a deployment.

The mc ilm tier list command has equivalent functionality to mc ilm tier ls.

Syntax

The command has the following syntax:

The following example outputs a list of the existing remote tiers on the myminio deployment.

mc replicate update

Mon, 01 Jan 0001 00:00:00 +0000

Changed: RELEASE.2022-12-24T15-21-38Z

mc replicate update replaces the mc admin bucket remote update command.

Changed: RELEASE.2022-11-07T23-47-39Z

mc replicate update replaces the mc replicate edit command.

Syntax

The mc replicate update command modifies an existing bucket replication rule.

mc [GLOBALFLAGS] replicate update FLAGS [FLAGS] ARGUMENTS [ARGUMENTS]

The following command modifies an existing replication rule for the mydata bucket on the myminio MinIO deployment:

mc support perf

Mon, 01 Jan 0001 00:00:00 +0000

Changed: RELEASE.2022-07-24T02-25-13Z

mc support perf replaces the mc admin speedtest command.

SUBNET Registration Required

Description

Use the mc support perf command to review the performance of the S3 API (read/write), network IO, and storage (drive read/write).

mc support top net

Mon, 01 Jan 0001 00:00:00 +0000

SUBNET Registration Required

Syntax

The mc support top net command displays realtime network metrics.

The following command displays the current realtime network metrics for the alias myminio deployment.

MinIO Access Management Plugin Settings

Mon, 01 Jan 0001 00:00:00 +0000

This page documents settings for enabling external authorization management using the MinIO Access Management Plugin. See MinIO External Access Management Plugin for a tutorial on using these settings.

You can establish or modify settings by defining:

an environment variable on the host system prior to starting or restarting the MinIO Server. Refer to your operating system’s documentation for how to define an environment variable.
a configuration setting using mc admin config set.

If you define both an environment variable and the similar configuration setting, MinIO uses the environment variable value.

MinIO External Identity Management Plugin

Mon, 01 Jan 0001 00:00:00 +0000

Overview

The MinIO Identity Management Plugin provides a REST interface for offloading authentication to an external identity manager through a webhook service.

Once enabled, client applications use the AssumeRoleWithCustomToken STS API extension to generate access tokens for MinIO. MinIO verifies this token by making a POST request to the configured plugin endpoint and uses the returned response to determine the authentication status of the client.

Configuration Settings

You can configure the MinIO Identity Management Plugin using the following environment variables or configuration settings:

Monitor a MinIO Server with Grafana

Mon, 01 Jan 0001 00:00:00 +0000

Grafana allows you to query, visualize, alert on and understand your metrics no matter where they are stored.

Prerequisites

An existing Prometheus deployment with backing Alert Manager
An existing MinIO deployment with network access to the Prometheus deployment
Grafana installed

Grafana dashboards use metrics version 2

The MinIO Grafana dashboards use metrics version 2. For more about metrics API versions, see Metrics and alerts.

Version 3 metrics require creating your own dashboard. For more information about dashboards, see the Grafana documentation.

MQTT Notification Settings

Mon, 01 Jan 0001 00:00:00 +0000

This page documents settings for configuring an MQTT service as a target for Bucket Notifications. See Publish Events to MQTT for a tutorial on using these settings.

You can establish or modify settings by defining:

an environment variable on the host system prior to starting or restarting the MinIO Server. Refer to your operating system’s documentation for how to define an environment variable.
a configuration setting using mc admin config set.

If you define both an environment variable and the similar configuration setting, MinIO uses the environment variable value.

Object Healing

Mon, 01 Jan 0001 00:00:00 +0000

What is healing?

Healing is MinIO’s ability to restore an object that has been damaged, corrupted, or partially lost. The loss can come from multiple types of corruptions or loss, such as but not limited to:

drive-level errors or failure
OS or filesystem errors or failure
bit rot

Healing and Erasure Coding

The ability of MinIO to restore a damaged object relates directly to the following:

total number of drives in the erasure set where the object exists

Publish Events to NSQ

Mon, 01 Jan 0001 00:00:00 +0000

MinIO supports publishing bucket notification events to NSQ service endpoint.

Add a NSQ Endpoint to a MinIO Deployment

The following procedure adds a new NSQ service endpoint for supporting bucket notifications in a MinIO deployment.

Prerequisites

MinIO `mc` Command Line Tool

This procedure uses the mc command line tool for certain actions. See the mc Quickstart for installation instructions.

1) Add the NSQ Endpoint to MinIO

You can configure a new NSQ service endpoint using either environment variables or by setting runtime configuration settings.

Security Policy

Mon, 01 Jan 0001 00:00:00 +0000

Security maintenance is the reason this fork exists. Upstream minio/minio is archived; Silo tracks CVEs against the codebase, backports or writes the fixes, and publishes what it found.

Reporting a vulnerability

Report undisclosed high-severity vulnerabilities through a private channel, not in a public issue.

Silo server and mcli client — preferably as a private report through GitHub Security Advisories on pgsty/minio.
This documentation — open an issue on pgsty/silo-docs; if the content itself discloses a weakness, use a private channel instead.

Include the affected release, a description of the impact, and reproduction steps if you have them — this helps us confirm the issue faster.

Security Token Service (STS) for MinIO Operator

Mon, 01 Jan 0001 00:00:00 +0000

Overview

Added: Operator

v5.0.0

The MinIO Operator supports a set of API calls that allows an application to obtain STS credentials for a MinIO Tenant.

Benefits of STS for MinIO Operator include:

STS credentials allow an application to access objects on a MinIO Tenant without the need to create credentials for the application on the tenant.
Allows applications to access objects in MinIO tenants using a Kubernetes-native authentication mechanism.

SUBNET

Mon, 01 Jan 0001 00:00:00 +0000

You can use the MinIO Console to perform several of the license and subscription related functions available in MinIO, such as:

View the license you are currently using for your MinIO deployment.
Subscribe to a commercial license, which includes access to MinIO SUBNET.
Manage the deployment’s Enterprise license.
Access Support tools for sharing with MinIO Engineering.
Review differences between license options.

License

MinIO offers three licensing options:

Open source with the GNU AGPLv3 license
Enterprise Lite, a commercial license with included support direct from MinIO Engineers
Enterprise Plus, a commercial license with included support direct from MinIO Engineers, longer release cycle, shorter SLA, and other benefits

The License page shows the current license status of the deployment. You can also begin the registration process to sign up for a paid subscription or add the deployment to an existing subscription.

Tenant Helm Charts

Mon, 01 Jan 0001 00:00:00 +0000

MinIO publishes Helm Charts for the Helm Operator Charts and Helm Tenant Charts. You can use these charts to deploy the MinIO Operator and managed Tenants through Helm.

The following page documents the values.yaml chart for a MinIO Tenant. For documentation on the chart for a MinIO Operator, see Operator Helm Charts

MinIO Tenant Chart

tenant

Transition Objects from MinIO to Azure

Mon, 01 Jan 0001 00:00:00 +0000

The procedure on this page creates a new object lifecycle management rule that transition objects from a MinIO bucket to a remote storage tier on the Azure storage backend. This procedure supports use cases like moving aged data to low-cost public cloud storage solutions after a certain time period or calendar date.

Requirements

Install and Configure `mc`

Upgrade a MinIO Tenant

Mon, 01 Jan 0001 00:00:00 +0000

The following procedures upgrade a single MinIO Tenant, using either Kustomize or Helm. MinIO recommends you test upgrades in a lower environment such as a Dev or QA Tenant, before upgrading production Tenants.

Important

For Tenants using a MinIO Image older than RELEASE.2024-03-30T09-41-56Z running with AD/LDAP enabled, you must read through the release notes for RELEASE.2024-04-18T19-09-19Z before starting this procedure. You must take the extra steps documented in the linked release as part of the upgrade procedure.

CVE-2026-39414: Oversized S3 Select Records and a SIMD Bypass

Wed, 15 Apr 2026 00:00:00 +0000

Status: Released; the second-round fix was completed in June
Initial fix release: RELEASE.2026-04-17T00-00-00Z
Complete fix release: RELEASE.2026-06-18T00-00-00Z
GitHub issue: pgsty/minio#25

The first fix in April reused the existing 1 MiB maxCharsPerRecord limit for both CSV and ordinary JSON Lines. This prevented unbounded buffering while waiting for a delimiter and returned the explicit OverMaxRecordSize error to clients. A June review then found that CPUs with SIMD support took a different simdjson fast path that bypassed the limit completely.

SILO 20260314 Released

Sat, 14 Mar 2026 00:00:00 +0000

Published: 2026-03-14 · Version: RELEASE.2026-03-14T12-00-00Z

This release switches the project to the community-maintained Console fork and performs a sizeable dependency refresh to establish the base for the later Go 1.26.x maintenance releases.

Major Changes

Switch to the community-maintained georgmangold/console v1.9.1 fork in place of the unmaintainable upstream Console dependency.
Refresh a large portion of the direct and indirect dependency graph so the new Console and toolchain combination builds cleanly.
Fix the go vet format directive issue in grid_test.go and adjust tests for the HTTP behavior changes in Go 1.26.

Fixed CVEs

CVE-2025-47913: golang.org/x/crypto v0.37.0 -> v0.46.0 fixes a panic in ssh/agent when handling malformed responses.
CVE-2025-58181: golang.org/x/crypto v0.37.0 -> v0.46.0 fixes unbounded memory consumption in ssh GSSAPI authentication parsing.
CVE-2025-47914: golang.org/x/crypto v0.37.0 -> v0.46.0 fixes a panic in ssh/agent caused by malformed identity messages.
CVE-2025-47911: golang.org/x/net v0.39.0 -> v0.48.0 fixes quadratic parsing complexity in html.Parse for crafted inputs.
CVE-2025-58190: golang.org/x/net v0.39.0 -> v0.48.0 fixes an infinite parsing loop in golang.org/x/net/html.

68521b3: add github ci/cd pipeline
00f3cf7: RELEASE.2026-03-14T12-00-00Z with go 1.26.0

Access Management

Mon, 01 Jan 0001 00:00:00 +0000

Overview

MinIO uses Policy-Based Access Control (PBAC) to define the authorized actions and resources to which an authenticated user has access. Each policy describes one or more actions and conditions that outline the permissions of a user or group of users.

MinIO PBAC is built for compatibility with AWS IAM policy syntax, structure, and behavior. The MinIO documentation makes a best-effort to cover IAM-specific behavior and functionality. Consider deferring to the IAM documentation for more complete documentation on AWS IAM-specific topics.

Automatic Object Expiration

Mon, 01 Jan 0001 00:00:00 +0000

Each procedure on this page creates a new object lifecycle management rule that expires objects on a MinIO bucket. This procedure supports use cases like removing “old” objects after a certain time period or calendar date.

Requirements

Install and Configure `mc`

Data Compression

Mon, 01 Jan 0001 00:00:00 +0000

Overview

MinIO Server supports compressing objects to reduce disk usage. Objects are compressed on PUT before writing to disk, and uncompressed on GET before they are sent to the client. This makes the compression process transparent to client applications and services.

Depending on the type of data, compression may also increase overall throughput. Write throughput for a production deployment is generally 500MB per second or greater per available CPU core in the system. Decompression is approximately 1 GB per second or greater for each CPU core.

Deploy MinIO on Windows

Mon, 01 Jan 0001 00:00:00 +0000

This page documents deploying MinIO onto Microsoft Windows hosts.

MinIO officially supports Windows operating systems in the Active Support of the Microsoft Modern Lifecycle Policy.

At the time of writing, that includes:

Windows Server 23H2 (Recommended)
Windows Server 2022 LTSC
Windows 11 Enterprise/Workstation 23H2
Windows 11 Enterprise/Workstation 22H2
Windows 10 Enterprise 21H2 (LTS)
Windows 10 IoT 21H2 (LTS)
Windows 10 Enterprise 22H2

MinIO may run on older or out-of-support Windows releases, with limited support or troubleshooting from either MinIO or Microsoft.

Expand a MinIO Tenant

Mon, 01 Jan 0001 00:00:00 +0000

This procedure documents expanding the available storage capacity of an existing MinIO tenant by deploying an additional pool of MinIO pods in the Kubernetes infrastructure.

Important

The MinIO Operator Console is deprecated and removed in Operator 6.0.0.

See Modify a MinIO Tenant for instructions on migrating Tenants installed via the Operator Console to Kustomization.

Prerequisites

MinIO Kubernetes Operator

This procedure on this page requires a valid installation of the MinIO Kubernetes Operator and assumes the local host has a matching installation of the MinIO Kubernetes Operator. This procedure assumes the latest stable Operator, version 7.1.1.

mc admin accesskey info

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc admin accesskey info command returns a description of the specified access key(s).

The description output includes the following details, as available:

Access Key
Parent user of the specified access key
Access key status (on or off)
Policy or policies
Comment
Expiration

The following command returns information on the specified access key:

mc admin decommission

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc admin decommission command starts the decommissioning process for a MinIO server pools. Decommissioning is designed for removing an older server pool whose hardware is no longer sufficient or performant compared to the pools in the deployment. MinIO automatically migrates data from the decommissioned pool to the remaining pools in the deployment based on the ratio of free space available in each pool.

See Decommission Server Pools for a complete procedure on decommissioning a server pool.

mc admin policy info

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

Returns the specified policy in JSON format if it exists on the target MinIO deployment.

The following command displays the contents of the writeonly policy on the alias myminio.

 mc admin policy info myminio writeonly

The command has the following syntax:

mc admin policy info TARGET POLICYNAME
 [--policy-file, -f <path>]

Brackets [] indicate optional parameters.
Parameters sharing a line are mutually dependent.
Parameters separated using the pipe | operator are mutually exclusive.

Copy the example to a text editor and modify as-needed before running the command in the terminal/shell.

mc admin user ls

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc admin user ls command lists all MinIO users on the target MinIO deployment.

The mc admin user list command has equivalent functionality to mc admin user ls.

mc admin user ls does not return the access key or secret key associated to a user. Use mc admin user info to retrieve detailed user information, including the user access key.

To manage external Identity Provider users, see OIDC or AD/LDAP.

The following command lists all users on the myminio MinIO deployment:

mc admin user svcacct info

Mon, 01 Jan 0001 00:00:00 +0000

Important

This command has been replaced and will be deprecated in a future MinIO Client release.

As of MinIO Client RELEASE.2024-10-08T09-37-26Z, use the mc admin accesskey info command to display information about access keys for built-in MinIO IDP users.

For access keys for AD/LDAP users, use the mc idp ldap accesskey info command.

Syntax

The mc admin user svcacct info command returns a description of the specified access key.

“Access Keys” have equivalent functionality to and replace the concept of “Service Accounts” in MinIO.

mc alias export

Mon, 01 Jan 0001 00:00:00 +0000

Added: mc.RELEASE.2023-11-15T22-45-58Z

Syntax

The mc alias export command exports an alias configuration from the existing configuration.

The command outputs the result to STDOUT where you can either capture the output as a file or perform further modifications to the output as necessary.

Use the mc alias import command to import the resulting JSON configuration.

The following command exports an alias configuration from the existing host and outputs it to a file:

mc anonymous get-json

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc anonymous get-json command gets anonymous (i.e. unauthenticated or public) access policies for a bucket.

Buckets with anonymous policies allow clients to access the bucket contents and perform actions consistent with the specified policy without authentication.

The following command retrieves the JSON-formatted anonymous policy for the mydata bucket on the myminio MinIO deployment:

mc batch start

Mon, 01 Jan 0001 00:00:00 +0000

Changed: MinIO

RELEASE.2022-10-08T20-11-00Z or later

Syntax

The mc batch start command launches a batch job from a job batch YAML file.

The batch job runs to completion (or up to the number of retries specified in the file) one time. To run the batch job again after completion, you must start it again.

The following command creates a basic YAML file for a replicate job on the mybucket bucket of the myminio alias.

mc cat

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc cat command concatenates the contents of a file or object to another file or object. You can also use the command to display the contents of the specified file or object to STDOUT. cat has similar functionality to cat.

The following command concatenates the contents of an object on a MinIO deployment to STDOUT:

mc idp ldap accesskey ls

Mon, 01 Jan 0001 00:00:00 +0000

Description

The mc idp ldap accesskey ls displays a list of LDAP access key pairs.

mc idp ldap accesskey ls is also known as mc idp ldap accesskey list.

This command works against access keys created by an AD/LDAP user after authenticating to MinIO.

Create AD/LDAP service accounts with the mc idp ldap accesskey create command.

MinIO supports using AssumeRoleWithLDAPIdentity to generate temporary access keys using the Security Token Service.

The following example returns a list of access keys associated with the authenticated user on the minio alias:

mc idp ldap ls

Mon, 01 Jan 0001 00:00:00 +0000

Description

The mc idp ldap ls command lists the existing set of configurations for an AD/LDAP provider.

mc idp ldap ls is also known as mc idp ldap list.

The following example lists the AD/LDAP configuration settings for the myminio deployment.

mc idp ldap ls \
 myminio

The command has the following syntax:

mc ilm ls

Mon, 01 Jan 0001 00:00:00 +0000

Changed: RELEASE.2022-12-24T15-21-38Z

mc ilm ls replaced by mc ilm rule ls.

Syntax

The mc ilm ls command summrizes all configured object lifecycle management rules on a MinIO bucket in a tabular format.

The output of the command might resemble the following:

┌───────────────────────────────────────────────────────────────────────────────┐
│ Transition for latest version (Transition) │
├────────┬─────────┬────────┬─────────────────────┬──────────────┬──────────────┤
│ ID │ STATUS │ PREFIX │ TAGS │ DAYS TO TIER │ TIER │
├────────┼─────────┼────────┼─────────────────────┼──────────────┼──────────────┤
│ rule-1 │ Enabled │ doc/ │ key1=val1&key2=val2 │ 0 │ WARM-MINIO-1 │
└────────┴─────────┴────────┴─────────────────────┴──────────────┴──────────────┘
┌────────────────────────────────────────────────────────────────┐
│ Transition for older versions (NoncurrentVersionTransition) │
├────────┬─────────┬────────┬──────┬──────────────┬──────────────┤
│ ID │ STATUS │ PREFIX │ TAGS │ DAYS TO TIER │ TIER │
├────────┼─────────┼────────┼──────┼──────────────┼──────────────┤
│ rule-2 │ Enabled │ logs/ │ - │ 10 │ WARM-MINIO-1 │
└────────┴─────────┴────────┴──────┴──────────────┴──────────────┘
┌────────────────────────────────────────────────────────────────────────────────────────┐
│ Expiration for latest version (Expiration) │
├────────┬─────────┬────────┬─────────────────────┬────────────────┬─────────────────────┤
│ ID │ STATUS │ PREFIX │ TAGS │ DAYS TO EXPIRE │ EXPIRE DELETEMARKER │
├────────┼─────────┼────────┼─────────────────────┼────────────────┼─────────────────────┤
│ rule-1 │ Enabled │ doc/ │ key1=val1&key2=val2 │ 30 │ false │
└────────┴─────────┴────────┴─────────────────────┴────────────────┴─────────────────────┘
┌──────────────────────────────────────────────────────────────────────────────────┐
│ Expiration for older versions (NoncurrentVersionExpiration) │
├────────┬─────────┬────────┬─────────────────────┬────────────────┬───────────────┤
│ ID │ STATUS │ PREFIX │ TAGS │ DAYS TO EXPIRE │ KEEP VERSIONS │
├────────┼─────────┼────────┼─────────────────────┼────────────────┼───────────────┤
│ rule-1 │ Enabled │ doc/ │ key1=val1&key2=val2 │ 15 │ 0 │
│ rule-2 │ Enabled │ logs/ │ - │ 1 │ 3 │
└────────┴─────────┴────────┴─────────────────────┴────────────────┴───────────────┘

The following command lists all lifecycle management rules for the mydata bucket on the myminio MinIO deployment:

mc ilm rule ls

Mon, 01 Jan 0001 00:00:00 +0000

Changed: RELEASE.2022-12-24T15-21-38Z

mc ilm rule ls replaces mc ilm ls.

Changed: RELEASE.2023-05-26T23-31-54Z

mc ilm rule ls --json output includes the policy modification time in updateAt.

Syntax

The mc ilm rule ls command summarizes all configured object lifecycle management rules on a MinIO bucket in a tabular format.

The mc ilm rule list command has equivalent functionality to mc ilm rule ls.

The following command lists all lifecycle management rules for the mydata bucket on the myminio MinIO deployment:

mc ilm tier rm

Mon, 01 Jan 0001 00:00:00 +0000

Description

The mc ilm tier rm command removes an remote tier that has not been used to transition any objects.

The mc ilm tier remove command has equivalent functionality to mc ilm tier rm

Note

Once a tier has transitioned objects, it cannot be removed.

Required Permissions

MinIO requires the following permissions scoped to to the bucket or buckets for which you are creating lifecycle management rules.

MinIO also requires the following administrative permissions on the cluster in which you are creating remote tiers for object transition lifecycle management rules:

mc replicate resync

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc replicate resync command resynchronizes all objects in the specified MinIO bucket to a remote replication target.

This command requires first configuring the remote bucket target using the mc replicate add command. You must specify the resulting remote ARN as part of running mc replicate resync.

This command supports rebuilding a MinIO deployment using an active-active replication remote as the “backup” source. See the following tutorials for more information on active-active replication:

mc support profile

Mon, 01 Jan 0001 00:00:00 +0000

SUBNET Registration Required

Description

mc support profile runs a system profile for your deployment. The results of the profile can provide insight into the MinIO server process running on a given node.

The resulting report is intended for use by MinIO Engineering. You can upload the report to MinIO SUBNET. Independent or third-party use of these profiles for diagnostics and remediation is done at your own risk.

mc support top rpc

Mon, 01 Jan 0001 00:00:00 +0000

SUBNET Registration Required

Syntax

The mc support top rpc command displays metrics for remote procedure calls (RPC).

The following command displays the current remote procedure call metrics for the alias myminio deployment.

Migrate from Gateway or Filesystem Mode

Mon, 01 Jan 0001 00:00:00 +0000

Background

The MinIO Gateway and the related filesystem mode entered a feature freeze in July 2020. In February 2022, MinIO announced the deprecation of the MinIO Gateway. Along with the deprecation announcement, MinIO also announced that the feature would be removed in six months time.

As of RELEASE.2022-10-29T06-21-33Z, the MinIO Gateway and the related filesystem mode code have been removed. Deployments still using the standalone or filesystem MinIO modes that upgrade to MinIO Server RELEASE.2022-10-29T06-21-33Z or later receive an error when attempting to start MinIO.

MinIO Console Settings

Mon, 01 Jan 0001 00:00:00 +0000

Changed: RELEASE.2025-05-24T17-08-30Z

The Console now presents only object browser capabilities similar to those available through the mc tool. For administrative interactions, such as user management, use the mc admin command.

Some of the settings on this page may no longer be relevant for newer deployments.

This page covers settings that manage access and behavior for the MinIO Console.

You can establish or modify settings by defining:

an environment variable on the host system prior to starting or restarting the MinIO Server. Refer to your operating system’s documentation for how to define an environment variable.
a configuration setting using mc admin config set.

If you define both an environment variable and the similar configuration setting, MinIO uses the environment variable value.

MySQL Notification Settings

Mon, 01 Jan 0001 00:00:00 +0000

This page documents settings for configuring a MYSQL service as a target for Bucket Notifications. See Publish Events to MySQL for a tutorial on using these settings.

You can establish or modify settings by defining:

an environment variable on the host system prior to starting or restarting the MinIO Server. Refer to your operating system’s documentation for how to define an environment variable.
a configuration setting using mc admin config set.

If you define both an environment variable and the similar configuration setting, MinIO uses the environment variable value.

Object Scanner

Mon, 01 Jan 0001 00:00:00 +0000

Overview

MinIO uses the built-in scanner to check objects for healing and to take any scheduled object actions. Such actions may include:

calculate data usage on drives
evaluate and apply configured lifecycle management or object retention rules
perform bucket or site replication
check objects for missing or corrupted data or parity shards and perform healing

The scanner performs these functions at two levels: cluster and bucket. At the cluster level, the scanner splits all buckets into groups and scans one group of buckets at a time. The scanner starts with any new buckets added since the last scan, then randomizes the scanning of other buckets. The scanner completes checks on all bucket groups before starting over with a new set of scans.

Publish Events to Elasticsearch

Mon, 01 Jan 0001 00:00:00 +0000

MinIO supports publishing bucket notification events to an Elasticsearch service endpoint.

MinIO relies on the https://github.com/elastic/go-elasticsearch v7 project for Elastic connectivity.

Add a Elasticsearch Endpoint to a MinIO Deployment

The following procedure adds a new Elasticsearch service endpoint for supporting bucket notifications in a MinIO deployment.

Prerequisites

Elasticsearch v7.0 and later

MinIO relies on the https://github.com/olivere/elastic v7 project for Elastic connectivity. The elastic/v7 library specifically targets Elasticsearch v7.0 and is not compatible with earlier Elasticsearch versions.

Resynchronize Bucket from Remote Replica

Mon, 01 Jan 0001 00:00:00 +0000

The procedure on this page resynchronizes the contents of a MinIO bucket using a healthy replication remote. Resynchronization supports recovery after partial or total loss of data on a MinIO deployment in a replica configuration.

For example, consider a MinIO active-active replication configuration similar to the following:

Resynchronization allows using the healthy data on one of the participating MinIO deployments as the source for rebuilding the other deployment.

Upload Files Using Pre-signed URLs

Mon, 01 Jan 0001 00:00:00 +0000

Using pre-signed URLs, a client can upload files directly to an S3-compatible cloud storage server (S3) without exposing the S3 credentials to the user.

This guide describes how to use the presignedPutObject API from the MinIO JavaScript Library to generate a pre-signed URL. This is demonstrated through a JavaScript example in which an Express Node.js server exposes an endpoint to generate a pre-signed URL and a client-side web application uploads a file to MinIO Server using that URL.

CVE-2026-40344: Snowball Auto-Extract Authentication Bypass

Thu, 16 Apr 2026 00:00:00 +0000

Status: Released
First containing release: RELEASE.2026-04-17T00-00-00Z
GitHub advisory: GHSA-9c4q-hq6p-c237

Snowball’s PutObjectExtractHandler omitted the streaming unsigned-trailer authentication case. A tar stream with a forged signature could enter untar() before authentication completed, and one request could fan out into many object writes. The final fix initialized the correct reader, handled the decoded length, and completed SigV4 verification before any tar byte reached the extractor.

Why the identifier changed

The official CVE had not been assigned when the fix was written, so the commit subject used the temporary identifier fake CVE-2026-40028. The final identifier is CVE-2026-40344. The historical commit was not rewritten; the advisory and this article use the official number.

SILO 20260214 Released

Sat, 14 Feb 2026 00:00:00 +0000

Published: 2026-02-14 · Version: RELEASE.2026-02-14T12-00-00Z

This early infrastructure-focused community release restores the embedded Console, introduces GitHub CI/CD, and lifts the Go baseline to 1.26.0, which also absorbs a batch of security fixes from the older toolchain generation.

Major Changes

Restore the embedded Console and refresh the README to clarify the community fork position.
Add GitHub CI/CD workflows as the base for automated builds and multi-platform delivery.
Add quick links for docs, Docker, the GitHub repository, and installation through the pig package manager.

Fixed CVEs

These issues were absorbed as part of the Go 1.25.5 -> 1.26.0 upgrade:

Delete a MinIO Tenant

Mon, 01 Jan 0001 00:00:00 +0000

Prerequisites

MinIO Kubernetes Operator

This procedures on this page requires a valid installation of the MinIO Kubernetes Operator and assumes the local host has a matching installation of the MinIO Kubernetes Operator. This procedure assumes the latest stable Operator, version 7.1.1.

See Deploy MinIO on Kubernetes for complete documentation on deploying the MinIO Operator.

Tenant Persistent Volume Claims

The delete behavior of each Persistent Volume Claims (PVC) generated by the Tenant depends on the Reclaim Policy of its bound Persistent Volume (PV):

Generate Let’s Encrypt certificate using Certbot for MinIO

Mon, 01 Jan 0001 00:00:00 +0000

Let’s Encrypt is a new free, automated, and open source, Certificate Authority.

Certbot is a console based certificate generation tool for Let’s Encrypt.

In this recipe, we will generate a Let’s Encypt certificate using Certbot. This certificate will then be deployed for use in the MinIO server.

1. Prerequisites

Install MinIO Server from here.
Install Certbot from here

2. Dependencies

Port 443 for https needs to be open and available at time of executing certbot.
Certbot needs root access while executing because only root is allowed to bind to any port below 1024.
We will be using our own domain myminio.com as an example in this recipe. Replace with your own domain under your setup.

3. Recipe Steps

Step 1: Install Certbot

Install Certbot by following the documentation at https://certbot.eff.org/

mc admin accesskey ls

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc admin accesskey ls command lists users, access keys, or temporary security token service keys managed by the MinIO deployment.

The alias mc admin accesskey list has equivalent functionality to mc admin accesskey ls.

The following command lists all access keys associated to the user with username admin1 on the deployment at alias myminio:

mc admin group

Mon, 01 Jan 0001 00:00:00 +0000

Description

The mc admin group command manages groups on a MinIO deployment.

A group is a collection of users. Each group can have one or more assigned policies that explicitly list the actions and resources to which group members are allowed or denied access. Groups provide a simplified method for managing shared permissions among users with common access patterns and workloads.

Use mc admin on MinIO Deployments Only

MinIO does not support using mc admin commands with other S3-compatible services, regardless of their claimed compatibility with MinIO deployments.

mc admin policy ls

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

Lists all policies on the target MinIO deployment.

The mc admin policy list command has equivalent functionality to mc admin policy ls.

The following command displays a list of the policies currently current on the alias play.

mc admin policy ls play

The command has the following syntax:

mc admin policy ls TARGET

Brackets [] indicate optional parameters.
Parameters sharing a line are mutually dependent.
Parameters separated using the pipe | operator are mutually exclusive.

Copy the example to a text editor and modify as-needed before running the command in the terminal/shell.

mc admin user rm

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc admin user rm command removes a MinIO user on the target MinIO deployment.

The mc admin user remove command has equivalent functionality to mc admin user rm.

To manage external Identity Provider users, see OIDC or AD/LDAP.

The following command removes user myuser on the myminio MinIO deployment:

mc admin user rm myminio myuser

Removes a user on the target MinIO deployment.

mc admin user svcacct ls

Mon, 01 Jan 0001 00:00:00 +0000

Important

This command has been replaced and will be deprecated in a future MinIO Client release.

As of MinIO Client RELEASE.2024-10-08T09-37-26Z, use the mc admin accesskey ls command to list access keys for built-in MinIO IDP users.

For access keys for AD/LDAP users, use the mc idp ldap accesskey ls command.

Syntax

The mc admin user svcacct ls command lists all access keys associated to the specified user.

The alias mc admin user svcacct list has equivalent functionality to mc admin user svcacct ls.

mc anonymous set-json

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc anonymous set-json command sets anonymous (i.e. unauthenticated or public) access policies for a bucket using using an IAM JSON policy document.

Buckets with anonymous policies allow clients to access the bucket contents and perform actions consistent with the specified policy without authentication.

The following command applies the JSON-formatted anonymous policy to the mydata bucket on the myminio MinIO deployment:

mc batch status

Mon, 01 Jan 0001 00:00:00 +0000

Changed: MinIO

RELEASE.2022-10-08T20-11-00Z or later

Syntax

The mc batch status command outputs summaries of job events on a MinIO server.

Changed: mc

RELEASE.2024-07-03T20-17-25Z

Batch status displays summaries for active, in-progress jobs or any batch job completed in the previous three (3) days.

The following command outputs the status of the specified job with JobID KwSysDpxcBU9FNhGkn2dCf currently in progress on the myminio alias.

mc cp

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc cp command copies objects to or from a MinIO deployment, where the source can MinIO or a local filesystem.

You can also use mc cp against the local filesystem to produce similar results to the cp commandline tool.

Note

mc cp only copies the latest version or the specified version of an object without any version information or modification date. To copy all versions, version information, and related metadata, use mc replicate add or mc admin replicate.

mc idp ldap accesskey rm

Mon, 01 Jan 0001 00:00:00 +0000

Description

The mc idp ldap accesskey rm deletes the specified access key from the local server.

mc idp ldap accesskey rm is also known as mc idp ldap accesskey remove.

This command works against access keys created by an AD/LDAP user after authenticating to MinIO.

Create AD/LDAP service accounts with the mc idp ldap accesskey create command.

MinIO supports using AssumeRoleWithLDAPIdentity to generate temporary access keys using the Security Token Service.

The following example deletes the access key mykey from the minio deployment:

mc idp ldap rm

Mon, 01 Jan 0001 00:00:00 +0000

Description

The mc idp ldap rm command removes the existing configuration for an AD/LDAP provider.

mc idp ldap rm is also known as mc idp ldap remove.

The following example removes the AD/LDAP provider settings for the myminio deployment.

mc idp ldap rm \
 myminio

The command has the following syntax:

mc ilm rm

Mon, 01 Jan 0001 00:00:00 +0000

Changed: RELEASE.2022-12-24T15-21-38Z

mc ilm rm replaced by mc ilm rule rm.

Syntax

The mc ilm rm command removes an object lifecycle management rule from a MinIO Bucket.

The mc ilm remove command has equivalent functionality to mc ilm rm.

The following command removes a single lifecycle management rule from the mydata bucket on the myminio MinIO deployment:

mc ilm rule rm

Mon, 01 Jan 0001 00:00:00 +0000

Changed: RELEASE.2022-12-24T15-21-38Z

mc ilm rule rm replaces mc ilm rm.

Syntax

The mc ilm rule rm command removes an object lifecycle management rule from a MinIO Bucket.

The following command removes a single lifecycle management rule from the mydata bucket on the myminio MinIO deployment:

mc ilm rule rm --id "bgrt1ghju" myminio/mydata

The command has the following syntax:

mc ilm tier update

Mon, 01 Jan 0001 00:00:00 +0000

Changed: RELEASE.2022-12-24T15-21-38Z

mc ilm tier update replaces mc admin tier edit.

Description

The mc ilm tier update command modifies an existing configured remote tier.

Use mc admin on MinIO Deployments Only

MinIO does not support using mc admin commands with other S3-compatible services, regardless of their claimed compatibility with MinIO deployments.

Supported S3 Services

mc ilm tier supports only the following S3-compatible services as a remote target for object tiering:

mc replicate rm

Mon, 01 Jan 0001 00:00:00 +0000

Changed: RELEASE.2022-12-24T15-21-38Z

mc replicate rm replaces the mc admin bucket remote rm command. Removing the replication automatically removes the underlying remote target.

Syntax

The mc replicate rm command removes a replication rule from a MinIO bucket.

The mc replicate remove command has equivalent functionality to mc replicate rm.

mc [GLOBALFLAGS] replicate rm FLAGS [FLAGS] ALIAS

The following command removes the replication rule with specified id from the mydata bucket on the myminio MinIO deployment:

mc support proxy

Mon, 01 Jan 0001 00:00:00 +0000

Description

Use the mc support proxy command to configure a proxy to use to communicate with MinIO SUBNET.

Examples

Set a Proxy URL

Define the proxy URL to use when the deployment minio1 communicates to SUBNET. The proxy URL in the example is http://my.proxy.

mc support proxy set minio1 http://my.proxy

Remove the Proxy URL Configured for a Deployment

The following command removes the URL configured as the proxy for the alias minio1.

Metrics and Logging Settings

Mon, 01 Jan 0001 00:00:00 +0000

This page covers settings that control behavior related to MinIO metrics and logging. See Metrics and alerts for more information.

These settings configure publishing regular minio server logs and audit logs to an HTTP webhook. See Publish Server or Audit Logs to an External Service for more complete documentation.

You can establish or modify settings by defining:

an environment variable on the host system prior to starting or restarting the MinIO Server. Refer to your operating system’s documentation for how to define an environment variable.
a configuration setting using mc admin config set.

If you define both an environment variable and the similar configuration setting, MinIO uses the environment variable value.

MinIO External Access Management Plugin

Mon, 01 Jan 0001 00:00:00 +0000

Overview

The MinIO Access Management Plugin provides a REST interface for offloading authorization through a webhook service.

Once enabled, MinIO sends the request and credential details for every API call to the configured external HTTP(S) endpoint and looks for a response of ALLOW or DENY. MinIO can therefore delegate the access management to the external system instead of relying on S3 policy based access control.

Configuration Settings

You can configure the MinIO External Access Management Plugin using the following environment variables or configuration settings.

NATS Notification Settings

Mon, 01 Jan 0001 00:00:00 +0000

NATS Streaming Deprecated

NATS Streaming is deprecated. Migrate to JetStream instead.

The related MinIO configuration options and environment variables are deprecated.

This page documents settings for configuring an NATS service as a target for Bucket Notifications. See Publish Events to NATS for a tutorial on using these settings.

You can establish or modify settings by defining:

an environment variable on the host system prior to starting or restarting the MinIO Server. Refer to your operating system’s documentation for how to define an environment variable.
a configuration setting using mc admin config set.

If you define both an environment variable and the similar configuration setting, MinIO uses the environment variable value.

Publish Events to Kafka

Mon, 01 Jan 0001 00:00:00 +0000

MinIO supports publishing bucket notification events to a Kafka service endpoint.

MinIO relies on the https://github.com/Shopify/sarama project for Kafka connectivity and shares that project’s Kafka support. See the sarama Compatibility and API stability section for more details.

Add a Kafka Endpoint to a MinIO Deployment

The following procedure adds a new Kafka service endpoint for supporting bucket notifications in a MinIO deployment.

Prerequisites

Kafka Minimum Versions and Supported Versions

Thresholds and Limits

Mon, 01 Jan 0001 00:00:00 +0000

This page reflects limits and thresholds that apply to MinIO.

Refer to the hardware and software for related recommendations and requirements.

S3 API Limits

Item

Specification

Maximum object size

50 TiB

Minimum object size

0 B

Maximum object size per PUT operation

5 TiB for non-multipart upload
50 TiB for multipart upload

Maximum number of parts per upload

10,000

Part size range

CVE-2026-41145: Unsigned-Trailer Query Authentication Bypass

Thu, 16 Apr 2026 00:00:00 +0000

Status: Released
First containing release: RELEASE.2026-04-17T00-00-00Z
GitHub advisory: GHSA-hv4r-mvr4-25vw

Query-string SigV4 credentials could enter a STREAMING-UNSIGNED-PAYLOAD-TRAILER data flow, while the old code verified the signature only when an Authorization header was present. A request carrying a valid access-key identifier could therefore complete a write without a correct signature.

The final fix moved presigned rejection and SigV4 verification into newUnsignedV4ChunkedReader(), making every caller consuming that stream share one authentication boundary.

Identifier note

The official CVE had not been assigned when the patch was written, so its commit subject used fake CVE-2026-40027. The final identifier is CVE-2026-41145. The historical commit remains unchanged; public material uses the official identifier.

SILO 20251203 Released

Mon, 15 Dec 2025 00:00:00 +0000

Published: 2025-12-15 · Version: RELEASE.2025-12-03T12-00-00Z

This is the earliest traceable community release. Its purpose is to establish the community packaging and distribution baseline rather than to deliver incremental fixes over an earlier community release.

Major Changes

Build the community packaging flow around minio/pkger.
Choose a maintenance-mode upstream MinIO baseline as the starting point for the community-maintained fork.
Produce the first apk, deb, and rpm artifacts for ongoing community releases.

Fixed CVEs

This is the first community release. The GitHub Release does not provide a delta-style security-fix list against an earlier community version, and this page does not attempt to reconstruct the full historical CVE delta against the upstream maintenance baseline.

d4cd4b4: RELEASE.2025-12-03T12-00-00Z with go 1.25.5

mc admin accesskey rm

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc admin accesskey rm command removes an access key associated to a user on the deployment.

The mc admin accesskey remove command has equivalent functionality to mc admin accesskey rm.

Warning

Applications can no longer authenticate using the access key after its removal.

The following command removes the specified access key:

mc admin heal

Mon, 01 Jan 0001 00:00:00 +0000

Description

The mc admin heal command scans for objects that are damaged or corrupted and heals those objects.

mc admin heal is resource intensive and typically not required as a manual process, even after drive failures or corruption events.

As a part of normal operations, MinIO:

automatically heals objects damaged by silent bit rot corruption, drive failure, or other issues on each POST or GET operation.
performs periodic background object healing using the scanner.
aggressively heals objects after drive replacement.

Refer to Object Healing for more details on how MinIO heals objects.

mc admin policy rm

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

Removes an IAM policy from the target MinIO deployment.

The mc admin policy remove command has equivalent functionality to mc admin policy rm.

The following command removes the policy names writeonly from the myminio MinIO deployment:

mc admin policy rm myminio writeonly

The command has the following syntax:

mc admin policy rm TARGET POLICYNAME

Brackets [] indicate optional parameters.
Parameters sharing a line are mutually dependent.
Parameters separated using the pipe | operator are mutually exclusive.

Copy the example to a text editor and modify as-needed before running the command in the terminal/shell.

mc admin user sts info

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc admin user sts info command retrieves information on the specified STS credential, such as the parent MinIO user who generated the credentials, associated policies, and expiration.

STS credentials provide temporary access to the MinIO deployment.

The following command retrieves information on the STS credentials with specified access key:

mc admin user sts info myminio/ "J123C4ZXEQN8RK6ND35I"

The command has the following syntax:

mc admin user svcacct rm

Mon, 01 Jan 0001 00:00:00 +0000

Important

This command has been replaced and will be deprecated in a future MinIO Client release.

As of MinIO Client RELEASE.2024-10-08T09-37-26Z, use the mc admin accesskey rm command to delete access keys for built-in MinIO IDP users.

For access keys for AD/LDAP users, use the mc idp ldap accesskey rm command.

Syntax

The mc admin user svcacct rm command removes an access key associated to a user on the deployment.

mc diff

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc diff mc computes the differences between two filesystem directories or MinIO buckets. mc diff lists only those objects which are missing or which differ in size. mc diff does not compare the contents of objects.

The following command computes the difference between an object on a local filesystem and an object in the mydata bucket on the myminio MinIO deployment:

mc idp ldap update

Mon, 01 Jan 0001 00:00:00 +0000

Description

The mc idp ldap update command modifies an existing set of configurations for an AD/LDAP provider.

The following example changes two of the AD/LDAP configuration settings for the myminio deployment.

mc idp ldap update \
 myminio \
 lookup_bind_dn=cn=admin,dc=min,dc=io \
 lookup_bind_password=somesecret

The command has the following syntax:

mc [GLOBALFLAGS] idp ldap update \
 ALIAS \
 [CFG_PARAM1] \
 [CFG_PARAM2]...

Replace ALIAS with the alias of a MinIO deployment to update for AD/LDAP integration.

mc replicate status

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc replicate status command displays the replication status of a MinIO bucket. The status also lists the remote target path or location.

The following command displays the current replication status of the mydata bucket on the myminio MinIO deployment:

mc replicate status myminio/mydata

The command has the following syntax:

NSQ Notification Settings

Mon, 01 Jan 0001 00:00:00 +0000

This page documents settings for configuring an NSQ service as a target for Bucket Notifications. See Publish Events to NSQ for a tutorial on using these settings.

You can establish or modify settings by defining:

an environment variable on the host system prior to starting or restarting the MinIO Server. Refer to your operating system’s documentation for how to define an environment variable.
a configuration setting using mc admin config set.

If you define both an environment variable and the similar configuration setting, MinIO uses the environment variable value.

Publish Events to MySQL

Mon, 01 Jan 0001 00:00:00 +0000

MinIO supports publishing bucket notification events to a MySQL service endpoint. MinIO supports MySQL 5.7.8 and later only.

Add a MySQL Endpoint to a MinIO Deployment

The following procedure adds a new MySQL service endpoint for supporting bucket notifications in a MinIO deployment.

Prerequisites

MySQL 5.7.8 and later

MinIO relies on features introduced with MySQL 5.7.8.

MinIO `mc` Command Line Tool

This procedure uses the mc command line tool for certain actions. See the mc Quickstart for installation instructions.

Rust Quickstart Guide

Mon, 01 Jan 0001 00:00:00 +0000

MinIO Rust SDK for Amazon S3 Compatible Cloud Storage

The MinIO Rust SDK is a Simple Storage Service (aka S3) client for performing bucket and object operations to any Amazon S3 compatible object storage service. It provides a strongly-typed, async-first interface to the MinIO and Amazon S3-compatible object storage APIs.

Each supported S3 operation has a corresponding request builder (for example: [BucketExists], [PutObject], [UploadPartCopy]), which allows users to configure request parameters using a fluent builder pattern.

CVE-2026-42600: ReadMultiple Storage-REST Path Traversal

Fri, 12 Jun 2026 00:00:00 +0000

Status: Released
First containing release: RELEASE.2026-06-18T00-00-00Z
GitHub advisory: GHSA-xh8f-g2qw-gcm7
Affected scope: Distributed erasure only; cluster-root / internode JWT required

The msgpack body of /rmpl carried Bucket, Prefix, and Files. The old code joined those values into filesystem paths without a containment check. The initial fix implemented full preflight validation. Continued call-chain review then found that this API had had no production caller since 2024. The final solution changed from “retain and harden” to removing the route, handler, client, interface, and generated code.

mc admin info

Mon, 01 Jan 0001 00:00:00 +0000

Description

The mc admin info command displays information on a MinIO server. For distributed MinIO deployments, mc admin info displays information for each MinIO server in the deployment.

Added: mc

RELEASE.2024-05-03T11-21-07Z

The command output includes information about the erasure code setting for the cluster. This displays in the output in the format EC:#.

The output of the command resembles the following:

● play.min.io
 Uptime: 2 hours
 Version: 2024-05-10T08:24:14Z
 Network: 1/1 OK
 Drives: 4/4 OK
 Pool: 1

Pools:
 1st, Erasure sets: 1, Drives per erasure set: 4

0 B Used, 3 Buckets, 0 Objects
4 drives online, 0 drives offline, EC:1

Examples

The following example assumes that the play alias exists in the mc configuration file. You can replace play with the alias for your preferred S3-compatible deployment.

mc du

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc du command summarizes the disk usage of buckets and folders. You can also use du against the local filesystem to produce similar results as the du command.

The following command prints the disk usage of the mybucket bucket on the myminio MinIO deployment:

mc du play/mybucket

The output resembles the following:

mc replicate export

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc replicate export command exports the JSON-formatted replication rules for a MinIO bucket to STDOUT.

The following command exports the replication configuration for the mydata bucket on the myminio MinIO deployment:

mc replicate export myminio/mydata > mydata-replication.json

The command has the following syntax:

mc [GLOBALFLAGS] export ALIAS

Brackets [] indicate optional parameters.
Parameters sharing a line are mutually dependent.
Parameters separated using the pipe | operator are mutually exclusive.

Copy the example to a text editor and modify as-needed before running the command in the terminal/shell.

mc support upload

Mon, 01 Jan 0001 00:00:00 +0000

Description

mc support upload copies a file from the local file system to a SUBNET ticket.

SUBNET Registration Required

Syntax

The mc support profile command has the following syntax:

mc [GLOBALFLAGS] support profile \
 ALIAS \
 FILE \
 [--comment "string"] \
 [--enc] \
 [--issue integer]

Parameters

`ALIAS`

mc-cmd

PostgreSQL Notification Settings

Mon, 01 Jan 0001 00:00:00 +0000

This page documents settings for configuring an POSTGRES service as a target for Bucket Notifications. See Publish Events to PostgreSQL for a tutorial on using these settings.

You can establish or modify settings by defining:

an environment variable on the host system prior to starting or restarting the MinIO Server. Refer to your operating system’s documentation for how to define an environment variable.
a configuration setting using mc admin config set.

If you define both an environment variable and the similar configuration setting, MinIO uses the environment variable value.

Publish Events to PostgreSQL

Mon, 01 Jan 0001 00:00:00 +0000

MinIO supports publishing bucket notification events to PostgreSQL. MinIO supports PostgreSQL 9.5 and later only.

Add a PostgreSQL Endpoint to a MinIO Deployment

The following procedure adds a new PostgreSQL service endpoint for supporting bucket notifications in a MinIO deployment.

Prerequisites

PostgreSQL 9.5 and later

MinIO relies on features introduced with PostgreSQL 9.5.

MinIO `mc` Command Line Tool

This procedure uses the mc command line tool for certain actions. See the mc Quickstart for installation instructions.

ILM Settings

Mon, 01 Jan 0001 00:00:00 +0000

This page covers settings that control Information Lifecycle Management (ILM) for the MinIO process.

You can establish or modify settings by defining:

an environment variable on the host system prior to starting or restarting the MinIO Server. Refer to your operating system’s documentation for how to define an environment variable.
a configuration setting using mc admin config set.

If you define both an environment variable and the similar configuration setting, MinIO uses the environment variable value.

mc admin kms key

Mon, 01 Jan 0001 00:00:00 +0000

Description

The mc admin kms key command performs cryptographic key management operations through the MinIO Key Encryption Service (KES).

Use mc admin on MinIO Deployments Only

MinIO does not support using mc admin commands with other S3-compatible services, regardless of their claimed compatibility with MinIO deployments.

Syntax

`mc admin kms key create`

mc-cmd

Creates a new master key on a Key Management System (KMS).

The command has the following syntax:

mc replicate import

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc replicate import command imports JSON-formatted replication rules for a MinIO bucket from STDIN.

The following command imports the replication configuration for the mydata bucket on the myminio MinIO deployment:

mc replicate import myminio/mydata < mydata-replication.json

The command has the following syntax:

mc [GLOBALFLAGS] import ALIAS

Brackets [] indicate optional parameters.
Parameters sharing a line are mutually dependent.
Parameters separated using the pipe | operator are mutually exclusive.

Copy the example to a text editor and modify as-needed before running the command in the terminal/shell.

Publish Events to Redis

Mon, 01 Jan 0001 00:00:00 +0000

MinIO supports publishing bucket notification events to a Redis service endpoint.

Add a Redis Endpoint to a MinIO Deployment

The following procedure adds a new Redis service endpoint for supporting bucket notifications in a MinIO deployment.

Prerequisites

MinIO `mc` Command Line Tool

This procedure uses the mc command line tool for certain actions. See the mc Quickstart for installation instructions.

1) Add the Redis Endpoint to MinIO

You can configure a new Redis service endpoint using either environment variables or by setting runtime configuration settings.

Redis Notification Settings

Mon, 01 Jan 0001 00:00:00 +0000

This page documents settings for configuring a Redis service as a target for Bucket Notifications. See Publish Events to Redis for a tutorial on using these settings.

You can establish or modify settings by defining:

an environment variable on the host system prior to starting or restarting the MinIO Server. Refer to your operating system’s documentation for how to define an environment variable.
a configuration setting using mc admin config set.

If you define both an environment variable and the similar configuration setting, MinIO uses the environment variable value.

Key Encryption Service Settings

Mon, 01 Jan 0001 00:00:00 +0000

MinIO Server includes three groups of environment variables to manage how the MinIO Server interacts with the Key Encryption Service (KES), Key Management Service (KMS), or static key files. You may only define one of the three sets. If more than one type of environment variable sets is defined, MinIO returns an error.

Note

These settings do not have configuration setting options for use with mc admin config set.

mc admin logs

Mon, 01 Jan 0001 00:00:00 +0000

SUBNET Registration Required

Changed: RELEASE.2022-12-02T23-48-47Z

mc support logs moved to mc admin logs and provide a simpler command interface for displaying server logs for the MinIO deployment.

The output is similar to what is available via journalctl -uf minio for systemd-controlled deployments.

Publish Events to Webhook

Mon, 01 Jan 0001 00:00:00 +0000

MinIO supports publishing bucket notification events to a Webhook service endpoint.

Add a Webhook Endpoint to a MinIO Deployment

The following procedure adds a new Webhook service endpoint for supporting bucket notifications in a MinIO deployment.

Prerequisites

MinIO `mc` Command Line Tool

This procedure uses the mc command line tool for certain actions. See the mc Quickstart for installation instructions.

1) Add the Webhook Endpoint to MinIO

You can configure a new Webhook service endpoint using either environment variables or by setting runtime configuration settings.

Webhook Service Notification Settings

Mon, 01 Jan 0001 00:00:00 +0000

This page documents settings for configuring an Webhook service as a target for Bucket Notifications. See Publish Events to Webhook for a tutorial on using these settings.

You can establish or modify settings by defining:

an environment variable on the host system prior to starting or restarting the MinIO Server. Refer to your operating system’s documentation for how to define an environment variable.
a configuration setting using mc admin config set.

If you define both an environment variable and the similar configuration setting, MinIO uses the environment variable value.

mc admin bucket quota

Mon, 01 Jan 0001 00:00:00 +0000

Changed: RELEASE.2022-12-13T00-23-28Z

mc admin bucket quota replaced by:

Description

The mc admin bucket quota command manages per-bucket storage quotas.

Use mc admin on MinIO Deployments Only

MinIO does not support using mc admin commands with other S3-compatible services, regardless of their claimed compatibility with MinIO deployments.

Units of Measurement

The mc admin bucket quota --hard flag accepts the following case-insensitive suffixes to represent the unit of the specified size value:

mc find

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc find command supports searching for objects on a MinIO deployment. You can also use the command to search for files on a filesystem.

The following command searches for all objects matching the specified pattern in the mydata bucket on the myminio MinIO deployment:

mc find myminio/mydata --name "*.jpg"

The command has the following syntax:

Object Lambda function settings

Mon, 01 Jan 0001 00:00:00 +0000

This page describes the settings available to configure MinIO to publish data to an HTTP webhook endpoint and trigger an Object Lambda function. See Transforms with Object Lambda for more complete documentation and tutorials on using these settings.

You can establish or modify settings by defining:

an environment variable on the host system prior to starting or restarting the MinIO Server. Refer to your operating system’s documentation for how to define an environment variable.
a configuration setting using mc admin config set.

If you define both an environment variable and the similar configuration setting, MinIO uses the environment variable value.

Deprecated Settings

Mon, 01 Jan 0001 00:00:00 +0000

This page covers deprecated settings that control core behavior of the MinIO process.

Settings on this page may be removed at any time. Users should migrate to the recommended replacement at the earliest opportunity.

You can establish or modify settings by defining:

an environment variable on the host system prior to starting or restarting the MinIO Server. Refer to your operating system’s documentation for how to define an environment variable.
a configuration setting using mc admin config set.

If you define both an environment variable and the similar configuration setting, MinIO uses the environment variable value.

mc admin bucket remote

Mon, 01 Jan 0001 00:00:00 +0000

Changed: RELEASE.2022-12-24T15-21-38Z

mc admin bucket remote add replaced by mc replicate add
mc admin bucket remote update replaced by mc replicate update
mc admin bucket remote rm replaced by mc replicate rm
mc admin bucket remote ls replaced by mc replicate ls

Changed: RELEASE.2023-02-16T19-20-11Z

mc admin bucket remote bandwidth replaced by mc replicate status

Replication related statistics are moving to the mc replicate status command.

Description

The mc admin bucket remote command manages the ARN resources for use with bucket replication.

mc get

Mon, 01 Jan 0001 00:00:00 +0000

Added: mc

RELEASE.2024-02-24T01-33-20Z

Syntax

The mc get command downloads an object from a target S3 deployment to the local file system.

mc get provides a simplified interface for downloading files compared to mc cp or mc mirror. mc get uses a one-way download function that trades efficiency for the power and complexity of the other commands.

The following downloads the file logo.png from an s3 source to the local file system at path ~/images/collateral/.

mc admin console

Mon, 01 Jan 0001 00:00:00 +0000

Important

This command has been replaced by mc admin logs in mc RELEASE.2022-12-02T23-48-47Z.

The command was previously replaced by mc support logs show in mc RELEASE.2022-06-26T18-51-48Z.

Description

The mc admin console command returns server log entries for each MinIO server in the deployment.

Use mc admin on MinIO Deployments Only

MinIO does not support using mc admin commands with other S3-compatible services, regardless of their claimed compatibility with MinIO deployments.

Syntax

mc admin console has the following syntax:

mc admin rebalance

Mon, 01 Jan 0001 00:00:00 +0000

Permission

This command requires that the user performing it have the admin:Rebalance policy action for the deployment.

Description

The mc admin rebalance command allows starts, monitors, or stops a rebalancing operation on a MinIO deployment. Rebalancing redistributes objects across all pools in the deployment.

MinIO does not automatically rebalance objects when adding a new server pool. Instead, MinIO writes new objects to the pool with relatively more free space compared to the other available pools on the deployment. Triggering a manual rebalancing procedure prompts MinIO to scan the entire deployment and move objects as necessary to achieve a similar available free space across all pools.

mc head

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc head command displays the first n lines of an object, where n is an argument specified to the command.

mc head does not perform any transformation or formatting of object contents to facilitate readability. You can also use mc head against the local filesystem to produce similar results to the head commandline tool.

The following command returns the first 10 lines of an object in the mydata bucket on the myminio MinIO deployment:

mc admin idp ldap

Mon, 01 Jan 0001 00:00:00 +0000

Changed: RELEASE.2023-05-26T23-31-54Z

mc admin idp ldap and its subcommands replaced by mc idp ldap.

Description

The mc admin idp ldap commands allow you to add, modify, review, list, remove, enable, and disable server configurations to 3rd party Active Directory or LDAP Identity and Access Management (IAM) integrations.

Define configuration settings as an alternative to using environment variables when setting up an AD/LDAP connection.

Note

Configuration settings do not override settings configured as environment variables.

mc admin replicate

Mon, 01 Jan 0001 00:00:00 +0000

Changed: RELEASE.2023-01-11T03-14-16Z

mc admin replicate edit renamed to mc admin replicate update
mc admin replicate remove renamed to mc admin replicate rm

Description

The mc admin replicate command creates and manages site replication for a set of MinIO peer sites.

Site replication mimics an active-active bucket replication, but for multiple MinIO deployments. Wherever a change occurs to IAM settings, buckets, or objects across the set of sites, the change replicates across all sites in the site replication group.

mc admin idp ldap policy

Mon, 01 Jan 0001 00:00:00 +0000

Changed: RELEASE.2023-05-26T23-31-54Z

mc admin idp ldap policy and its subcommands replaced by mc idp ldap policy.

Description

The mc admin idp ldap policy command allows you to view the mapping relationships between policies and the associated groups or users.

The mc admin idp ldap policy command has the following subcommands:

Subcommand	Description
`mc admin idp ldap policy attach`	Attach a policy to an entity
`mc admin idp ldap policy detach`	Detach a policy from an entity
`mc admin idp ldap policy entities`	List policy entity mappings

Syntax

`attach`

mc-cmd

mc admin idp openid

Mon, 01 Jan 0001 00:00:00 +0000

Changed: RELEASE.2023-05-26T23-31-54Z

mc admin idp openid and its subcommands replaced by mc idp openid.

Description

The mc admin idp openid commands allow you to add, modify, review, list, remove, enable, and disable server configurations to 3rd party OpenID Identity and Access Management (IAM) integrations.

Define configuration settings as an alternative to using environment variables when setting up an OpenID connection.

The mc admin idp openid command has the following subcommands:

Subcommand	Description
`mc admin idp openid add`	Create an OpenID IDP server configuration.
`mc admin idp openid update`	Modify an existing OpenID IDP server configuration.
`mc admin idp openid rm`	Remove an OpenID IDP server configuration from a deployment.
`mc admin idp openid ls`	Outputs a list of the existing OpenID server configurations for a deployment.
`mc admin idp openid info`	Displays details for a specific OpenID server configuration.
`mc admin idp openid enable`	Enables an OpenID server configuration.
`mc admin idp openid disable`	Disables an OpenID server configuration.

Configuration Parameters

The mc admin idp openid subcommands support configuration parameters. The parameters define the server’s interaction with the IAM provider.

mc admin service

Mon, 01 Jan 0001 00:00:00 +0000

Description

The mc admin service command can restart or unfreeze MinIO servers.

mc admin service affects all MinIO servers in the target deployment at the same time. The command interrupts in-progress API operations on the MinIO deployment. Use caution when issuing this command to a deployment.

Use mc admin on MinIO Deployments Only

MinIO does not support using mc admin commands with other S3-compatible services, regardless of their claimed compatibility with MinIO deployments.

mc idp ldap accesskey create-with-login

Mon, 01 Jan 0001 00:00:00 +0000

Added: mc

RELEASE.2024-04-18T16-45-29Z

Description

The mc idp ldap accesskey create-with-login uses interactive terminal-based prompt to authenticate with the external AD/LDAP server and generate access keys for use with MinIO.

The following example prompts the user to provide their AD/LDAP credentials. It then generates a new access key pair using the policy or policies associated with that AD/LDAP user.

mc admin profile

Mon, 01 Jan 0001 00:00:00 +0000

Note

This command has been replaced by mc support profile as of mc RELEASE.2023-04-06T16-51-10Z.

Description

The mc admin profile command generates profiling data for debugging purposes.

Use mc admin on MinIO Deployments Only

MinIO does not support using mc admin commands with other S3-compatible services, regardless of their claimed compatibility with MinIO deployments.

Profile Data Format

mc admin profile produces a ZIP archive profile.zip that contains one or more .pprof files. Use the pprof go utility to read the profile data.

mc admin trace

Mon, 01 Jan 0001 00:00:00 +0000

Description

The mc admin trace command displays API operations occurring on the target MinIO deployment.

Use mc admin on MinIO Deployments Only

MinIO does not support using mc admin commands with other S3-compatible services, regardless of their claimed compatibility with MinIO deployments.

Examples

Monitor All API operations

Use mc admin trace to monitor API operations on a MinIO deployment:

mc admin trace -a ALIAS

Replace ALIAS with the alias of the MinIO deployment.

See Calls that Return 503 Errors

Use mc admin trace to monitor API operations that return a service unavailable 503 error:

Core Administration Concepts

Mon, 01 Jan 0001 00:00:00 +0000

The following core concepts are fundamental to the administration of MinIO deployments, including but not limited to object retention, encryption, and access management.

What Is Object Storage?

An object is binary data, sometimes referred to as a Binary Large OBject (BLOB). Blobs can be images, audio files, spreadsheets, or even binary executable code. Object Storage platforms like MinIO provide dedicated tools and capabilities for storing, retrieving, and searching for blobs.

mc admin speedtest

Mon, 01 Jan 0001 00:00:00 +0000

Changed: RELEASE.2022-07-24T02-25-13Z

mc admin speedtest replaced by mc support perf.

Description

The mc admin speedtest command tests throughputs per host with PUT and GET operations.

speedtest is available starting with mc RELEASE.2021-09-02T09-21-27Z and supports distributed MinIO deployments running RELEASE.2021-07-30T00-02-00Z or later.

speedtest does not support standalone or MinIO Gateway deployments.

Use mc admin on MinIO Deployments Only

MinIO does not support using mc admin commands with other S3-compatible services, regardless of their claimed compatibility with MinIO deployments.

mc admin update

Mon, 01 Jan 0001 00:00:00 +0000

Description

The mc admin update command updates all MinIO servers in the deployment. The command also supports using a private mirror server for environments where the deployment does not have public internet access.

After running the command, a prompt displays to confirm the update. Type y and [ENTER] to confirm and proceed with the update.

The user must have write permissions for the target location where the binary installs.

mc idp openid

Mon, 01 Jan 0001 00:00:00 +0000

Added: RELEASE.2023-05-26T23-31-54Z

mc idp openid and its subcommands replace mc admin idp openid.

Description

The mc idp openid commands allow you to manage configurations to 3rd party OpenID Identity and Access Management (IAM) integrations.

Define configuration settings as an alternative to using environment variables when setting up an OpenID connection. The mc idp openid commands are only supported against MinIO deployments.

Note

MinIO OpenID environment variables override their corresponding configuration settings as modified or set by this command.

mc admin tier

Mon, 01 Jan 0001 00:00:00 +0000

Changed: RELEASE.2022-12-24T15-21-38Z

mc admin tier replaced by mc ilm tier.

Description

The mc admin tier command configures a remote supported S3-compatible service for supporting MinIO Lifecycle Management: Object Transition (“Tiering”).

Use mc admin on MinIO Deployments Only

MinIO does not support using mc admin commands with other S3-compatible services, regardless of their claimed compatibility with MinIO deployments.

Supported S3 Services

mc admin tier supports only the following S3-compatible services as a remote target for object tiering:

mc admin top

Mon, 01 Jan 0001 00:00:00 +0000

Changed: RELEASE.2022-08-11T00-30-48Z

mc admin top replaced by mc support top.

Description

The mc admin top command returns statistics for distributed MinIO deployments, similar to the output of the top command.

Use mc admin on MinIO Deployments Only

MinIO does not support using mc admin commands with other S3-compatible services, regardless of their claimed compatibility with MinIO deployments.

Syntax

`mc admin top locks`

mc-cmd

Returns the 10 oldest locks on the MinIO deployment.

Transforms with Object Lambda

Mon, 01 Jan 0001 00:00:00 +0000

MinIO’s Object Lambda enables developers to programmatically transform objects on demand. You can transform objects as needed for your use case, such as redacting personally identifiable information (PII), enriching data with information from other sources, or converting between formats.

Overview

An Object Lambda handler is a small code module that transforms the contents of an object and returns the results. Like Amazon S3 Object Lambda functions, you trigger a MinIO Object Lambda handler function with a GET request from an application. The handler retrieves the requested object from MinIO, transforms it, and returns the modified data back to MinIO to send to the original application. The original object remains unchanged.

File Transfer Protocol (FTP/SFTP)

Mon, 01 Jan 0001 00:00:00 +0000

File Transport Using FTP and SFTP with MinIO

Starting with Operator 5.0.7 and MinIO Server RELEASE.2023-04-20T17-56-55Z, you can use the SSH File Transfer Protocol (SFTP) to interact with the objects on a MinIO Operator Tenant deployment.

SFTP is defined by the Internet Engineering Task Force (IETF) as an extension of SSH 2.0. It allows file transfer over SSH for use with Transport Layer Security (TLS) and virtual private network (VPN) applications.

mc ls

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc ls command lists buckets and objects on MinIO or another S3-compatible service.

You can also use mc ls against the local filesystem to produce similar results as the ls command.

The following command lists all objects and object versions in the mydata bucket on the myminio MinIO deployment:

mc ls --recursive --versions myminio/mydata

The output resembles the following:

mc mb

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc mb command creates a new bucket or directory at the specified path.

You can also use mc mb against the local filesystem to produce similar results to the mkdir -p commandline tool.

The following command creates a new bucket mydata on the myminio MinIO deployment. The command creates the bucket with object locking enabled.

mc mirror

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc mirror command synchronizes content to MinIO deployment, similar to the rsync utility. mc mirror supports filesystems, MinIO deployments, and other S3-compatible hosts as the synchronization source.

Note

mc mirror only synchronizes the current object without any version information or metadata. To synchronize an object’s version history and metadata, consider using mc replicate for bucket replication or mc admin replicate for site replication.

The following command synchronizes content from a local filesystem directory to the mydata bucket on the myminio MinIO deployment.

mc mv

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc mv command moves an object from source to the target, such as between MinIO deployments or between buckets on the same MinIO deployment. mc mv also supports moving objects between a local filesystem and MinIO.

You can also use mc mv against the local filesystem to produce similar results to the mv commandline tool.

The following command moves objects from the mydata bucket to the archive bucket on the myminio MinIO deployment:

S3 API Compatibility

Mon, 01 Jan 0001 00:00:00 +0000

This page documents S3 APIs supported by MinIO Object Storage. For reference documentation on any given API, see the corresponding documentation for Amazon S3.

Important

MinIO strongly recommends using an S3-Compatible SDK for performing object storage operations.

Object APIs

Object Locking

Unsupported API Object Endpoints

GetObjectAcl
PutObjectAcl

Multipart Uploads

Differences from S3 APIs for Multipart Uploads

ListMultipartUploads requires the exact object name as a prefix.
The AbortIncompleteMultipartUpload lifecycle action is not supported with PutBucketLifecycle.

Bucket APIs

Bucket Replication

Bucket Lifecycle

Bucket Notifications

Bucket Policies

Unsupported API Bucket Operations

GetBucketInventoryConfiguration
PutBucketInventoryConfiguration
DeleteBucketInventoryConfiguration
PutBucketCors
DeleteBucketCors
GetBucketMetricsConfiguration
PutBucketMetricsConfiguration
DeleteBucketMetricsConfiguration
PutBucketWebsite
GetBucketLogging
PutBucketLogging
PutBucketAccelerateConfiguration
DeleteBucketAccelerateConfiguration
PutBucketRequestPayment
DeleteBucketRequestPayment
PutBucketAcl
HeadBucketAcl
GetPublicAccessBlock
PutPublicAccessBlock
DeletePublicAccessBlock
GetBucketOwnershipControls
PutBucketOwnershipControls
DeleteBucketOwnershipControls
GetBucketIntelligentTieringConfiguration
PutBucketIntelligentTieringConfiguration
ListBucketIntelligentTieringConfigurations
DeleteBucketIntelligentTieringConfiguration
GetBucketAnalyticsConfiguration
PutBucketAnalyticsConfiguration
ListBucketAnalyticsConfigurations
DeleteBucketAnalyticsConfiguration
CreateSession

MinIO alternatives for unsupported Bucket resources

For calls to BucketACL or ObjectACL operations, use Policies.
Calls to BucketCORS operations are not needed because CORS is enabled by default on all buckets for all HTTP verbs.
For calls to BucketWebsite operations, use caddy or nginx.
For calls to BucketAnalytics, BucketMetrics, or BucketLogging operations, use Bucket Notifications.

Glossary

Mon, 01 Jan 0001 00:00:00 +0000

access keys

A MinIO deployment or tenant user account with limited account typically used with API calls. Access Keys were previously referred to as “Service Accounts”

active-active

A method of replication that provides bidirectional mirroring of data. With active-active configuration, changing the data at at any storage location also changes the data at the other storage location(s).

See also: active-passive.

active-passive

A method of replication that provides one-way mirroring of data. With the active-passive configuration, changing data at the originating location also changes the data at the destination. However, changing data at the destination does not affect the data on the origin.

mc od

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc od command copies a local file to a remote location in a specified number of parts and part sizes. The command outputs the time it took to upload the file.

Use the mc od to mimic the functionality of the Linux dd command.

The following command Upload 200MiB of a file to a bucket in 5 parts of size 40MiB. The output shows the results of the upload, including the length of time it took for the upload to complete.

mc ping

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc ping command performs a liveness check on a specified target.

The following sends a response request to the target(s) and outputs the minimum, maximum, average, and roundtrip times of the response, as well as the number of errors encountered when processing the request.

mc ping play --count 5

The command pings the deployment at the alias play for five cycles. The output resembles the following:

mc pipe

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc pipe command streams content from STDIN to a target object.

The following command writes contents of STDIN to an S3 compatible storage.

echo "My Meeting Notes" | mc pipe s3/engineering/meeting-notes.txt

The command has the following syntax:

mc [GLOBALFLAGS] pipe \
 TARGET \
 [--attr "string"] \
 [--checksum "string"] \
 [--enc-kms "string"] \
 [--enc-s3 "string"] \
 [--enc-c "string"] \
 [--storage-class, --sc "string"] \
 [--tags "string"]

Brackets [] indicate optional parameters.
Parameters sharing a line are mutually dependent.
Parameters separated using the pipe | operator are mutually exclusive.

Copy the example to a text editor and modify as-needed before running the command in the terminal/shell.

mc put

Mon, 01 Jan 0001 00:00:00 +0000

Added: mc

RELEASE.2024-02-24T01-33-20Z

Syntax

The mc put uploads an object from the local file system to a bucket on a target S3 deployment.

mc put provides a simplified interface for uploading files compared to mc cp or mc mirror. mc put uses a one-way upload function that trades efficiency for the power and complexity of the other commands.

The following uploads the file logo.png from the local file system at path ~/images/collateral/ to a bucket called marketing on the MinIO deployment with the alias of minio.

mc rb

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc rb command removes one or more buckets on MinIO or another S3-compatible service.

To remove only the contents of a bucket, use mc rm instead.

Important

mc rb permanently deletes bucket(s) on the target deployment, including any and all object versions and bucket configurations such as lifecycle management or replication.

You can also use mc rb against the local filesystem to produce similar results to the rm --rf commandline tool.

mc ready

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc ready command checks the status of a cluster and whether the cluster has read and write quorum.

The following sends a GET request to the cluster at alias myminio and returns its status.

mc ready myminio

The command sends a GET request to the deployment at the alias myminio.’ The command repeats the request until it is successful.

mc rm

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc rm command removes objects from a bucket on a MinIO deployment. To completely remove a bucket, use mc rb instead.

You can also use mc rm against the local filesystem to produce similar results to the rm commandline tool.

For more information on how MinIO performs DELETE actions on objects, see Object Deletion.

Important

mc rm supports removing multiple objects or files in a single command. Consider using the --dry-run option to validate that the operation targets only the desired objects/files.

mc sql

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc sql command provides an S3 Select interface for performing sql queries on objects in the specified MinIO deployment.

See Selecting content from objects for more information on S3 Select behavior and limitations.

The following command queries all objects in the mydata bucket on the myminio MinIO deployment:

mc sql --recursive --query "select * from S3Object" myminio/mydata

The command has the following syntax:

mc stat

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc stat command displays information on objects in a MinIO bucket, including object metadata. You can also use it to retrieve bucket metadata.

You can use mc stat against the local filesystem to produce similar results to the stat commandline tool.

The following command displays information on all objects in the mydata bucket on the myminio MinIO deployment:

mc tree

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc tree command lists all prefixes inside a MinIO bucket in a tree format. The command optionally supports listing all objects inside of bucket at each prefix, including the bucket root.

You can also use mc tree against a local filesystem directory to produce similar results to the tree commandline tool.

The following command prints a complete tree of all objects at any depth in the mydata bucket on the myminio MinIO deployment:

mc undo

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc undo command reverses changes due to either a PUT or DELETE operation at a specified path.

The following command reverts the last three uploads and/or deletions of the file.zip object on the myminio deployment in the data bucket:

mc undo myminio/data/file.zip --last 3

The command has the following syntax:

mc update

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc update command automatically updates the mc binary to the latest stable version.

Running this command is equivalent to manually downloading the latest stable binary and using it to replace the existing mc installation on the host machine.

The following command updates the mc binary on the local host:

mc update

The command has the following syntax:

mc watch

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc watch command watches for events on the specified MinIO bucket or local filesystem path. For S3 services, use mc event add to configure bucket event notifications on S3-compatible services.

You can also use mc watch against a local filesystem directory to produce similar results to running the inotify -e modify,create,delete,move command.

The following command watches for events on any object or prefix in the mydata bucket on the myminio MinIO deployment:

API

Mon, 01 Jan 0001 00:00:00 +0000

404: Not Found

MinIO Rust SDK for Amazon S3 Compatible Cloud Storage

Mon, 01 Jan 0001 00:00:00 +0000

Page Not Found

Mon, 01 Jan 0001 00:00:00 +0000

The page you are looking for has moved, been deleted, or does not exist.

Upgrade Legacy MinIO Operators

Mon, 01 Jan 0001 00:00:00 +0000

MinIO supports the following upgrade paths for older versions of the MinIO Operator:

Current Version	Supported Upgrade Target
5.0.15 or later	7.1.1
5.0.0 to 5.0.14	5.0.15
4.2.3 to 4.5.7	4.5.8
4.0.0 through 4.2.2	4.2.3
3.X.X	4.2.2

To upgrade from Operator to 7.1.1 from version 4.5.7 or earlier, you must first upgrade to version 4.5.8, then upgrade to 5.0.15. Depending on your current version, you may need to do one or more intermediate upgrades to reach v4.5.8.

kubectl minio init

Mon, 01 Jan 0001 00:00:00 +0000

Description

The kubectl minio init command initialize the MinIO Operator.

If the Kubernetes cluster has an existing MinIO Operator installation, this command upgrades the Operator to match the MinIO plugin version. For more information on upgrading the MinIO Operator, see Upgrade MinIO Operator.

Syntax

The following command initializes a new MinIO Operator deployment running 7.1.1.

mc idp ldap accesskey create

Mon, 01 Jan 0001 00:00:00 +0000

Added: mc

RELEASE.2023-12-23T08-47-21Z

Description

The mc idp ldap accesskey create allows you to add LDAP access key pairs.

The following example creates a new access key pair with the same policy as the authenticated user on the minio alias:

mc idp ldap accesskey create minio/

The command has the following syntax:

Download & Install SILO

Mon, 01 Jan 0001 00:00:00 +0000

SILO: Community-Maintained MinIO Fork by Pigsty on SILO

SILO 20260618 Released

MinIO Fork, Promise Kept

CVE-2026-32285: The jsonparser Advisory That Required No Patch

Active Directory / LDAP Settings

AMQP Notification Settings

AssumeRoleWithCustomToken

Request Endpoint

Request Query Parameters

Batch Replication

Bucket Versioning

Overview

cert-manager for Operator

Prerequisites

1) Create a CA Issuer for the minio-operator namespace

Configure MinIO for Authentication using Active Directory / LDAP

Overview

Deploy a MinIO Tenant

Deploy MinIO on RedHat Linux

Deploy Operator With Helm

Overview

Prerequisites

Deployment Architecture

Distributed MinIO Deployments

Drive Failure Recovery

Enable TLS for MinIO

Encrypting Files

Description

Encryption

Hardware Checklist

Considerations

License

Software: AGPLv3

Managing Your Deployment

mc admin accesskey create

Syntax

mc admin cluster bucket import

Description

mc admin cluster iam import

Description

mc admin policy attach

Syntax

mc admin prometheus generate

Description

mc admin scanner status

Description

mc admin user add

Syntax

mc admin user svcacct add

Syntax

mc alias list

Syntax

mc anonymous set

Syntax

mc batch cancel

Syntax

mc encrypt clear

Syntax

mc event add

Syntax

mc idp ldap accesskey disable

Description

mc idp ldap add

Description

mc idp ldap policy attach

Description

mc ilm add

Syntax

mc ilm restore

Syntax

mc ilm rule add

Syntax

mc ilm tier add

Description

Supported S3 Services

Permissions

mc legalhold clear

Syntax

mc license info

Description

1) Create a CA Issuer for the `minio-operator` namespace

Install and Configure `mc`