MinIO Community Edition is archived
The minio/minio repository has been read-only since April 2026 and is no longer maintained. An existing instance no longer receives community security fixes: read "Stay or migrate" below. To move off it, the guide migrer-minio-vers-garage-ou-rustfs-vps describes the method, and heberger-garage-s3-vps and self-host-rustfs-vps describe the two destinations.
MinIO Community Edition is archived: the real state of the project
The minio/minio repository is archived: it is read-only, its last commit dates from April 2026 and its README states that the repository is no longer maintained. This is the end of a slide visible since autumn 2025: the vendor announced in October 2025 that it would stop publishing Docker images, then the project went into "maintenance only" in December 2025, with no new contributions accepted and, at best, case-by-case review of critical fixes only. The Community edition is now distributed as source code only, under the AGPLv3 licence, and the vendor points to AIStor Free (standalone edition, free licence) or AIStor Enterprise (distributed edition with commercial support). The code is still available and your data is still readable: what disappears is the upstream team that fixes vulnerabilities.
What this means for an instance already in service
- No more community security fixes — the next flaw affecting the S3 server, the console or authentication will, by default, be fixed by nobody upstream; you stay exposed until you fix it yourself
- Bumping the image tag no longer helps —
docker compose pullno longer brings back a fixed version ofminio/minio; automatic updates give a false sense of security - Rebuilding from source means becoming the maintainer — with source-only distribution, compiling, signing and tracking the CVEs of Go dependencies become your job
- The ecosystem moves on without you — S3 SDKs, tools and applications will keep working for a while, but nobody will run interoperability tests against new MinIO versions any more
- Your data is not in immediate danger — nothing breaks on the day of the archive and both
mcandrclonestill read your buckets; the risk is slow, it is security debt - Exposure sets the urgency — an instance reachable from the Internet has a different risk profile from one on a private network, behind a VPN or a firewall
Stay or migrate: how to decide
Ask three questions in this order. Is the instance reachable from the Internet? Does the data justify security monitoring that nobody else will do for you? Can your team carry the maintenance of a home-built binary? A "yes" to the first question, or three "no" answers to the others, point to migrating; a private, little-exposed instance with tested backups gives you time to prepare. Either way, do not decide in a rush: an S3 migration has to be prepared (bucket inventory, policies, presigned URLs, versioning) and that is what the guide migrer-minio-vers-garage-ou-rustfs-vps details. The destinations are described in heberger-garage-s3-vps and self-host-rustfs-vps, two S3-compatible storages whose feature gaps with MinIO you should know before choosing.
Stay, compile, migrate: the decision table
Scroll the table
| Option | When it holds up | What it implies |
|---|---|---|
| Stay on the last community version | Private instance, low-sensitivity data, planned exit | No upstream fixes, isolation and monitoring are on you |
| Compile from source | A team able to track Go CVEs and rebuild | You become the maintainer of your own binary |
| Move to the vendor's AIStor edition | You want to stay in the MinIO ecosystem | Vendor-specific licence and terms, to read before committing |
| Migrate to Garage | Modest volume, simple S3 needs, replication between sites | Versioning, ACLs and bucket policies are not supported |
| Migrate to RustFS | You need a console and usage close to MinIO | ACLs not supported, region and addressing style to set explicitly |
| Go back to public S3 storage | No in-house operations capacity | Egress fees and per-request billing return |
Why self-host MinIO on a VPS
MinIO exposes a 100% S3-compatible API: all your SDKs, tools (aws s3, rclone, mc) and frameworks that speak S3 work without modification. Instead of paying for storage, requests and especially the egress of a public cloud, you get local object storage at the fixed price of your VPS. It is perfect for serving application assets, storing user uploads, receiving database snapshots, or building a backup target for your other servers, all on infrastructure you control.
The strengths of in-house object storage
- A native S3 API: immediate compatibility with
aws-cli,rclone, existing SDKs and frameworks - No egress fees or per-request GET/PUT billing
- A built-in web console to manage buckets, policies and users
- Server-side encryption and object versioning enabled per bucket
- An ideal backup target for your VPS, databases and containers
- Granular access policies and presigned links to share files securely
Realistic prerequisites
MinIO is light on CPU/RAM: a 2 vCPU / 2 GB RAM VPS is enough to get started. The determining factor is the disk: plan for an SSD volume sized according to your target capacity, with headroom for versioning. Docker + Compose installed, a subdomain for the API (s3.yourdomain.com) and another for the console (console.yourdomain.com). A TLS certificate is essential because MinIO carries credentials.
Step-by-step deployment
Prepare storage on the VPS
Create the data directory on your SSD:
mkdir -p /opt/minio/data. If you have several volumes, MinIO can aggregate them in erasure-coding mode for resilience.Define the service with strong credentials
In
docker-compose.yml, use theminio/minioimage, theserver /data --console-address ":9001"command, and setMINIO_ROOT_USER/MINIO_ROOT_PASSWORDwith randomly generated values. Mount/opt/minio/data:/data.Start and bind the ports locally
Run
docker compose up -d. Expose API port 9000 and console port 9001 only on127.0.0.1: they will be published exclusively via the reverse proxy.Set up the TLS reverse proxy
Configure two HTTPS virtual hosts:
s3.yourdomain.comto port 9000 andconsole.yourdomain.comto 9001. Remember to allow large uploads withclient_max_body_size 0;(Nginx) on the API host.Create a bucket and an application user
With the
mcclient:mc alias set local https://s3.yourdomain.com ..., thenmc mb local/mon-bucketand create a dedicated user with areadwritepolicy limited to that bucket rather than using the root account.Enable versioning and encryption
Enable versioning (
mc version enable) to protect against accidental deletions and configure server-side encryption (SSE) on sensitive buckets.
Use the bucket replication feature (mc replicate) between your MinIO and a second remote VPS: you get a near real-time copy of your objects in another location, which constitutes a robust disaster-recovery strategy without depending on a third-party cloud. Combine it with lifecycle rules to automatically expire old versions and keep disk space in check.
MinIO: when staying is defensible
Staying is not a mistake in itself. An archived MinIO still stores and serves objects, and a poorly prepared migration often does more damage than a theoretical flaw on a service that is not exposed. Staying is defensible when you choose this risk knowingly, with an exit date, rather than ignoring it.
The conditions for a reasonable decision to stay
- No public exposure — ports 9000 and 9001 bound to
127.0.0.1or a private network, console never published, access through a VPN or SSH tunnel - Bounded use — internal backup target or artefact storage, no uploads from anonymous users or sensitive personal data
- Independent, tested backup — a copy of the buckets on another medium with
mc mirrororrclone, and a restore that has actually been tried - Features with no equivalent elsewhere — your application depends on versioning, bucket policies or replication that the destination does not support, and migrating would break it
- A written deadline — a quarterly review and migration triggers: a published flaw with no fix, exposure that has become necessary, an application that requires a newer version
If one of these five points is missing, treat migration as a project to schedule, not a "someday" item: migrer-minio-vers-garage-ou-rustfs-vps for the method, heberger-garage-s3-vps and self-host-rustfs-vps to install the target.
