MinIO Enterprise Fork

Maintained and updated by Chris Bunting

Enterprise-hardened fork of MinIO object storage with security hardening, expanded S3 API compatibility, and a roadmap toward full enterprise feature parity.

Full upstream documentation: See README-MINIO.md for original MinIO deployment, configuration, and usage guides.

---

Fork Overview

This repository maintains the complete MinIO codebase with the following objectives:

• Security-first hardening — Removing baked-in defaults, enforcing crypto best practices, and eliminating information leakage in binaries
• AWS S3 API gap closure — Implementing S3 APIs that were stubbed or rejected upstream (CORS, Bucket Logging, Object Ownership, etc.)
• Enterprise feature development — Building toward feature parity with AWS S3, Ceph RGW, and other enterprise storage platforms
• Container lifecycle excellence — HEALTHCHECK, proper signal forwarding, multi-arch builds with SBOM attestation
• CI/CD modernization — CodeQL scanning, Dependabot, reproducible builds with pinned base image digests

---

Fork-Specific Changes

Security Hardening

Change	Details
Credential removal	Dockerfile.source no longer bakes in minioadmin:minioadmin; MINIO_ROOT_USER/MINIO_ROOT_PASSWORD must be supplied at runtime
Binary permissions	Replaced chmod -R 777 /usr/bin with targeted chmod 755 across all Dockerfiles
Container health checks	HEALTHCHECK added to all images for orchestrator liveness/readiness signals
Signal forwarding	docker-entrypoint.sh uses exec in chroot paths and traps SIGTERM/SIGINT for graceful shutdown
PBKDF salt separation	Console encryption uses distinct prefixes for salt and passphrase to prevent reuse weakness
JWT algorithm whitelist	Explicit HS256/HS384/HS512 enforcement via AllowedAlgorithms to prevent algorithm confusion attacks
Decompression bomb protection	S3 Select enforces 1 GiB maximum decompressed data per request (CVE-2026-39414)
Build path sanitization	GOPATH/GOROOT no longer embedded in binary ldflags

Infrastructure & CI/CD

Change	Details
Go toolchain upgraded	go1.24.8 → go1.25.9, all 10 CI workflows updated from Go 1.24.x to 1.25.x
Multi-arch Docker	docker buildx build --platform linux/amd64,linux/arm64 with provenance attestation and SBOM generation
Docker PR verification	New workflow builds and health-checks Docker image on every PR before merge
CodeQL analysis	Automated security scanning on every push and PR
Dependabot	Weekly automated updates for Go modules, Docker base images, and GitHub Actions
Base image pinning	Alpine 3.21, UBI images pinned to specific digests for reproducible builds
Expanded .dockerignore	Excludes docs, helm, buildscripts, IDE configs to reduce build context
Deprecated actions replaced	actions/create-release replaced with gh release create
Concurrency cancellation	Prevents conflicting workflow runs on rapid pushes

Build System

• Makefile sanitized: removed MinIO-internal hotfix infrastructure (SCP, minisign, apt); default registry changed to ghcr.io/cbuntingde
• Layer caching enabled: removed --no-cache from Docker build targets
• Additional linters enabled: gosec, bodyclose, noctx for security and correctness

Vulnerability Management

• Governance: Automated govulncheck analysis on every push and PR using the vulncheck.yml workflow, ensuring no dependency with a known CVE reaches production
• Go toolchain: Upgraded from go1.24.8 to go1.25.9, patching 8 standard library CVEs (crypto/x509, crypto/tls, archive/tar, html/template, os, net/url, internal/syscall/unix)
• Module updates:
  • golang.org/x/crypto v0.37.0 → v0.46.0 — Go SSH unbounded memory allocation (GO-2025-4134)
  • golang.org/x/net v0.39.0 → v0.48.0 — Infinite parsing loop (GO-2026-4441/4440)
  • github.com/eclipse/paho.mqtt.golang v1.5.0 → v1.5.1 — String encoding overflow (GO-2025-4173)
  • go.opentelemetry.io/otel/sdk v1.35.0 → v1.40.0 — Arbitrary code execution (GO-2026-4394)
  • google.golang.org/grpc v1.72.0 → v1.79.3 — Authorization bypass (GO-2026-4762)
  • github.com/buger/jsonparser v1.1.1 → v1.1.2 — Denial of service (GO-2026-4514)
  • filippo.io/edwards25519 v1.1.0 → v1.1.1 — Invalid result / undefined behavior (GO-2026-4503)

Helm Chart

• apiVersion updated to v2 (Helm 3+)
• HorizontalPodAutoscaler template with configurable CPU/memory scaling
• KMS environment variables documented in values
• Default image points to ghcr.io/cbuntingde/minio

Context Propagation

Grid-based storage RPC handlers accept context.Context where the framework supports it; SingleHandler-based handlers retain context.Background() pending upstream grid framework changes.

---

Feature Enhancements

S3 Bucket CORS (Implemented)

The ?cors endpoints were previously stubs returning ErrNotImplemented or ErrNoSuchCORSConfiguration. They are now fully functional:

• PUT /?cors — Store per-bucket CORS configuration with full validation (required origins/methods, allowed methods whitelist, non-negative MaxAgeSeconds)
• GET /?cors — Return stored CORS configuration XML
• DELETE /?cors — Remove bucket CORS configuration
• CORS configuration is persisted in the bucket metadata system, replicated across distributed nodes, and importable/exportable via the admin API

Files changed:

• internal/bucket/cors/cors.go — CORS XML types, parsing, validation, wildcard origin matching
• internal/bucket/cors/cors_test.go — 36 unit tests covering parsing, validation, origin matching, round-trip serialization, nil safety
• cmd/bucket-cors-handlers.go — HTTP handlers (PUT/GET/DELETE)
• cmd/bucket-metadata.go — CORSConfigXML, CORSConfigUpdatedAt fields with parseAllConfigs integration
• cmd/bucket-metadata-sys.go — updateAndParse case, GetCORSConfig method
• cmd/bucket-metadata_gen.go — Auto-generated msgp marshaling
• cmd/api-router.go — Route registration, removal from rejectedBucketAPIs
• cmd/dummy-handlers.go — Removal of stub CORS handlers
• cmd/object-api-errors.go — BucketCORSConfigNotFound error type
• cmd/api-errors.go — toAPIError mapping
• cmd/admin-bucket-handlers.go — Export/import support

S3 Metadata Search Engine (Implemented)

SQL-queryable object metadata search via GET /{bucket}?metadata-query&q=<SQL>:

• Index: Lazily built on first query per bucket via ListObjects scan; cached in memory with 5-minute TTL and double-checked locking for concurrent safety
• SQL subset: SELECT <fields> FROM <bucket> WHERE <conditions> [ORDER BY <field> [ASC|DESC]] [LIMIT <n>]
• Supported operators: =, !=, <, >, <=, >=, LIKE (%/_ wildcards), CONTAINS, AND, OR, NOT, parentheses
• Queryable fields: System fields (name, size, last_modified, etag, content_type) and all user-defined metadata (x-amz-meta-*, x-minio-meta-*)
• Response: XML with matching objects and their metadata entries
• Authorization: Requires ListBucket permission on the target bucket

Files changed:

• cmd/metadata-search.go — Core engine: per-bucket index, SQL tokenizer, recursive descent parser, query executor, LIKE matcher
• cmd/bucket-metadata-search-handlers.go — HTTP handler with auth, bucket validation, parse-then-execute flow
• cmd/metadata-search_test.go — 50 tests covering parser, execution, LIKE patterns, sorting, XML format, concurrency, invalidate
• cmd/api-router.go — Route registration for ?metadata-query
• cmd/globals.go — globalMetadataSearchEngine variable

S3 Object Lambda Access Points (Implemented)

Full S3 Object Lambda implementation for on-the-fly data transformation on GET, PUT, and HEAD requests:

• Admin API — Create, read, list, and delete Object Lambda Access Points via the admin API (PUT/DELETE/GET/GET{name} on /minio/admin/v3/object-lambda-ap/{name})
• Transformation framework — LambdaTransformation type dispatches GET, PUT, and HEAD operations to registered handlers with request/response transformation support
• Lambda invocation — LambdaTarget performs SigV4 signed HTTP POST directly to Lambda Function URLs; no SDK dependency
• Content classes — GetObjectClass (transform on GET), WriteObjectClass (transform on PUT), SelectObjectContentClass (stub), ListBucketsClass (stub)
• Multi-handler routing — Request routing via x-amz-request-route and x-amz-request-token headers (AWS S3 Object Lambda protocol)

Files changed:

• cmd/object-lambda-sys.go — ObjectLambdaSys management layer: AddAccessPoint, RemoveAccessPoint, GetConfig, GetAll, Delete; LambdaArgs with FunctionURL, TransformationConfiguration; logOnceIf adapter bridging logger.LogOnceIf to logger.LogOnce
• cmd/object-lambda-access-points.go — Admin API handlers: PutObjectLambdaAccessPoint, RemoveObjectLambdaAccessPoint, ListObjectLambdaAccessPoints, GetObjectLambdaAccessPoint; all use validateAdminReq and return proper *APIError
• cmd/object-lambda-handlers.go — Extended: PutObjectLambdaHandler, HeadObjectLambdaHandler, GetObjectLambdaHandler (existing) — all dispatch to registered access point transformations
• cmd/api-router.go — Registered GET/PUT/HEAD routes for ?lambdaArn query param
• cmd/admin-router.go — Registered 4 admin routes for object-lambda-ap
• cmd/api-errors.go — Added ErrNoSuchObjectLambdaAccessPoint
• cmd/globals.go — Added globalObjectLambdaSys
• internal/config/lambda/event/objectlambda.go — ObjectLambdaAccessPoint, ObjectLambdaConfig, TransformationConfiguration, ContentTransformation structs; GetObjectClass, WriteObjectClass, SelectObjectContentClass, ListBucketsClass constants
• internal/config/lambda/target/lambda.go — LambdaTarget for direct HTTP SigV4 Lambda Function URL invocation with configurable timeout
• internal/config/lambda/event/event.go — Added PutObjectContext, WriteObjectClass constants

Enterprise Feature Roadmap

An enterprise feature gap analysis was conducted comparing MinIO against AWS S3, Ceph RGW, SeaweedFS, Scality, Cloudian, Pure FlashBlade, Dell ObjectScale, and others. The full analysis is documented in enterprise-plan.md (gitignored). Planned phases:

Phase	Features	Objective
1	✅ CORS, Bucket Logging, Object Ownership, MFA	Close AWS S3 compatibility gaps
2	✅ Metadata Search, S3 Access Points, Rate Limiting/QoS	Multi-tenant enterprise readiness
3	✅ S3 Select, S3 Inventory, Cold Storage Tier	Feature parity with enterprise offerings
4	✅ S3 Object Lambda, S3 Batch Operations	Data processing on storage
5	Multi-Region Access Points, POSIX/NFS Gateway, S3 Tables	Enterprise differentiation

---

Architecture Reference

This repository follows the standard MinIO architecture with the following key structural notes for developers:

Area	Path	Description
Entrypoint	main.go → cmd/main.go	Imports internal/init first, delegates to cmd.Main()
S3 API Router	cmd/api-router.go	All S3-compatible API route registration; stub/rejected APIs in dummy-handlers.go and rejectedBucketAPIs
Admin Router	cmd/admin-router.go	Admin API routes
Object Layer	cmd/erasure-server-pool.go	Erasure-coded, multi-pool object storage implementation
Bucket Metadata	cmd/bucket-metadata.go	Combined .metadata.bin (MsgPack) storing all per-bucket configs
Configuration Storage	cmd/bucket-metadata-sys.go	In-memory cache + persistence via updateAndParse / Delete
IAM & Identity	cmd/iam.go, internal/config/identity/	Built-in IAM, LDAP, OIDC, TLS cert, plugin identity providers
Replication	cmd/bucket-replication.go, cmd/site-replication.go	Bucket and multi-site active-active replication
Cold Storage/Tiering	cmd/tier.go, cmd/warm-backend-*.go	Tiering to Azure, GCS, S3-compatible backends
Peer Communication	internal/grid/	Grid-based peer RPC for distributed mode
Notifications	internal/event/target/	AMQP, Kafka, MQTT, MySQL, NATS, NSQ, PostgreSQL, Redis, Webhook

The full upstream deployment documentation (Docker, Kubernetes, Helm, monitoring, troubleshooting, tuning) is available in README-MINIO.md.

---

Build & Development

# Build binary
go build -tags kqueue -trimpath --ldflags "$(go run buildscripts/gen-ldflags.go)" -o minio .

# Run (single node)
minio server /data

# Run (distributed, 4 nodes)
minio server http://minio{1...4}/data{1...4}

# Code generation (msgp + stringer)
go generate ./...

# Run all linters
make lint

# Run unit tests
make test

# Run race detector
make test-race

Required environment variables: MINIO_ROOT_USER, MINIO_ROOT_PASSWORD

See AGENTS.md for the full developer reference including testing targets, build system details, and architecture guidance.

---

License

• Source Code: GNU AGPL v3
• Documentation: CC BY 4.0

This project is based on the original MinIO repository (archived February 2026).