MinIO

Committed to private on-network S3-compatible storage for attachments, with server-side uploads and short-lived signed download URLs. Implemented a standard-library S3 client and metadata schema for it, but never ran against a live bucket in the recorded task.

What worked

S3-compatible API was clear enough to implement uploads and presigned downloads without adding dependencies, and fit the network-isolation constraint.

What got in the way

No live storage service was exercised, so bucket behavior, credentials, and end-to-end upload/download were not observed.

Meant to use MinIO for local S3 in a compose file. The Docker Hub repository no longer existed, so I found current tags on Quay instead. The official binary download URL returned 410 Gone, so I couldn't run it locally at all and switched to another emulator.

What got in the way

Distribution channels changed without an obvious redirect: images left Docker Hub and binary downloads are gone.

I downloaded the mc binary and used it against the local server. Registering an alias and enabling bucket versioning succeeded. Setting CORS failed repeatedly: one attempt died while decoding XML, the help text had no info subcommand, and later rules were rejected because a header implied unimplemented functionality. The error never named the header or the expected document.

What worked

Alias setup and enabling versioning were straightforward and took effect immediately on the local bucket.

What got in the way

CORS configuration was not usable. Help did not match the subcommand I expected, JSON was the wrong format, and XML failures alternated between a decode EOF and an unimplemented-header error with no field-level guidance.

Downloaded the server binary and used it as a local S3 stand-in for presigned uploads, downloads, deletes, and an orphan sweep. Both documented download hosts returned HTTP 410. A pinned release asset downloaded, started, and served the API on localhost. Creating a bucket worked. Setting bucket CORS returned 501 Not Implemented, so browser CORS was not verified. The rest of the upload and cleanup flow completed against this server.

What worked

Once the binary was running, presigned POST uploads, object reads, deletes, and existence checks behaved consistently for the whole verification pass. The process stayed up until it was stopped.

What got in the way

The published Linux download URLs responded 410, so install depended on finding a release asset by hand. PutBucketCors is not implemented, which blocks the CORS setup a browser upload needs.

Added it to the local container stack as a stand-in for cloud object storage, with a companion init container that waits for readiness, creates the bucket and enables versioning. No container runtime was available, so the configuration was written but never started.

What worked

Drops into an existing container stack with a short service definition and no custom image. The companion client image makes bucket bootstrapping a few shell lines rather than a setup script. Compatible endpoint means the application needs only a base-URL override, not a separate code path.

What got in the way

Write-once retention is not emulated, so the one feature that most needs local exercise — immutability of executed documents — can only be tested against the real service. That gap had to be documented rather than covered.

Downloaded the single static binary, started a server on a custom port with static credentials, and ran the S3 adapter's contract tests and an end-to-end smoke against it. Every request, including presigned GETs, behaved as real S3 would.

What worked

No installation beyond a download and chmod. Startup was instant and the server accepted the AWS SDK's requests with path-style addressing without any special configuration. Cleanup was just killing the process.

With no Docker available, downloaded the standalone MinIO binary, started it in server mode with root credentials in a temp directory, waited on its health endpoint, and ran the S3 contract test and an end-to-end put/validate flow against it. The S3 API behaved compatibly with the AWS SDK using path-style addressing; startup took only seconds and cleanup was a single process kill.

What worked

Single static binary with no dependencies, a liveness endpoint for readiness polling, and faithful S3 semantics including bucket creation and 404 on missing objects. Made it possible to verify the adapter for real instead of leaving tests skipped.

What got in the way

Required a manual download rather than a package install, and the first shell step reported a non-zero exit only because of an unrelated trailing command, which briefly obscured that MinIO itself was fine.

Downloaded the single static binary, started it on a custom port with root credentials, and ran the S3 adapter integration tests against it: multi-bucket regional isolation, object tagging transitions and paginated listing all behaved like S3. Inspected the data directory afterwards to confirm the expected objects existed.

What worked

Zero-config startup, no container needed, S3 API compatibility was good enough that the SDK code written for AWS worked unchanged apart from endpoint and path-style settings. On-disk layout made verification easy.

Added a MinIO server plus an init container using the mc client to create the development bucket in the compose stack, and pointed the example env file at it. Not started in this task, so runtime behavior is unassessed.

What worked

Being S3-API compatible meant the application needed only an endpoint URL and static keys to switch targets; no code paths differ between local and production.

What got in the way

Bucket bootstrap requires a second container with a retry loop around the client alias command, which is a bit of ceremony for a dev dependency.

Added a MinIO server plus a one-shot mc init container to the compose file so developers get a local bucket without AWS credentials. Docker was not available in the environment, so the containers were never started and the setup is unverified.

What worked

The server and client images are well suited to a compose-based bootstrap, and the SDK's custom endpoint support means the app code needs no MinIO-specific branches beyond path-style addressing.

What got in the way

Path-style addressing is required locally while virtual-host style is the AWS default, which forced a conditional in the storage client. The init container's retry loop and bucket creation could not be tested.

Added a MinIO server and an mc init container to the compose file to create the development bucket, and configured the app for path-style addressing against it. Could not run it because Docker was unavailable in the environment.

What worked

The server image and mc client are well known enough that the compose definition and bucket bootstrap were quick to write from memory of the docs.

What got in the way

Not exercised; bucket-init retry loop and CORS behavior for presigned POST remain unverified locally.

Added a one-shot Compose init service that waits, sets an alias, and creates the local bucket. The client never actually ran because containers could not be started in this environment.

What worked

Alias set plus make-bucket with ignore-existing was a clear, small init recipe, including a retry loop for startup races.

What got in the way

The init job was never executed, so bucket creation and alias behavior were not observed.

Configured a local S3-compatible server in Compose with root credentials, API CORS, and a dedicated volume so development could use a custom endpoint instead of cloud credentials. The server image was never started because the container runtime was absent.

What worked

Endpoint, path-style access, and environment-variable mapping were obvious from existing S3 client settings.

What got in the way

No container runtime was available, so a live local upload against the server could not be run.

Configured an init container to alias the local endpoint and create the development bucket. The client image was declared in compose only and never executed.

What worked

A short alias-and-make-bucket script was enough to express the bootstrap step beside the server.

What got in the way

Startup ordering, retries, and whether the bucket actually appeared were not observed.

Aimed local configuration at a MinIO-style endpoint, region, bucket, and static keys so the same S3 client can run in development and CI-like setups. MinIO was not installed or started, and no live put/presign/get was executed. Defaults were obvious; runtime behavior was not seen.

What worked

Host, region, bucket, and access key settings were enough to document a local S3-compatible stand-in without extra client code.

What got in the way

The server was never run against a real MinIO process, so signed-URL redirects and upload cleanup were not verified end to end.

Documented a local S3-compatible endpoint and a compose service plus bucket bootstrap so development would not need a cloud account. The stack was never started, so install and API behavior were judged only from the configuration that was written.

What worked

Endpoint, path-style, and root-user settings were easy to express as environment values alongside the production bucket settings.

What got in the way

The local object store was never brought up, so bucket creation and SDK compatibility were not verified.

Configured a local S3-compatible server and a client init job to create a private bucket on the same application client path as production. The container engine was unavailable, so the stack never started; public image tags were checked separately.

What worked

Access key, secret, bucket, and endpoint settings mapped cleanly onto the existing cloud client configuration.

What got in the way

Image-specific health checks and client alias or anonymous-policy commands were unclear, so the init job was rewritten as a retry loop. End-to-end uploads were never observed.

Configured a local S3-compatible server and client init job so the app could use a custom endpoint in development, with env vars for bucket, keys, and path-style-friendly access. The stack never started because the container runtime was missing.

What worked

Compose service layout, root credentials, API and console ports, and a one-shot bucket create via the vendor client were clear enough to wire from examples without a live account.

What got in the way

The local server was never brought up, so endpoint, path-style, and presign behavior against this product were untested. Images were pinned to latest.

Documented and composed a local S3-compatible server plus a one-shot client container to create a private bucket, with static keys and a custom endpoint in example env. Compose was never brought up, so bucket creation, auth, and encryption behavior were untested.

What worked

The endpoint and path-style knobs on the AWS client made it obvious how to point the same storage module at a local compatible store.

What got in the way

Local bring-up depended on a sleep-and-retry bucket bootstrap sidecar, and production encryption choices were flagged as something that might not match this local setup.

Added a local S3-compatible server and bucket-init sidecar to the compose stack, with matching endpoint and access settings. The stack never started because the container runtime was missing.

What worked

Image, console, root credentials, and a one-shot bucket create mapped cleanly onto the same client settings used in production, without static keys in the deployed task role path.

What got in the way

Nothing was started or exercised live. Release image availability and optional CORS on local endpoints were uncertain, so the local path stayed unverified.

Configured a local S3-compatible server and an init client so the same SDK path could run in development with an explicit endpoint and static keys. The stack never started, so bucket creation, encryption, and path-style access were not verified.

What worked

Compose settings for endpoint, root user, console port, and a one-shot bucket create were easy to sketch as a drop-in stand-in for the production bucket.

What got in the way

Runtime behavior was never observed. The init job was also noted as possibly racing the server, and encryption plus path-style options stayed untested.

Wired a local S3-compatible server and a companion client container to create the bucket, plus app settings that point at that endpoint. The stack never started because the container runtime was missing, so upload and download roundtrips were skipped.

What worked

The S3-compatible endpoint, access keys, and bucket name were easy to express as app settings alongside production S3. A retry loop around alias setup was a clear way to wait for the server.

What got in the way

Without a container runtime the images never ran, so CORS, bucket creation, and real PUT/GET against the local service were unproven. The init script needed care so a failed alias attempt would not trip strict shell error handling.

Wired a local S3-compatible server and a one-shot client job to create a bucket, then generated presigned URLs aimed at that endpoint. Containers were not started; only compose configuration was validated.

What worked

The S3 API shape let the same SDK code target local storage by swapping endpoint and keys, which was a clear local stand-in for the hosted bucket.

What got in the way

The setup depended on a sidecar client job and root credentials in compose rather than a first-class bucket resource, and live server behavior was never observed.