Deployment

A reference summary of how MinIO is deployed in practice. The community repo no longer ships pre-compiled binaries (see README.md); deployments use either source builds, Docker images, or the Helm chart.

Topologies

Topology	Command	Notes
Single drive	./minio server /data	Dev only.
Multiple local drives	./minio server /mnt/data{1...4}	Single-node erasure-coded, tolerates per-drive failure.
Distributed cluster	./minio server http://node{1...8}.example.com/mnt/data{1...8}	Same command on every node; cmd/endpoint-ellipses.go parses the topology.
Multi-pool expansion	... http://nodeA{1...8}/d{1...8} http://nodeB{1...4}/d{1...8}	Add a new pool to grow capacity.

Containers

The repo ships several Dockerfile variants:

File	Use case
Dockerfile	Community build (uses pre-built ./minio).
Dockerfile.cicd	CI shell harness image.
Dockerfile.release	Released community image.
Dockerfile.release.old_cpu	Build for older AMD64 CPUs.
Dockerfile.hotfix	One-off hotfix image.
Dockerfile.scratch	"From scratch" minimal image.

docker-buildx.sh is the multi-arch wrapper used by CI. dockerscripts/docker-entrypoint.sh is the runtime wrapper that handles drive permissions and signals.

Helm

helm/minio/ is the community-maintained Helm chart. The chart supports:

• Standalone or distributed mode (set mode: distributed and replicas).
• StatefulSet topology with PVCs.
• Optional KES sidecar.
• Optional console.
• Service-mesh integrations (Istio, Linkerd) via standard pod annotations.

helm-releases/ contains the pre-built tarballs of every chart release. index.yaml at the repo root is the chart-repo index. helm-reindex.sh regenerates it.

For production Kubernetes the README recommends the MinIO Operator, which manages tenants more strictly than the bare chart.

TLS

• The server reads certs from ~/.minio/certs/ by default (override with --certs-dir or MINIO_CERTS_DIR).
• private.key + public.crt form the listening cert; CAs/ holds extra CAs.
• Per-host certs in CAs/host/host.crt are used for SNI.
• internal/config/certs.go validates them at boot.

Secrets

• Root credentials: MINIO_ROOT_USER and MINIO_ROOT_PASSWORD.
• KMS: MINIO_KMS_KES_* (KES) or MINIO_KMS_SECRET_KEY (single-key dev).
• Identity providers: MINIO_IDENTITY_LDAP_*, MINIO_IDENTITY_OPENID_*.
• Audit/notification webhooks: MINIO_AUDIT_WEBHOOK_AUTH_TOKEN, etc.

A YAML config file (--config /etc/minio/config.yaml, see cmd/server-main.go) consolidates these for systemd or Helm-driven deployments.

Hotfixes

make hotfix in the Makefile builds a packaged binary signed with minisign. It's used by the MinIO team to ship one-off patches against a release tag, with the resulting .deb and signature pushed to dl.min.io/server/minio/hotfixes/.

Resiliency testing

docs/resiliency/docker-compose.yaml boots a 4-node cluster locally; docs/resiliency/resiliency-tests.sh injects failures and validates that traffic survives. Run with make test-resiliency.

Upgrades

• Rolling restart per node (one node at a time) is the supported flow.
• Clusters detect format-on-disk version mismatches and refuse to start if the new server can't read the old format. The legacy migration code in cmd/xl-storage-format-v2-legacy.go covers v1→v2.
• make test-upgrade validates the rolling-upgrade path between recent releases via buildscripts/minio-upgrade.sh.

Decommission and rebalance

• Decom. Drain a pool's contents before removing it: mc admin pool start-drain <pool>. Implementation: cmd/erasure-server-pool-decom.go.
• Rebalance. Spread existing objects across pools: mc admin rebalance start. Implementation: cmd/erasure-server-pool-rebalance.go.

Both are pause/resume-able, persist progress, and report status via the admin API.

Monitoring

• Scrape /minio/metrics/v3/... with Prometheus.
• Send audit logs to a webhook or Kafka via MINIO_AUDIT_*.
• Use mc admin trace for ad-hoc debugging (no restart needed).

See How to monitor for the full guide.