跪拜 Guibai
← All articles
Docker · Backend · Java

MinIO Is Dead: Migrate to RustFS Without Losing Data

By 有来技术 ·
Read original on juejin.cn ↗ Google Translate ↗ Alt translation

Anyone running MinIO Community Edition is now on an unmaintained black box. RustFS provides a drop-in replacement that reads the existing disk format, so a migration can be done with a directory copy and a config change, not a multi-hour network transfer.

Summary

MinIO's Community Edition entered maintenance mode in late 2025 and its repository was archived read-only by February 2026, leaving unpatched CVEs. RustFS emerges as the lowest-friction replacement because it reads the MinIO disk format directly. A full directory copy moves buckets, objects, and policies without a network hop, while the old directory stays as a rollback backup. The application side switches from the MinIO Java SDK to the AWS SDK v2, following the S3 protocol rather than any single vendor. The migration keeps the same endpoint, ports, and bucket names, so the only code change is a single service implementation class. Common pitfalls include a mandatory `chown` to UID 10001 for the non-root RustFS container, enabling path-style access for IP endpoints, and replacing old access keys that don't carry over with the data.

Takeaways
MinIO Community Edition is archived and read-only as of February 2026; no further CVE fixes will ship.
RustFS reads the MinIO disk format directly, so old data migrates by copying the entire data directory with `cp -a`.
RustFS runs as UID 10001 inside the container; the host data directory must be `chown 10001:10001` or the container crashes with a permission error.
Old MinIO access keys do not survive the migration; applications must switch to the new AK/SK set at RustFS startup.
Switching from the MinIO Java SDK to the AWS SDK v2 requires `forcePathStyle(true)` when connecting to an IP endpoint, or DNS resolution fails.
Newer AWS SDK versions default to streaming chunked signatures that old MinIO cannot parse, producing `XAmzContentSHA256Mismatch` errors.
Bucket policies carry over with the data copy, but anonymous read must be explicitly set to 'Public' in the RustFS console for direct image links to work.
Conclusions

The migration's real value is not RustFS itself but the S3 protocol abstraction: swapping the backend becomes a configuration change, and standardizing on the AWS SDK decouples the client from any single vendor.

RustFS's disk-format compatibility turns what is normally a network-bound, hours-long data migration into a local disk copy, which is the single biggest factor reducing downtime and risk.

The `Permission denied` crash from UID mismatches is a near-certainty for anyone moving from MinIO's root-running image to RustFS's non-root model, and the fix is a single `chown` command that is easy to miss in planning.

MinIO's end-of-life surfaces a hidden coupling: the MinIO Java SDK masked path-style requirements that the AWS SDK exposes immediately, forcing teams to confront network addressing assumptions they never knew they had.

Concepts & terms
S3 path-style vs. virtual-hosted-style addressing
Path-style puts the bucket name in the URL path (e.g., `http://IP:9000/bucket/object`), while virtual-hosted-style puts it in the subdomain (e.g., `http://bucket.IP:9000/object`). The AWS SDK defaults to virtual-hosted, which breaks when connecting to an IP address directly, so `forcePathStyle(true)` is required for self-hosted S3-compatible storage.
MinIO disk format compatibility
MinIO stores each object as a directory containing `xl.meta` metadata and erasure-coded shards, not as a single file. RustFS (since v1.0.0-alpha.89) can read this on-disk layout directly, allowing a simple directory copy to migrate data without network transfers.
Streaming chunked signatures (AWS Signature V4)
A signing mode where the client streams data in chunks and signs each chunk, avoiding the need to compute a hash of the entire payload upfront. Older MinIO versions do not support this mode, causing `XAmzContentSHA256Mismatch` errors when newer AWS SDKs use it by default.
Source: juejin.cn ↗ Google Translate ↗ Backup ↗