MinIO server on a dedicated machine: licence, drives and erasure parity

Which MinIO you can still install

The open-source MinIO repository on GitHub is archived and its README states it is no longer maintained. Its code remains AGPLv3 and had already moved to source-only distribution: the legacy pre-built binaries stay downloadable but receive no updates. What MinIO ships and documents today is AIStor, with three licence tiers.

AIStor Free needs AIStor Server RELEASE.2025-12-20T04-58-37Z or later and a licence key from MinIO's SUBNET portal. The licence page lists what the Free tier refuses: distributed (multi-node) deployments, site, bucket and batch replication, tiering and lifecycle transitions, version-specific object deletion, profiling, performance tests, background heal status and encryption at rest. A write that asks for server-side encryption returns HTTP 405 XMinioPaidTierLicenseRequired.

AIStor starts without a licence, but in offline mode: every S3 call is blocked until a licence file is in place. Plan the SUBNET step before the maintenance window, not during it.

Drive count sets the parity

MinIO stripes each object into K data and M parity shards across an erasure set of 2 to 16 drives, and a set's parity can go up to half its size. MinIO's storage-class reference states that production deployments must use EC:3 or higher, and calls the defaults it picks for sets of five or fewer drives suitable for development and testing only. Since parity tops out at half the set, EC:3 needs at least six drives in the set. The erasure set layout is fixed when the pool initialises, so buy the drive count up front.

Defaults come from MinIO's storage-class table. The last three columns are our arithmetic from its quorum rules: reads need K healthy shards, writes need K, and K+1 when parity is exactly half the set, which is why 6- and 8-drive sets keep reading after one more failure than they keep writing. You can set MINIO_STORAGE_CLASS_STANDARD lower on an 8-drive set, for example EC:3, to keep more capacity; the change applies only to objects written afterwards.

Hardware: MinIO's numbers and a single node

MinIO's hardware guidelines are set high: per host, a single-socket CPU with 64 or more cores, 100 GbE networking, 30 TB-class NVMe drives and 256 GiB of RAM, with the caveat that running on less risks reliability and performance. For one machine, the points below matter more than those figures.

• Drives. Flash (NVMe or SSD) for every workload, attached directly as JBOD with no RAID or LVM in front, formatted XFS, all the same capacity, make and model. The slowest or smallest drive sets the pace.
• Memory. MinIO allocates up to 75% of host RAM to GET operations at about 2 MiB per request, so memory caps concurrency: its table gives 12,288 concurrent requests at 32 GiB, 24,576 at 64 GiB and 49,152 at 128 GiB.
• Network. Throughput stops at the port. MinIO's table puts 10 Gbps at about 1.25 GB/s and 25 Gbps at about 3.1 GB/s of storage traffic, whatever the drives could do.
• Kernel. MinIO recommends Linux 6.8 or later, such as Ubuntu 24.04 LTS.

Building the machine

A custom dedicated server is specified part by part, and the storage step is where this workload is decided: choose the JBOD controller so every drive reaches Linux on its own, then the drive type and count, up to 24 bays on the largest lines, in SATA-SSD, SAS-SSD or NVMe-SSD up to 30.72 TB. Memory runs from 8 GB to 2 TB of registered ECC. Nobody else runs on the hardware, and you get root.

The port is the other half. It is unshared and unmetered at every speed from 1 Gbps to 100 Gbps, so reads served out of the bucket carry no per-gigabyte line. Builds are handed over 4 to 24 hours after the order is approved, in New York, Miami, San Francisco, Amsterdam or Bucharest; the locations page has a test IP per city. If a racked machine already has the drives you need, instant servers go live about 30 minutes after approval. Memory and drives can be changed after the server is live, but MinIO will not widen an initialised erasure set, so size the drive count for the pool's whole life.

Setting it up on Ubuntu 24.04

1. Create the mount points with sudo mkdir -p /mnt/drive-{1..8}, then format each data drive XFS with a label (mkfs.xfs -L AISTORDRIVE1 /dev/sdX erases that drive: check the device name twice) and mount it from /etc/fstab by label with defaults,noatime, one line per drive at /mnt/drive-1 onwards. Labels let a replacement drive take the old one's place without editing the file.
2. Install the AIStor package from MinIO's download server and confirm the systemd unit exists with systemctl status minio.
3. Put the licence string in /opt/minio/minio.license and give minio-user ownership of /opt/minio and every /mnt/drive-N.
4. Write /etc/default/minio as below; the hostname in MINIO_VOLUMES must resolve to this machine. Set MINIO_ROOT_USER and MINIO_ROOT_PASSWORD before the first start: omitted, both default to minioadmin, which MinIO says never to use in production.
5. Create /opt/minio/certs, copy in a PEM public.crt and private.key valid for the MINIO_VOLUMES hostname, and run chown -R minio-user:minio-user /opt/minio/certs. The service starts with https:// volumes and --certs-dir, so the certificate has to be there first.
6. Run systemctl enable minio.service && systemctl start minio, then follow journalctl -u minio until the drives report online.

curl --progress-bar -L dl.min.io/aistor/minio/release/linux-amd64/minio.deb -o minio.deb
sudo dpkg -i minio.deb

# /etc/default/minio  -- holds the root password:
# sudo chown root:minio-user /etc/default/minio && sudo chmod 640 /etc/default/minio
MINIO_LICENSE="/opt/minio/minio.license"
MINIO_VOLUMES="https://s3.example.net:9000/mnt/drive-{1...8}/minio"
MINIO_OPTS="--certs-dir /opt/minio/certs --console-address 127.0.0.1:9001"
MINIO_ROOT_USER="replace-with-a-long-random-name"
MINIO_ROOT_PASSWORD="replace-with-a-long-random-secret"

TLS, ports and the console

The S3 API listens on 9000 by default. The web console takes the port you give --console-address; omit the flag and MinIO picks a dynamic port at each start and prints it to the log, which makes firewall rules guesswork. Binding the console to 127.0.0.1 as above keeps the admin login off the internet: reach it with ssh -L 9001:127.0.0.1:9001 and a browser on your own machine.

TLS is already on from the certificate step above: a PEM public.crt and private.key at the root of /opt/minio/certs, owned by minio-user, with --certs-dir pointing at it and https:// in MINIO_VOLUMES. Extra hostnames go in subdirectories, picked by the certificate's SAN list rather than the folder name. PFX bundles are not accepted, and a password-protected key must be PKCS-1 with MINIO_CERT_PASSWD set. On RELEASE.2026-02-02T23-40-11Z and later, a certificate replaced in place is reloaded without a restart.

Running it

• Licence. An AIStor Free licence does not expire: mc license info ALIAS shows its expiry as N/A. The 30-day grace period, then read-only, then no S3 access from day 90 that MinIO's licence page describes applies to paid licences; a trial goes read-only as soon as it lapses.
• A second copy. Erasure coding survives drive failures, not the loss of the machine, a bad delete or a compromised key, and the Free tier has no replication. Copy the buckets that matter to storage in another location with any S3 client, on a timer.
• XFS errors. MinIO's storage page supplies a script that sets XFS max_retries to 0 for EIO, ENOSPC and default errors, so a failing drive errors out instead of stalling; run it from an @reboot cron entry because the setting does not persist.
• Identities. Create named users with scoped policies for each application and keep the root keys for administration.
• Hardware. On the rack and blade lines, the out-of-band console reaches the machine when Linux will not; failed parts are covered by the support terms.

Where one machine is the wrong answer

A single node is a single failure domain: a dead motherboard or power supply takes the bucket offline until the part is replaced, however much parity the drives carry. High availability means multiple nodes, which AIStor Free does not license. Each of our machines also has one connected port and no private VLAN between servers, so a multi-node cluster would carry its inter-node traffic over the public interface. If your applications cannot tolerate an outage while hardware is swapped, the paid AIStor tiers on several machines are the documented design.