Docker¶

docker/Dockerfile builds a small, static (CGO_ENABLED=0), non-root image. docker/docker-compose.yaml is a runnable example showing:

• mounting host-backed volumes as bucket storage
• configuring buckets (and everything else) purely through MINIS3_* environment variables, with an otherwise-empty config file

cd docker
mkdir -p certs
openssl req -x509 -newkey rsa:2048 -keyout certs/key.pem -out certs/cert.pem \
  -days 365 -nodes -subj "/CN=localhost"
docker compose up --build

Then, from the host:

aws --endpoint-url https://localhost:8443 --no-verify-ssl s3api list-buckets \
  --profile minis3  # configured with the AKIAPHOTOSEXAMPLE01 credential above

Non-root and privileged ports¶

The image runs as a non-root user (gcr.io/distroless/static-debian12:nonroot), so it cannot bind ports below 1024 — including the spec's default of 443. Configure network.listen (or MINIS3_NETWORK_LISTEN_0) to a high port (the example uses :8443) and map it to whatever host port you want with Docker's port publishing.

Building the image standalone¶

docker build -f docker/Dockerfile -t minis3 .