mirror of
https://github.com/pgsty/minio.git
synced 2026-08-10 00:03:29 +03:00
Feng Ruohang
c46b16ec62
The transitional references land in one commit, because they are only correct together: the repository is pgsty/silo, its default branch is main, and nothing in the tree should point a user at the old names. Changed: - Workflow branch filters. go.yml and vulncheck.yml gated on `branches: master` for both push and pull_request, so renaming the default branch would have taken automatic CI offline with no error and no signal - the workflows would simply never trigger again. They now name main. - Release target. goreleaser's `release.github.name` becomes silo, which is what actually decides where a tagged build publishes. sign-release-rpms.sh's GH_REPO default follows. - The OCI `image.source` label, the Helm chart `sources` entry, the security advisory link in the issue-template config, and the go.mod comment citing the LDAP TLS fix. - 115 occurrences across README, README_ZH, SECURITY, CONTRIBUTING and 30 docs pages, including 72 links that also carried the master branch in their path. Those matter most: GitHub redirects clone, fetch, push and web URLs after a rename, but raw.githubusercontent.com does not, and neither follows a branch rename - every one of those links would 404 twice over. - Three error strings in cmd/erasure-sets.go, cmd/storage-errors.go and internal/config/errors.go that print an issue URL to operators. These are Go string literals inside rebrand-guard's brand allowlist, so the baseline is regenerated. The regeneration removes exactly those three entries and adds none; all twelve other protected sets, including the 9014 exported symbols, are byte-identical. - The transitional-naming disclaimers in README, README_ZH, SECURITY and CONTRIBUTING are dropped, since they no longer describe anything. Deliberately unchanged, all three because they exist to reject or freeze the old name rather than to point at it: - buildscripts/minio-upgrade.sh pins pgsty/minio@sha256:b6bfe72... - the frozen pre-rebrand image is the control group for the MinIO-to-Silo upgrade test. - helm-migration-guard rejects any rendered container still pulling pgsty/minio. - verify-rebrand.sh rejects the same in the delivery surfaces. Also unchanged: docs/config/README.md links to pgsty/mc/blob/master, and that repository's default branch really is still master. It moves when mc does. verify-rebrand.sh gains three assertions so this cannot silently regress: no source reference may name pgsty/minio outside the three allowlisted guards, no link may target pgsty/silo's master branch, and go.yml and vulncheck.yml must filter on main. Both new rejections were negative-tested - reintroducing a master branch filter and adding a pgsty/minio URL each fail the gate with the specific message. This commit assumes the rename actually happens. Until the GitHub branch and repository renames are executed, the links it introduces do not resolve. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
223 lines
7.9 KiB
Markdown
223 lines
7.9 KiB
Markdown
# Silo Docker Quickstart Guide [](https://hub.docker.com/r/pgsty/silo/)
|
|
|
|
See the [Silo documentation](https://silo.pgsty.com/docs/) for production
|
|
deployment and operations guidance.
|
|
|
|
For images built from this `pgsty/silo` fork, the container also bundles `mcli` and a compatibility `mc` symlink from `pgsty/mc`.
|
|
|
|
## Prerequisites
|
|
|
|
Docker installed on your machine. Download the relevant installer from [here](https://www.docker.com/community-edition#/download).
|
|
|
|
## Run Standalone Silo on Docker
|
|
|
|
*Note*: Standalone Silo is intended for early development and evaluation. For production clusters, deploy a [Distributed](https://silo.pgsty.com/operations/deployments/baremetal-deploy-minio-as-a-container/) Silo deployment.
|
|
|
|
Silo needs a persistent volume to store configuration and application data. For testing purposes, you can launch Silo by simply passing a directory (`/data` in the example below). This directory gets created in the container filesystem at the time of container start. But all the data is lost after container exits.
|
|
|
|
```sh
|
|
docker run \
|
|
-p 9000:9000 \
|
|
-p 9001:9001 \
|
|
-e "MINIO_ROOT_USER=AKIAIOSFODNN7EXAMPLE" \
|
|
-e "MINIO_ROOT_PASSWORD=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" \
|
|
docker.io/pgsty/silo server /data --console-address ":9001"
|
|
```
|
|
|
|
To create a Silo container with persistent storage, you need to map local persistent directories from the host OS to virtual config. To do this, run the below commands
|
|
|
|
### GNU/Linux and macOS
|
|
|
|
```sh
|
|
mkdir -p ~/silo/data
|
|
|
|
docker run \
|
|
-p 9000:9000 \
|
|
-p 9001:9001 \
|
|
--name silo1 \
|
|
-v ~/silo/data:/data \
|
|
-e "MINIO_ROOT_USER=AKIAIOSFODNN7EXAMPLE" \
|
|
-e "MINIO_ROOT_PASSWORD=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" \
|
|
docker.io/pgsty/silo server /data --console-address ":9001"
|
|
```
|
|
|
|
The command creates `~/silo/data` in your home directory and maps it to
|
|
`/data` in the container. Data written to `/data` therefore persists in the
|
|
host directory across container restarts.
|
|
|
|
### Windows
|
|
|
|
```sh
|
|
docker run \
|
|
-p 9000:9000 \
|
|
-p 9001:9001 \
|
|
--name silo1 \
|
|
-v D:\data:/data \
|
|
-e "MINIO_ROOT_USER=AKIAIOSFODNN7EXAMPLE" \
|
|
-e "MINIO_ROOT_PASSWORD=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" \
|
|
docker.io/pgsty/silo server /data --console-address ":9001"
|
|
```
|
|
|
|
## Run Distributed Silo on Containers
|
|
|
|
For production, use the Silo Helm chart, Pigsty automation, or another
|
|
deployment system that pins the image digest and preserves the documented
|
|
`MINIO_*` compatibility configuration.
|
|
|
|
See the [Kubernetes documentation](https://silo.pgsty.com/operations/deployments/kubernetes/) for more information.
|
|
|
|
## Silo Docker Tips
|
|
|
|
### Silo Custom Access and Secret Keys
|
|
|
|
To override Silo's auto-generated keys, you may pass secret and access keys explicitly as environment variables. Silo server also allows regular strings as access and secret keys.
|
|
|
|
#### GNU/Linux and macOS (custom access and secret keys)
|
|
|
|
```sh
|
|
docker run \
|
|
-p 9000:9000 \
|
|
-p 9001:9001 \
|
|
--name silo1 \
|
|
-e "MINIO_ROOT_USER=AKIAIOSFODNN7EXAMPLE" \
|
|
-e "MINIO_ROOT_PASSWORD=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" \
|
|
-v /mnt/data:/data \
|
|
docker.io/pgsty/silo server /data --console-address ":9001"
|
|
```
|
|
|
|
#### Windows (custom access and secret keys)
|
|
|
|
```powershell
|
|
docker run \
|
|
-p 9000:9000 \
|
|
-p 9001:9001 \
|
|
--name silo1 \
|
|
-e "MINIO_ROOT_USER=AKIAIOSFODNN7EXAMPLE" \
|
|
-e "MINIO_ROOT_PASSWORD=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" \
|
|
-v D:\data:/data \
|
|
docker.io/pgsty/silo server /data --console-address ":9001"
|
|
```
|
|
|
|
### Run Silo Docker as a regular user
|
|
|
|
Docker provides standardized mechanisms to run docker containers as non-root users.
|
|
|
|
#### GNU/Linux and macOS (regular user)
|
|
|
|
On Linux and macOS you can use `--user` to run the container as regular user.
|
|
|
|
> NOTE: make sure --user has write permission to *${HOME}/data* prior to using `--user`.
|
|
|
|
```sh
|
|
mkdir -p ${HOME}/data
|
|
docker run \
|
|
-p 9000:9000 \
|
|
-p 9001:9001 \
|
|
--user $(id -u):$(id -g) \
|
|
--name silo1 \
|
|
-e "MINIO_ROOT_USER=AKIAIOSFODNN7EXAMPLE" \
|
|
-e "MINIO_ROOT_PASSWORD=wJalrXUtnFEMIK7MDENGbPxRfiCYEXAMPLEKEY" \
|
|
-v ${HOME}/data:/data \
|
|
docker.io/pgsty/silo server /data --console-address ":9001"
|
|
```
|
|
|
|
#### Windows (regular user)
|
|
|
|
On windows you would need to use [Docker integrated windows authentication](https://success.docker.com/article/modernizing-traditional-dot-net-applications#integratedwindowsauthentication) and [Create a container with Active Directory Support](https://blogs.msdn.microsoft.com/containerstuff/2017/01/30/create-a-container-with-active-directory-support/)
|
|
|
|
> NOTE: make sure your AD/Windows user has write permissions to *D:\data* prior to using `credentialspec=`.
|
|
|
|
```powershell
|
|
docker run \
|
|
-p 9000:9000 \
|
|
-p 9001:9001 \
|
|
--name silo1 \
|
|
--security-opt "credentialspec=file://myuser.json"
|
|
-e "MINIO_ROOT_USER=AKIAIOSFODNN7EXAMPLE" \
|
|
-e "MINIO_ROOT_PASSWORD=wJalrXUtnFEMIK7MDENGbPxRfiCYEXAMPLEKEY" \
|
|
-v D:\data:/data \
|
|
docker.io/pgsty/silo server /data --console-address ":9001"
|
|
```
|
|
|
|
### Silo Custom Access and Secret Keys using Docker secrets
|
|
|
|
To override Silo's auto-generated keys, you may pass secret and access keys explicitly by creating access and secret keys as [Docker secrets](https://docs.docker.com/engine/swarm/secrets/). Silo server also allows regular strings as access and secret keys.
|
|
|
|
```
|
|
echo "AKIAIOSFODNN7EXAMPLE" | docker secret create access_key -
|
|
echo "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" | docker secret create secret_key -
|
|
```
|
|
|
|
Create a Silo service using `docker service` to read from Docker secrets.
|
|
|
|
```
|
|
docker service create --name="silo-service" --secret="access_key" --secret="secret_key" docker.io/pgsty/silo server /data
|
|
```
|
|
|
|
Read more about `docker service` [here](https://docs.docker.com/engine/swarm/how-swarm-mode-works/services/)
|
|
|
|
#### Silo Custom Access and Secret Key files
|
|
|
|
To use other secret names follow the instructions above and replace `access_key` and `secret_key` with your custom names (e.g. `my_secret_key`,`my_custom_key`). Run your service with
|
|
|
|
```
|
|
docker service create --name="silo-service" \
|
|
--secret="my_access_key" \
|
|
--secret="my_secret_key" \
|
|
--env="MINIO_ROOT_USER_FILE=my_access_key" \
|
|
--env="MINIO_ROOT_PASSWORD_FILE=my_secret_key" \
|
|
docker.io/pgsty/silo server /data
|
|
```
|
|
|
|
`MINIO_ROOT_USER_FILE` and `MINIO_ROOT_PASSWORD_FILE` also support custom absolute paths, in case Docker secrets are mounted to custom locations or other tools are used to mount secrets into the container. For example, HashiCorp Vault injects secrets to `/vault/secrets`. With the custom names above, set the environment variables to
|
|
|
|
```
|
|
MINIO_ROOT_USER_FILE=/vault/secrets/my_access_key
|
|
MINIO_ROOT_PASSWORD_FILE=/vault/secrets/my_secret_key
|
|
```
|
|
|
|
### Retrieving Container ID
|
|
|
|
To use Docker commands on a specific container, you need to know the `Container ID` for that container. To get the `Container ID`, run
|
|
|
|
```sh
|
|
docker ps -a
|
|
```
|
|
|
|
`-a` flag makes sure you get all the containers (Created, Running, Exited). Then identify the `Container ID` from the output.
|
|
|
|
### Starting and Stopping Containers
|
|
|
|
To start a stopped container, you can use the [`docker start`](https://docs.docker.com/engine/reference/commandline/start/) command.
|
|
|
|
```sh
|
|
docker start <container_id>
|
|
```
|
|
|
|
To stop a running container, you can use the [`docker stop`](https://docs.docker.com/engine/reference/commandline/stop/) command.
|
|
|
|
```sh
|
|
docker stop <container_id>
|
|
```
|
|
|
|
### Silo container logs
|
|
|
|
To access Silo logs, you can use the [`docker logs`](https://docs.docker.com/engine/reference/commandline/logs/) command.
|
|
|
|
```sh
|
|
docker logs <container_id>
|
|
```
|
|
|
|
### Monitor Silo Docker Container
|
|
|
|
To monitor the resources used by Silo container, you can use the [`docker stats`](https://docs.docker.com/engine/reference/commandline/stats/) command.
|
|
|
|
```sh
|
|
docker stats <container_id>
|
|
```
|
|
|
|
## Explore Further
|
|
|
|
* [Silo in a Container Installation Guide](https://silo.pgsty.com/operations/deployments/baremetal-deploy-minio-as-a-container/)
|
|
* [Silo Erasure Code QuickStart Guide](https://silo.pgsty.com/operations/concepts/erasure-coding/)
|