MinIO Object Storage on PMSS

MinIO is a mature, widely-integrated S3 server you can run on a Pulsed Media storage box or seedbox when you want more than a plain bucket — object versioning, bucket policies, and a browser-based object console. It is a single Go binary that runs from your home directory; in a test on a Pulsed Media storage box the server held about 138 MB of RAM. It is one of the self-hosted S3 options, heavier than rclone serve s3 but with a richer feature set. The keys are yours and the data stays in Pulsed Media's Finnish datacenters.

The MinIO Community Edition object browser on a Pulsed Media storage box, showing a private bucket and an uploaded object. The server held about 138 MB of RAM.

When MinIO is the right tool

Reach for MinIO when a plain bucket is not enough:

You want object versioning — keep previous versions of an object after it is overwritten or deleted. rclone serve s3 does not do this; MinIO does.
You want bucket policies and multiple access keys with different permissions, managed with the mc command-line client.
You want a browser object console to see and manage buckets and objects without a separate S3 client.
You are running software that expects a full-featured S3 target — MinIO is one of the most widely tested S3 implementations, so compatibility is rarely the problem.

For the simplest possible endpoint on one box, rclone serve s3 is lighter. To spread the store across boxes so a whole box can fail, use Garage.

What one process needs

MinIO ships as a single Go binary — download it into ~/bin and run it; there is no package to install and no root required. In a test on a Pulsed Media storage box (MinIO RELEASE.2025-09-07, Debian 12) the running server held about 138 MB of resident memory while serving a small bucket. That is more than rclone serve s3 (about 51 MB in the same test) and buys you the console, versioning, and policy engine. Objects are stored under a data directory in your home; disk cost tracks your data.

Verified behaviour

On a Pulsed Media storage box, MinIO was exercised end to end: download the binary, start the server on non-default ports bound to localhost, then over the S3 API create a bucket, upload an object, list it, and read it back byte for byte. Object versioning was enabled on the bucket and accepted. The object browser, reached over an SSH tunnel to the console port, showed the bucket and the uploaded object — that is the screenshot. The server held about 138 MB of RAM throughout.

The Community Edition console

MinIO's open-source Community Edition is what you self-host, and it is worth knowing what its console does and does not include. Since 2025, MinIO moved the browser-based administration features — user management, access policies, and configuration — out of the Community Edition and into its paid tier. What the Community Edition console still gives you is the object browser: create buckets, browse, upload, and download objects, as in the screenshot. Administration — users, policies, versioning, configuration — is done with the mc command-line client (mc admin), which remains fully featured. So on a Pulsed Media box you drive MinIO day to day with mc, and use the console when you want to click through your objects.

Setting it up

Download the server and the client into ~/bin:

mkdir -p ~/bin ~/minio-data
curl -fsSL https://dl.min.io/server/minio/release/linux-amd64/minio -o ~/bin/minio && chmod +x ~/bin/minio
curl -fsSL https://dl.min.io/client/mc/release/linux-amd64/mc      -o ~/bin/mc    && chmod +x ~/bin/mc

Start the server. Pick your own ports — not the default 9000, which automated scanners probe and which another user on a shared box may already hold — and bind to localhost, a VPN, or a known client IP. Run it inside a tmux or screen session:

MINIO_ROOT_USER=YOUR-ACCESS-KEY MINIO_ROOT_PASSWORD=YOUR-SECRET-KEY \
  ~/bin/minio server ~/minio-data \
  --address 127.0.0.1:PORT --console-address 127.0.0.1:CONSOLE_PORT

Point the mc client at it and use it:

mc alias set myminio http://127.0.0.1:PORT YOUR-ACCESS-KEY YOUR-SECRET-KEY
mc mb myminio/mybucket
mc version enable myminio/mybucket      # object versioning
mc cp file.txt myminio/mybucket/

To reach the console from your own machine, forward the console port over SSH — ssh -L LOCALPORT:127.0.0.1:CONSOLE_PORT you@server — then open http://127.0.0.1:LOCALPORT. Do not bind the console to all interfaces on a shared box. See Docker on PMSS if you would rather run MinIO as a rootless container than a bare binary.

A stable hostname, and TLS

Point S3 clients at your service permalink — <your-service-label>.mcx.fi:PORT — so the endpoint keeps working when Pulsed Media migrates your service. Some clients refuse plain HTTP; give MinIO a certificate by mounting public.crt and private.key into ~/.minio/certs/, and set the certificate's name to your permalink so the trusted name survives a move.

Security

Use long, random values for the root access key and secret. The console and the S3 API both use them.
Do not use the default port 9000. Pick your own, and bind to localhost, a VPN, or a known client IP unless you need public access.
Manage least-privilege access keys and bucket policies with mc admin rather than handing out the root key.
MinIO stores and serves bytes; it does not encrypt them for you. Combine it with client-side encryption for sensitive data.