garfieldwtf/s3nio repository overview

⁠S3nio Console

S3nio Console is a self-hosted web console for managing and browsing S3-compatible object storage. It supports multiple storage connections, object browsing, uploads, downloads, previews, bucket settings, and provider-specific identity management.

Alibaba Cloud OSS connections use the Alibaba Cloud CLI for RAM users, groups, custom policies, and AccessKeys. The CLI is included in the image on amd64 and arm64; RAM API credentials and the region come from the selected connection. The first RAM operation may download the Alibaba RAM CLI plugin, so the container needs outbound access to Alibaba's plugin repository.

⁠Quick start

docker pull garfieldwtf/s3nio:latest
docker run -d \
  --name s3nio \
  --restart unless-stopped \
  -p 4173:4173 \
  -e MINIO_UI_USERNAME=admin \
  -e MINIO_UI_PASSWORD='replace-with-a-password-of-at-least-8-characters' \
  -e MINIO_UI_SESSION_SECRET='replace-with-a-separate-random-session-secret' \
  -v s3nio-data:/data \
  garfieldwtf/s3nio:latest

Open http://localhost:4173 and sign in with the UI username and password you set. Add your S3 connection under Settings → S3 connections. The UI credentials are separate from your storage access keys.

Use HTTPS through a reverse proxy when exposing the console beyond a trusted network. Keep the password, session secret, and /data volume private.

⁠Configuration

The named volume mounted at /data stores configured S3 connections and provider-specific metadata. Back up this volume securely. Do not put storage credentials in the image or publish them in a container command that is visible to other users on the host.

To configure a default connection from environment variables, supply all three of MINIO_ENDPOINT, MINIO_ACCESS_KEY, and MINIO_SECRET_KEY. Additional connections can be added and edited in the console.

⁠Provider support

S3 object operations use the provider's S3-compatible API. Select a provider profile when adding a connection so endpoint addressing is configured appropriately.

• MinIO: object storage and MinIO user, group, policy, service-account, metrics, and site-replication administration, subject to server permissions.
• RustFS: object storage, IAM users, groups, canned policies, service accounts, and bucket replication through its APIs. The connected key needs RustFS admin permissions; service accounts inherit their parent user's access and can be restricted by a session policy. Site replication uses RustFS's rc client and is not exposed in this UI yet.
• SeaweedFS: object storage, IAM users, groups, managed/inline policies, and access keys through the embedded IAM API on the S3 endpoint. IAM writes must be enabled (-s3.iam.readOnly=false) and the filer must persist IAM metadata.
• Garage: object storage and key management through its separate Garage Admin API. Configure the Admin API endpoint and bearer token in the connection settings; assign per-bucket permissions in Garage.
• Ceph RGW: object storage, IAM users, groups, inline policies, built-in managed policies, and S3 user keys. IAM actions require account-root or delegated IAM authorization; Admin Ops key creation/removal also needs users=write and listing needs users=read. Ceph supports bucket replication between zones; site replication uses Ceph multisite administration.
• Amazon S3: S3 object operations and AWS IAM users, groups, managed policies, and access keys when the connected credentials also have the required IAM permissions.
• Backblaze B2: S3 object operations and B2 application keys with capability profiles, optional bucket scope, and expiry. Changing a key's policy replaces the key and returns a new secret once.
• Other listed S3-compatible providers: S3 object operations where supported by the service. Provider-specific users, policies, and credentials may require that provider's own control-plane API and account credentials.

S3 does not define a universal API for creating users or policies across all compatible providers. Garage and Ceph do not provide IAM policy documents per key; use their bucket permissions, user capabilities, or bucket policies. Availability and behavior depend on the selected provider and the permissions of the configured credentials.

⁠Included tools

The image includes MinIO Client (mc) on amd64, arm64, and ppc64le, plus AWS CLI (aws) on amd64. Backblaze B2 application-key management uses the built-in B2 API client and needs no extra command-line tool. On architectures without a bundled CLI, S3 object operations still use the app's S3 client; provider features requiring the missing CLI are unavailable.

⁠Supported architectures

The latest image is published for linux/386, linux/amd64, linux/arm/v6, linux/arm/v7, linux/arm64, linux/ppc64le, linux/riscv64, and linux/s390x.

⁠Build locally

docker build -t s3nio-console .

The frontend and production dependencies are prepared with node:lts-alpine. The final image uses the latest Alpine base and Alpine's Node.js package so the runtime supports the full architecture list above. The app runs as an unprivileged user.