MinIO on a VPS after the AGPL change: what you can still ship

curl -sI against https://dl.min.io/server/minio/release/linux-amd64/minio answered HTTP 410. docker pull minio/minio:latest failed with pull access denied. The same lab host then built MinIO with go install github.com/minio/minio@latest, started it on 127.0.0.1:9010, uploaded a 4 MiB object, downloaded it, and matched sha256 e1bc3c54…6305. Idle RSS sat at 129.2 MiB. License line on the binary: GNU AGPLv3.

AGPL arrived years earlier. What broke Compose files and “wget the binary” tutorials is source-only packaging, archived community repos, dead Hub tags, and a free proprietary product that is a different download entirely.

What changed, in order

SDK clients stayed Apache-licensed. The server you run did not. The AGPL change raised copyleft questions for anyone who modified MinIO and offered it over a network. The source-only and archive moves removed the easy binary path for everyone else.

How do you build MinIO from source on a VPS?

You need a current Go toolchain. This lab used Go 1.25.5 on amd64 Ubuntu.

export GOBIN=$HOME/bin
mkdir -p "$GOBIN"
# Prefer a tagged release when you want a pin:
# go install github.com/minio/[email protected]
go install github.com/minio/minio@latest
ls -lh "$GOBIN/minio"
"$GOBIN/minio" --version

@latest produced a 142 MiB binary labelled DEVELOPMENT.GOGET with License: GNU AGPLv3. For a reproducible VPS, pin the last community tag instead of floating @latest.

export MINIO_ROOT_USER=minioadmin
export MINIO_ROOT_PASSWORD='choose-a-long-secret'
mkdir -p ~/minio-data
minio server ~/minio-data \
  --address 127.0.0.1:9010 \
  --console-address 127.0.0.1:9011

Health check:

curl -s -o /dev/null -w '%{http_code}\n' \
  http://127.0.0.1:9010/minio/health/live
# 200

Keep the API on loopback. Put TLS on Caddy if clients need a hostname. Leave 9010 closed on the panel firewall.

A minimal systemd unit shape:

[Unit]
Description=MinIO (self-built AGPL)
After=network.target

[Service]
User=minio
Environment=MINIO_ROOT_USER=minioadmin
Environment=MINIO_ROOT_PASSWORD=FILE:/etc/minio/root-password
ExecStart=/usr/local/bin/minio server /var/lib/minio \
  --address 127.0.0.1:9010 \
  --console-address 127.0.0.1:9011
Restart=on-failure

[Install]
WantedBy=multi-user.target

Build the binary on a builder host or CI, copy it to the VPS, and record the commit or tag in your runbook. If you want a container, build the image yourself from that binary. Hub will not hand you minio/minio anymore.

Prove S3 put and get

export AWS_ACCESS_KEY_ID=minioadmin
export AWS_SECRET_ACCESS_KEY='choose-a-long-secret'
aws --endpoint-url http://127.0.0.1:9010 s3 mb s3://lab-bucket

dd if=/dev/urandom of=/tmp/proof.bin bs=1M count=4
sha256sum /tmp/proof.bin
aws --endpoint-url http://127.0.0.1:9010 \
  s3 cp /tmp/proof.bin s3://lab-bucket/proof.bin
aws --endpoint-url http://127.0.0.1:9010 \
  s3 cp s3://lab-bucket/proof.bin /tmp/proof-out.bin
cmp /tmp/proof.bin /tmp/proof-out.bin && echo SHA_MATCH

Lab result: sha256 e1bc3c541f5b975bc52eda16a5861d518dcea7f7f89e47f1ae9449a3885b6305 matched on download. Idle RSS after that round-trip: 129.2 MiB.

AGPL in plain language

AGPLv3 is free software with a network copyleft. If you run unmodified MinIO for your own apps on your VPS, the usual reading is that you can use the binary you built. If you modify the server and let other people interact with that modified program over a network, AGPL expects you to offer the corresponding source to those users.

“Ship” in this post means putting a binary or image into someone else’s hands, or selling a hosted S3 that includes your MinIO changes. Running a stock build for one tenant inside your company is a different risk profile than patching MinIO and selling object storage. Talk to counsel for the second case; this page is lab ops, not legal advice.

Unmaintained AGPL source also means you own CVE response. The last community-tagged security release was the October 2025 privilege-escalation fix. After archive, patches are yours to backport, or you move off the stack.

AIStor Free is a different product

MinIO’s current free download path is AIStor Free: full AIStor features on a single node, under a proprietary free licence that prohibits redistribution. It stays under MinIO Inc.’s licence terms. You cannot treat it as AGPL source you mirror into a private registry for customers, and multi-node needs a paid tier.

Use AIStor Free when you accept that licence and want their maintained binary channel. Leave it out of a Compose file you hand to other people if redistribution is part of what you sell.

The 2026 object-store menu around MinIO

Late-2026 roundups of “self-hosted S3 after MinIO” keep listing the same neighbours. RustFS (Apache 2.0) is the new MinIO-shaped binary path after a 1.0 GA; SeaweedFS (Apache 2.0) stays the usual pick for many small objects and already appears in our SeaweedFS vs Garage lab. Garage remains AGPLv3, so it does not fix a pure licence complaint even though it is light and geo-friendly. Ceph RGW is mature and heavy. Versity Gateway sits in front of an existing filesystem instead of owning the disks.

None of those are drop-in clones of every MinIO admin quirk. Pick by the S3 features you actually call (versioning, object lock, IAM-shaped policies), then put/get on a VPS the way this post does. Building MinIO from archived AGPL source still works when you need behavioural continuity; leaving for Garage or SeaweedFS is the lower ops bill when you do not.

When to leave for Garage

On this lab host Garage still answered on 127.0.0.1:3900 while MinIO ran on 9010. The Garage S3 post measured about 7 MiB idle for v2.5.0 after put/get. MinIO’s self-built process sat near 129 MiB.

Garage fits a maintained S3 endpoint with a small footprint on a 2 GB Compute Instance and without AGPL or AIStor paperwork. Self-built MinIO fits when you already depend on MinIO-specific behaviour and you accept building, pinning, and patching yourself. AIStor Free fits when you want MinIO’s commercial line on one node under their free licence.

FAQ

Is MinIO still open source? The archived community server remains AGPLv3 source. There is no maintained community binary channel. AIStor Free is proprietary.

Can I keep using an old Hub image I already pulled? Locally, until you rebuild the host. You cannot pull it again from Hub, and you inherit every unpatched CVE in that layer.

Does go install make AGPL go away? No. The binary still prints GNU AGPLv3. You built it; you did not relicense it.

mc client? Community mc followed the same source-only / archive path. This lab used the AWS CLI against the S3 API.

SeaweedFS? Sensible when you have many small objects and want a different ops model. Out of scope here; Garage is the sibling post for “small S3 on one VPS.”

What to run on the VPS

A 2 GB Compute Instance is enough for a self-built MinIO on loopback or Garage, with room for the app that talks S3. Build the binary (or pin Garage by digest), prove put/get once, then put Caddy in front if the API must be public. Leave Hub tags and dl.min.io wget lines out of the Compose you ship.