Category: Storage
S3-compatible storage for backups: MinIO alternatives
A destination for the backups of your databases, machines and applications that speaks S3, lives on servers you control and is designed so that an attacker cannot wipe the history.
- Where it runs
- In your account, in your name
- Backups
- With tested restores
- Updates
- Planned and documented
- Licence
- SeaweedFS, RustFS and Versity: Apache 2.0. Garage: AGPLv3. Ceph: LGPL
In short
S3-compatible object storage keeps files in buckets and understands the same API as Amazon S3, so almost any backup tool can write to it. We set it up on your servers with the maintained option that fits best, configure access, object locking where the software supports it, replication to another site and alerts, and we keep it up to date.
What do we look after?
Almost every modern backup tool writes to S3: pgBackRest, WAL-G, Velero, restic or Proxmox Backup Server. Having your own S3 destination is convenient, but it is the last resort when everything else fails, so it needs as much care as what it protects:
Servers and disks
Disk redundancy, SMART monitored and capacity planned for the retention.
S3 service
The chosen software configured, with HTTPS and up-to-date versions.
Credentials
One per tool, with minimum permissions and documented rotation.
Object locking
Versioning and Object Lock on the backup buckets when the software allows it.
Replication
A second copy in another location, your own or a provider’s.
Alerts
Space, write errors, degraded disks and backups that stop arriving.
Which option do we recommend today?
For years, MinIO was the default answer. With its repository archived and unmaintained, we no longer propose it for new installations. These alternatives are open source and still active:
| Option | Licence | Fits when | Limits to bear in mind |
|---|---|---|---|
| SeaweedFS | Apache 2.0 | Lots of files, continuous growth and a need for versioning and object locking | Several services (master, volume, filer and S3 gateway); we check the S3 features each tool uses |
| Ceph RGW | LGPL | Large volume, several servers and, often, an existing Ceph | Needs several nodes, a fast network and Ceph experience; locking is enabled when the bucket is created |
| RustFS | Apache 2.0 | A close replacement for MinIO, with versioning, object locking and replication | Version 1.0 is very recent; we test it with your tools first |
| Garage | AGPLv3 | Few servers, even on different sites, and a small team | No versioning or Object Lock; part of the S3 API not implemented |
| Versity S3 Gateway | Apache 2.0 | Giving S3 access to a file system you already have | Redundancy depends on the underlying file system |
| A provider’s managed S3 | Commercial service | No obligation to keep the data in-house | You depend on the provider; we often use it as a second location |
Before deciding, we check which S3 calls your backup tools make: some take versioning or certain headers for granted and fail if the server does not support them.
Which problems do we come across most often?
- Community MinIO left un-updated because there are no new versions to install.
- A single administrator credential used by every backup tool.
- Destination on the same machine or in the same room as what it backs up.
- No object locking or replication: whoever compromises the servers deletes the backups too.
- Disk full without warning: backups fail and nobody notices until one is needed.
- Self-signed certificates that force you to turn off TLS verification on the clients.
How do we check that it actually works?
A backup destination is tested by restoring from it. For each tool that writes there, we regularly rehearse a real restore and note the time taken. We also try to delete a protected backup with the tool’s credentials to confirm that locking works, check that the replica in the second location is up to date, and simulate the loss of a disk or a node to see that the service keeps responding.
Who is it for?
- A company that cannot take its backups off its premises because of a contract or internal policy.
- A team with its own Proxmox VE or Kubernetes cluster that needs a nearby S3 destination to restore quickly.
- Anyone running MinIO in production who needs to move to something maintained without losing the backup history.
Virtual machine backups usually arrive from a managed Proxmox Backup Server; database backups, from pgBackRest or WAL-G on managed PostgreSQL.
How do we update it?
We follow each project’s release notes and update node by node when there are several, so that the service is not interrupted. Before a major version, we check that recent backups of everything it holds are also in the second location. With Ceph, we also follow the upgrade order set out in its documentation.
- Backup toolspgBackRest, Velero, restic, PBS
- S3 APIHTTPS and credentials per tool
- StorageSeaweedFS, Ceph RGW, RustFS or Garage
- ReplicationSecond location
Where do we set it up?
In your account, with the provider you already use or the one that fits best. If the data has to stay in the EU, Hetzner and OVHcloud are the European options.
Providers we set it up on
- Hetzner
- OVH
- AWS
- Own server
| Provider | How we set it up | Things to bear in mind |
|---|---|---|
| Hetzner | Dedicated servers with plenty of disks as your own storage, or Hetzner Object Storage as a second location. | If a managed service is enough for you, Hetzner Object Storage is already S3-compatible and there is nothing to set up. |
| OVH | Dedicated storage servers with SeaweedFS, Ceph or RustFS, or OVHcloud Object Storage as a managed destination. | |
| AWS | Amazon S3 with Object Lock as a second location for the backups held on your own storage. | Running your own storage inside AWS is rarely worth it compared with S3. |
| Own server | The chosen storage on servers in your office or your data centre, with replication offsite. | A single machine with a single disk is not a backup destination: at the very least, redundant disks and a second location. |
What is included
- A reasoned choice of software based on volume, number of servers and the S3 features your backup tools need.
- An S3-compatible service on your servers or on dedicated machines, with disks and redundancy sized for the agreed retention.
- One bucket and one set of credentials per backup tool, with the minimum permissions each one needs.
- Versioning and object locking (Object Lock) on the backup buckets, if the chosen software supports them.
- HTTPS with a valid certificate and access only from the networks that send backups.
- Replication or a second copy in another location, to other storage of your own or to an S3 provider.
- Metrics for space, errors, disks and requests, with alerts before you run out of room.
- Planned updates and, if you already use MinIO, an exit plan towards a maintained alternative.
Frequently asked questions
What has happened to MinIO?
The public MinIO repository is archived and read-only, and its own front page warns that it is no longer maintained; the company points to its AIStor product. A community MinIO that already works keeps working, but it gets no updates, so for new installations we propose a maintained alternative.
Which alternative should I choose?
SeaweedFS and Ceph RGW are long-standing projects that document versioning and object locking; Ceph is the most complete and the most demanding to run. RustFS, also with object locking, released its version 1.0 in September 2026. Garage is lightweight and works across several sites, but today it has neither versioning nor locking. We choose based on your size and what your tools need.
Why does object locking matter?
Because with Object Lock a backup cannot be deleted or overwritten until its retention period ends. If someone compromises your servers, they cannot take the backup history with them too. If the chosen software does not support it, we make up for it with a second copy on a destination that does.
Is it not simpler to use a provider's S3?
Often, yes. Hetzner, OVHcloud and AWS offer managed S3-compatible storage, and for many companies it is the best option. Your own storage makes sense when the data cannot leave your premises, when the volume makes the service expensive, or as a second copy independent of the main provider.
How do we move off a MinIO we already have?
We set up the alternative in parallel, copy the buckets with an S3 sync tool such as rclone, compare counts and sizes, and switch the backup tools over one by one. The old MinIO stays read-only until the old retention periods expire or have been copied.
Tell us about your case
In a free 20-minute call we look at where you are and where to start. No commitment.
Official documentation consulted
The technical details on this page are based on:
Reviewed on