S3-compatible object storage,
without the weight.
VaultS3 is a self-hosted, S3-compatible object store in a single binary under 80 MB of RAM, with a built-in dashboard, erasure coding, clustering, encryption, and vector search. The maintained, honest alternative to MinIO.
docker run -p 9000:9000 eniz1806/vaults3 
Everything in one binary
No add-ons, no paywalled console, no surprise tiers. The features you'd pay for elsewhere ship in the box.
S3-compatible API
SigV4 auth, multipart uploads, versioning, presigned URLs, object tagging, lifecycle, CORS, and bucket policies. Drop-in for the AWS SDKs, aws-cli, rclone, and boto3.
Built-in web dashboard
A real management UI: file browser, bucket config, IAM, audit trail, metrics, search, and replication status. No separate console to license.
Cost estimator
A dashboard panel that prices what you are storing against AWS S3, GCS, Cloudflare R2, Backblaze B2 and Wasabi, storage and egress, next to what it costs you to host it yourself. Egress-free, and free.
Encryption your way
Server-side AES-256-GCM, per-bucket keys with rotation and crypto-shredding for multi-tenant isolation, and SSE-C for fully operator-blind objects.
IAM, policies and SSO
Users, groups and S3-compatible policies, with OIDC single sign-on via the authorization-code flow with PKCE, validated against real Keycloak and Authentik deployments.
Virus scanning
Uploads are posted to a scan endpoint you choose, ClamAV or VirusTotal or your own, and anything infected lands in a quarantine bucket instead of your data.
Erasure coding
Reed-Solomon sharding across disks with a background healer that auto-reconstructs degraded objects. Survives losing whole drives.
Raft clustering
Strongly-consistent metadata via HashiCorp Raft, a consistent-hash placement ring, failure detection, and automatic failover. (Beta)
Active-active replication
Bidirectional replication with vector clocks and pluggable conflict resolution, plus one-way async push between sites.
Semantic / vector search
Built-in RAG retrieval: embed text objects via any OpenAI-compatible endpoint and query by similarity. No separate vector database.
Tiering & backup
Transparent hot/cold tiering to local or remote storage, plus scheduled full/incremental backups.
Runs anywhere
One static binary of about 30 MB, a container image that is 14 MB to pull, a Helm chart, a Kubernetes operator, or a FUSE mount. amd64 + arm64.
How it compares
An honest look, including where the others are ahead.
This is a one-person project, and you should know that before you trust it with your data.
I built VaultS3 for myself. I was running MinIO, the pieces I depended on moved behind a paid tier, and I did not want to rent back something I already had. So I wrote my own.
It is on GitHub because I doubt I was the only one in that position. What you get is a maintainer who runs this in production himself and fixes things because he runs into them too. What you do not get is a company standing behind it. That is the trade, and I would rather you made the call with your eyes open.
If something breaks, open an issue. If you would rather fix it yourself, pull requests are welcome.
| VaultS3 | MinIO | Silo | RustFS | SeaweedFS | Garage | |
|---|---|---|---|---|---|---|
| GitHub stars | 1.3k | 61k | 2.5k | 31k | 34k | 4.4k |
| License | AGPL-3.0 | AGPL-3.0 | AGPL-3.0 | Apache-2.0 | Apache-2.0 | AGPL-3.0 |
| Maintained in the open | ✓ | Archived | ✓ | ✓ | ✓ | ✓ |
| RAM, idle | 17 MiB | 184 MiB | 101 MiB | 70 MiB | 98 MiB | 23 MiB |
| Components to run | 1 | 1 | 1 | 1 | 3 | 1 |
RAM measured August 2026 on one host, all six idle with no traffic, Docker working set after a 110 second settle. Memory under load is higher for every one of them: VaultS3 peaks near 185 MiB writing 64 MiB objects at concurrency 16. Reproduce it with docker stats --no-stream. MinIO archived its community console and project in 2025-2026, moving features to its paid AIStor offering.
When to pick something else
- You already run MinIO and want it to keep working: Silo, a community fork by Pigsty that keeps the line maintained and restores the console MinIO cut. Same on-disk format and API, so an existing deployment carries on unchanged.
- AGPL is a problem for you: RustFS or SeaweedFS, both Apache-2.0. RustFS is also the largest of these by adoption, though its own README still marks distributed mode, lifecycle and KMS as under testing.
- You need a distributed filesystem, not only object storage: SeaweedFS, with a mature FUSE mount and a filer layer. It runs as master, volume and filer rather than one process.
- You want the smallest replicated store and do not need erasure coding: Garage, which idles in 23 MiB and is deliberately narrow in scope.
When VaultS3 is the answer
One binary with the smallest footprint of the six, and the things you would otherwise assemble or pay for already in the box: a full dashboard, IAM with policies and OIDC, versioning with diff and rollback, per-bucket encryption with rotation and crypto-shredding, erasure coding, Raft clustering, active-active replication, lifecycle, notifications, a FUSE mount, full-text and vector search, virus scanning, tiering and scheduled backups. No paid tier holds any of it back, and there is no telemetry.
Spin it up in 30 seconds
One binary or one container. No license key, no account, no telemetry. Just object storage that works.