Self-hosted S3-compatible storage: Ceph RGW and the alternatives

Summary

Six open-source projects serve self-hosted S3-compatible storage as MinIO alternatives, and their own documentation and licenses, viewed on 8 and 9 November 2026, show how they differ in S3 features, license terms, maintainers and, for five of them, data protection.

• MinIO's community edition moved from the Apache License 2.0 to the GNU AGPL version 3 on 23 April 2021 [1], shipped as source code only from 15 October 2025 [2, 3], entered maintenance mode on 3 December 2025 [4] and was archived on 25 April 2026 [5]. MinIO now calls that codebase frozen and sells AIStor under a commercial license [6].
• Security fixes for MinIO's frozen open-source code go to its commercial product, AIStor [6, 7]. MinIO's advisory for CVE-2026-41145, published on 14 April 2026 and rated high, covers every open-source release from RELEASE.2023-05-18T00-05-36Z onward and lists the fix only in an AIStor release [7].
• "S3-compatible" names a subset that each project documents for itself. AWS lists 116 Amazon S3 actions (counted for this report) [8]. The Ceph Object Gateway (RGW) marks 27 of the 28 features in its S3 table as supported and bucket replication as partial [9], and Garage answers 501 Not Implemented for every endpoint it lacks [10].
• Ceph RGW, SeaweedFS and RustFS document versioning, object lock, server-side encryption and lifecycle rules [9, 11, 12, 13, 14]. Garage lists versioning, object lock and bucket policies as missing [10], and Apache Ozone's S3 gateway lists versioning, object locking and server-side encryption as not supported [15].
• SeaweedFS, RustFS, Garage and Ceph protect data in different ways. SeaweedFS replicates hot data and erasure-codes warm data (splits it into data and parity pieces) in the background [13], RustFS follows MinIO's erasure-set topology rules [14], and Garage keeps whole copies only, leaving erasure coding out by design [16]. Ceph RGW writes into the pools of a Ceph cluster that also serves block devices and a file system [17, 18].
• The licenses differ in kind. Ceph's code is LGPL 2.1 or 3 [19], SeaweedFS, RustFS, Ozone and OpenStack Swift are Apache 2.0 [13, 14, 20, 21], and Garage is AGPL version 3 [22], whose section 13 asks a modified version to offer its source to users who reach it over a network [23]. AIStor is commercially licensed [6].
• Data leaves MinIO at the S3 level through general tools such as rclone, which names Ceph, Minio and SeaweedFS among its S3 providers [24]. RustFS's interoperability document says it reads MinIO's on-disk data in one direction, MinIO to RustFS, with some MinIO-encrypted objects readable only in an opt-in build and those sealed through KES, a KMS plugin or MinKMS readable in none [25]. RustFS's README says objects MinIO encrypted are not readable by RustFS [14].

Background

MinIO and the S3 API

Amazon S3's API reference lists 116 actions under Amazon S3, from AbortMultipartUpload to WriteGetObjectResponse (counted for this report on 8 November 2026) [8]. A store that calls itself S3-compatible answers a subset of those actions, and general S3 tools then reach it by its endpoint: rclone's S3 backend "can be used with a number of different providers" [24].

Four S3 features come up throughout this report. Versioning means "keeping multiple variants of an object in the same bucket" [26]. Object Lock stores objects under a "write-once-read-many (WORM) model" [27]. Server-side encryption comes in three forms that Ceph documents against Amazon's specifications: SSE-C with keys the client provides, SSE-KMS with keys from a key management service, and SSE-S3 [12]. Lifecycle rules expire objects or move them between storage classes [10, 18]. Erasure coding, a way of protecting data, partitions each object into data and parity shards as it is written, in MinIO's description [28].

MinIO's README describes it as an "S3-compatible object storage solution released under the GNU AGPL v3.0 license" [2]. The README now opens with "THIS REPOSITORY IS NO LONGER MAINTAINED." and points to two editions of its commercial product, AIStor Free and AIStor Enterprise [2].

The projects compared

• Ceph Object Gateway (RGW). "An object storage interface built on top of librados" that provides a RESTful gateway to Ceph storage clusters, with S3 and Swift interfaces [17].
• SeaweedFS. "A distributed storage system for object storage (S3), file systems, Iceberg table buckets, and Lance vector buckets" [13].
• RustFS. A distributed object storage system built in Rust [14].
• Garage. "A lightweight geo-distributed data store that implements the Amazon S3 object storage protocol", developed by Deuxfleurs [16].
• Apache Ozone. A distributed storage system for data analytics and object store workloads [20], with a separate S3 Gateway component [15].
• OpenStack Swift. Its documentation publishes a matrix of the S3 REST calls that its S3 API answers, beside its own Swift API [29].

MinIO's AIStor is included for comparison, as the commercial product MinIO names in place of its community edition [2, 6].

Method

What was examined. Self-hosted stores that serve the S3 API, compared on S3 feature coverage, data protection, license, maintainer, release dates, Kubernetes paths and moving data off MinIO.

Sources. Each project's own documentation, license file, repository page and releases page: MinIO [1, 2, 3, 4, 5, 6, 7, 28, 30, 31, 32, 33, 34, 35, 36], Ceph [9, 11, 12, 17, 18, 19, 37, 38, 39, 40, 41, 42], Rook [43, 44], SeaweedFS [13, 45, 53], RustFS [14, 25, 46, 47], Garage [10, 16, 22, 48, 49], Apache Ozone [15, 20, 50, 51] and OpenStack Swift [21, 29]. Also AWS's S3 API reference and user guide [8, 26, 27], the AGPL version 3 and Apache License 2.0 texts [23, 52] and rclone's S3 documentation [24]. Every page was viewed on 8 November 2026, except the SeaweedFS 4.53 release page [53], viewed on 9 November 2026.

How. Facts about a project come from that project's own pages. Where a project's documentation describes another project, as SeaweedFS's and RustFS's READMEs do for MinIO and Garage's compatibility table does for other stores, that description is left out. Vendor benchmarks are left out, and no store was installed or tested. Counts marked "counted for this report" were made from the cited page on 8 November 2026. License findings restate the license texts and each project's license file. Dates are UTC calendar dates as each page shows them.

Findings

1. MinIO's open-source edition, 2021 to 2026

The README's "Source-Only Distribution" section gives two ways to install the community edition: go install github.com/minio/minio@latest, or building a Docker image from the provided Dockerfile [2]. It states that the legacy binary releases receive no updates [2]. Before the maintenance notice, the commits on master include "Updates for conditional put read quorum issue" on 24 October 2025 and "Drop v3 metrics from community docs" on 6 November 2025 [35].

The maintenance-mode text of 3 December 2025 said "Critical security fixes may be evaluated on a case-by-case basis" and pointed to AIStor for "actively maintained versions" [4]. By 8 November 2026 MinIO's pricing page described the original AGPLv3 edition as no longer maintained, with a codebase "frozen, with no new features, bug fixes, or security patches" [6]. The same page states that "MinIO OSS is at end of life" and encourages its users to evaluate alternatives or upgrade to AIStor [6]. MinIO's former community documentation URLs for erasure coding now redirect to the AIStor documentation (observed on 8 November 2026) [28].

The README also carries MinIO's own reading of the license: usage "requires validation against AGPLv3 obligations", and the AGPLv3 "provides no obligation by any party to support, maintain, or warranty" the original or modified work [2].

2. Security fixes after the freeze go to AIStor

MinIO published advisory GHSA-hv4r-mvr4-25vw, CVE-2026-41145, on 14 April 2026, rated high at CVSS v4.0 8.8 [7]. It describes a flaw that "allows any user who knows a valid access key to write arbitrary objects to any bucket without knowing the secret key or providing a valid cryptographic signature", and states that any MinIO deployment is impacted [7]. The first affected release is RELEASE.2023-05-18T00-05-36Z, and the affected range runs through the final release of the open-source project [7].

The fix is listed in MinIO AIStor RELEASE.2026-04-11T03-20-12Z, and the advisory tells users of the open-source project to upgrade to that AIStor release or later [7]. As interim steps it gives blocking STREAMING-UNSIGNED-PAYLOAD-TRAILER requests at the load balancer and restricting write permissions [7].

An earlier advisory ties a fix to the October 2025 release. CVE-2025-62506, published on 16 October 2025 and rated high, a privilege escalation through a session policy bypass, lists its fix as a go install of RELEASE.2025-10-15T17-29-55Z [34].

MinIO's own pages disagree on which release ended the open-source line. Advisory CVE-2026-42600, published on 25 April 2026, names RELEASE.2025-09-07T16-13-09Z as "the final release of the minio/minio open-source project" [33], while the releases page lists RELEASE.2025-10-15T17-29-55Z after it [30]. This report names no final release.

3. AIStor's tiers and terms

MinIO prices AIStor on usable capacity after erasure-code overhead. Its example is a 1 PB cluster with 750 TB usable, priced on 750 TB [6]. The pricing page publishes no list prices, since every paid tier says to request pricing [6]. AIStor itself is "commercially licensed" [6].

4. "S3-compatible" is a documented subset

Ceph states that RGW is compatible with "the basic data access model of the Amazon S3 API" and lists one unsupported response header, x-amz-id-2 [9]. With Umbrella, the v21.2.0 release of 28 October 2026, Ceph vendored its s3-tests suite into the main repository, and its QA suites run the tests from there [38]. SeaweedFS runs "the S3 compatibility suite" and its SDK, IAM, SSE, policy and Spark integration tests in CI on every change [13]. RustFS states that it "does not claim complete coverage of every standard or vendor-specific S3 behavior", and its matrix refers to moving Ceph s3tests cases between its lists [46]. Garage implements signature v4, path-style and vhost-style URLs and presigned URLs, and lists the deprecated signature v2 as missing [10].

5. Training data features, project by project

The table restates the feature lists of four projects, each from its own pages.

Ceph RGW. With versioning enabled, every object added to the bucket receives a unique version ID, and objects added while it is suspended receive the version ID null [11]. Object lock has to be enabled when the bucket is created, or a later lock configuration fails [11]. Object lock is documented on the bucket operations page and is not a row of the feature table [9, 11]. Server-side encryption has been in the gateway since Luminous, requests for it must use HTTPS, SSE-KMS integrates with Barbican, Vault and KMIP, and SSE-S3 integrates with Vault only [12]. Umbrella adds AES-256-GCM next to the legacy CBC default [12]. Bucket notifications go to HTTP, AMQP 0.9.1 and Kafka endpoints [41]. Storage classes place object data in pools, and lifecycle rules move objects between storage classes [18]. Umbrella's notes add CopyObject for encrypted objects, restore from Glacier or tape, journal-mode bucket logging, timestamp-based epochs for versioned objects, global CORS rules and rate-limit responses with Retry-After, and mark full object dedup as a tech preview [38].

SeaweedFS. Its README lists versioning, object lock with retention and legal hold, lifecycle rules, tagging, CORS, conditional reads and writes, checksums, presigned URLs, browser POST uploads and multipart uploads, with STS that accepts OIDC, LDAP and Kubernetes service accounts [13].

RustFS. Its feature table marks a feature Available when it is "shipped and covered by CI gates" [14]. Two features, S3 Tables over Iceberg REST and MinIO on-disk compatibility, are marked as a preview, behind an opt-in flag or with a bounded compatibility claim [14].

Garage. Garage implements no ACLs or bucket policies and uses "its own system instead, built around a per-access-key-per-bucket logic" [10]. It lists object and bucket tagging and the bucket encryption endpoints as missing, and states that it did not implement server-side encryption [10].

Apache Ozone and OpenStack Swift. Ozone's S3 page lists bucket versioning, object locking, server-side encryption and S3 Select as not supported. It lists ACLs, bucket policies, CORS and website hosting as not fully implemented, and says Ozone uses an internal permission model that deviates from AWS S3 [15]. Swift's matrix answers yes for versioning, multipart uploads, object and bucket ACLs and multi-object delete, and no for bucket notification, lifecycle, bucket policy, public website and object tagging [29].

6. How each project stores and protects data

Ceph RGW. The gateway is an HTTP server, radosgw, on librados [17]. A bucket's placement target selects its pools at creation and cannot be changed afterward, and each storage class names a data pool in the zone configuration [18]. The same Ceph cluster can hold data from Ceph File System and Ceph Block Device clients, and the S3 and Swift APIs share one namespace [17]. Umbrella adds "a substantial new EC I/O path" for erasure coding [38]. In a multi-zone setup each zone is backed by its own Ceph cluster, every zone accepts writes, and a bucket's object data replicates only to the other zones of its zonegroup [39]. Ceph's hardware guide asks for SSDs for the gateway's index and log pools when bucket data sits on hard drives [40].

MinIO AIStor. AIStor groups the drives of each server pool into erasure sets of the same size, 2 to 16 drives by default, or up to 32 with an environment variable from RELEASE.2026-02-02T23-40-11Z [28]. It sets the number and size of erasure sets when a pool initializes, and they cannot be changed afterward [28]. MinIO lists "Built-in erasure coding and bitrot protection against drive failures" among AIStor Free's features [31].

RustFS. RustFS asks deployments to keep an existing pool's endpoints and erasure set width unchanged and to expand by appending a new pool [14]. It states that these topology rules follow MinIO's [14]. A single-node, single-drive deployment cannot expand in place or be added as a pool [14]. Bitrot protection and pool expansion and decommission are listed as available [14].

SeaweedFS. Volume servers store blobs in append-only volume files, keep a 16-byte in-memory index per blob, and replicate or erasure-code at the volume level [13]. Filer servers add directories and files, keep metadata in a store the user chooses, and expose HTTP, S3, WebDAV, SFTP, FUSE and table catalogs [13]. Hot data is replicated, and erasure coding is applied to warm data in the background, so writes avoid the encoding cost [13]. SeaweedFS's Enterprise Edition adds customizable erasure coding, EC vacuum and repair, data recovery and self-healing storage, in the README's description [13].

Garage. Garage lists storage optimizations among its non-goals: "we limit ourselves to duplication", with no erasure coding [16]. Its replication factor is configurable, with the hint that "in most cases, replication_factor = 3 is what you want", and data is deduplicated and optionally compressed with Zstd [48]. Garage is built for several sites joined by regular Internet connections, and Deuxfleurs runs its own cluster on 9 nodes in 3 physical locations [16].

Apache Ozone. Ozone's home page lists "Built-in replication, erasure coding" and native S3 protocol support next to Hadoop ecosystem integration [51]. S3 buckets sit under the /s3v volume [15].

7. Licenses and who stands behind each project

Ceph's COPYING file lists other licenses for some files, among them BSD 3-clause, Boost, GPL3 and public domain [19].

The AGPL and Apache texts differ in a network clause. Section 13 of the GNU AGPL version 3 says that if you modify the Program, your modified version must "prominently offer all users interacting with it remotely through a computer network" an opportunity to receive its Corresponding Source, from a network server at no charge [23]. The Apache License 2.0 contains no such clause. Its section 3 grants a "perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable" patent license from each contributor, within the limits that section states [52]. AIStor Free's license prohibits redistribution, and MinIO's blog says it limits redistribution or resale of the AIStor software [6, 31]. This finding restates the texts and draws no conclusion about any reader's use.

8. Release dates, support windows and stated requirements

Ceph's index calls these three releases actively maintained, receiving "periodic backports and security fixes" [37]. Umbrella is "the 21st stable release of Ceph", and its container images are based on Rocky Linux 10, which requires a CPU at the x86-64-v3 microarchitecture level [38]. RustFS published 1.0.0 on 16 September 2026 and four patch releases by 25 October 2026, none marked as a pre-release [47]. SeaweedFS published 4.50 and 4.51 on 25 October 2026 and 4.52 on 2 November 2026 [45]. Garage's releases page also lists v2.4.1, released 8 September 2026, and earlier releases [49].

Ceph's hardware guide recommends one drive for each Ceph OSD Daemon and a minimum OSD size of 1 TiB, states that drives smaller than 100 GiB are not effective at all, and lists at least 4 GB of RAM per ceph-osd daemon, at least 5 GB per ceph-mon daemon and at least 8 GiB per ceph-mds daemon [40]. It stresses enterprise-quality storage media for production workloads [40].

9. Kubernetes paths by project

Rook configures the Ceph object store on Kubernetes for several scenarios [44]. The CNCF accepted Rook on 29 January 2018, moved it to Incubating on 25 September 2018 and to Graduated on 7 October 2020, a level the CNCF page defines as "stable, widely adopted, and production ready" [43]. Rook's object storage documentation says object storage "exposes an S3 API and or a Swift API to the storage cluster", and its scenarios include RGW multisite [44]. SeaweedFS lists a Helm chart, the SeaweedFS Operator and a CSI driver as its Kubernetes paths [13]. RustFS lists Kubernetes Helm charts as available [14].

10. Moving data off MinIO

At the S3 level. The provider list of rclone's S3 backend includes "Ceph", "Minio", "SeaweedFS" and "Other", and does not name Garage or RustFS [24]. For Ceph, its documentation says to leave the region blank and set the endpoint [24]. Its examples include rclone sync --checksum /path/to/source s3:bucket and rclone copy --max-age 24h --no-traverse /path/to/source s3:bucket [24]. No source reviewed states what such a copy carries over, whether object versions, object lock retention, encryption or metadata.

On disk, into RustFS. RustFS calls its MinIO format support "an interop contract" and states that migration is one-way, MinIO to RustFS [25]. In that document, the default and rio-v2 builds read MinIO's unencrypted xl.meta objects. Objects MinIO encrypted with SSE-S3 or SSE-KMS fail closed in the default build and read in the rio-v2 build, which requires the shared master key [25]. Any SSE object from a MinIO backed by KES, a KMS plugin or MinKMS fails closed in both builds, and RustFS lists a live MinIO binary reading a drive set that RustFS wrote as unsupported [25]. RustFS's README differs: it says MinIO on-disk compatibility is gated behind the rio-v2 feature and not part of the default build, and that objects MinIO encrypted are not readable by RustFS [14]. Its S3 compatibility matrix states that MinIO SSE objects are not readable in default builds [46].

Into AIStor. MinIO's advisory for CVE-2026-41145 tells users of the open-source project to upgrade to an AIStor release [7], and the pricing page encourages them to contact MinIO to upgrade [6].

Implications

For teams choosing a MinIO alternative. The S3 features a workload calls narrow the field first. Versioned datasets and retention on checkpoints need versioning and object lock, which Ceph RGW, SeaweedFS and RustFS document and Garage and Ozone list as missing or not supported [9, 10, 11, 13, 14, 15]. Next comes the protection model and what it fixes at setup: AIStor fixes its erasure sets when a pool initializes [28], RustFS keeps a pool's erasure set width and grows by appending pools [14], Ceph fixes a bucket's placement target at creation [18], and Garage keeps whole copies [16]. A team that also needs block volumes or a shared file system can take them from the same Ceph cluster [17], and SeaweedFS's filers expose a POSIX file system next to S3 [13].

For teams with data on MinIO today. The community edition is archived and frozen, and MinIO publishes its later security fixes in AIStor releases [5, 6, 7]. The advisory for CVE-2026-41145 lists interim steps at the load balancer and in write permissions [7]. Copies at the S3 level work with general tools [24], and since no source reviewed says what they carry over, a test copy of versioned, locked and encrypted objects shows what arrives. Objects MinIO encrypted stay unreadable to RustFS's default build [25, 46].

For legal and procurement reviewers. The AGPL version 3 has a network-interaction clause that the Apache License 2.0 lacks [23, 52]. Ceph's code is LGPL 2.1 or 3 [19]. AIStor is commercial, with redistribution prohibited on its Free tier, pricing on usable capacity and no published list prices [6]. These are summaries of the texts, not legal advice.

For platform teams on Kubernetes. Rook is a graduated CNCF project for Ceph [43, 44]. SeaweedFS and RustFS publish Helm charts, and SeaweedFS adds an operator and a CSI driver [13, 14]. Support windows differ too: of the pages reviewed, only Ceph's release index gives end-of-life estimates [37].

Rillor designs and builds Ceph clusters whose object gateway serves self-hosted S3-compatible buckets, with versioning, for datasets, model weights and checkpoints, next to block volumes and shared file systems from the same cluster.

Limits of this analysis

• Documentation only, viewed on 8 and 9 November 2026. No store was installed or tested, and no performance was measured or compared. The only benchmarks seen were the projects' own, and they are left out.
• Statements a project makes about another project are left out: SeaweedFS's and RustFS's comparisons with MinIO, and the other columns of Garage's compatibility table, whose update history ends in 2022 [10].
• MinIO's community documentation now redirects to the AIStor documentation, so this report lists no feature of the archived edition from MinIO's own pages [28].
• MinIO's advisories and its releases page disagree on the final open-source release [30, 33], so none is named.
• Swift's matrix is labelled 2.39.0.dev112 documentation [29].
• RustFS's README and its interoperability document disagree on what the default build reads from MinIO's disks [14, 25].
• OpenStack Swift's data protection model, the security advisory histories of projects other than MinIO, and commercial support for Garage, Ozone and Swift were not reviewed.
• Ceph's end-of-life dates are the project's estimates [37].
• No source reviewed states what an S3-level copy carries over.
• License findings restate the texts. They are research, not legal advice.
• No adoption or popularity measure was used.

Sources

1. update license change for MinIO (commit 0694325). MinIO, Inc., GitHub, 23 April 2021, viewed 8 November 2026. https://github.com/minio/minio/commit/069432566fcfac1f1053677cc925ddafd750730a
2. MinIO Quickstart Guide (README.md), minio/minio repository. MinIO, Inc., GitHub, last changed 12 February 2026, viewed 8 November 2026. https://github.com/minio/minio/blob/master/README.md
3. update README.md and other docs to point to source only releases (commit 9e49d5e). MinIO, Inc., GitHub, 15 October 2025, viewed 8 November 2026. https://github.com/minio/minio/commit/9e49d5e7a6
4. update README.md maintenance mode (commit 27742d4). MinIO, Inc., GitHub, 3 December 2025, viewed 8 November 2026. https://github.com/minio/minio/commit/27742d4694
5. minio/minio repository. MinIO, Inc., GitHub, archived 25 April 2026, viewed 8 November 2026. https://github.com/minio/minio
6. AIStor Subscriptions and Pricing (Pricing and FAQ). MinIO, Inc., viewed 8 November 2026. https://www.min.io/pricing
7. Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads (GHSA-hv4r-mvr4-25vw, CVE-2026-41145). MinIO, Inc., GitHub Security Advisories, 14 April 2026, viewed 8 November 2026. https://github.com/minio/minio/security/advisories/GHSA-hv4r-mvr4-25vw
8. Amazon S3 actions. Amazon Simple Storage Service API Reference, Amazon Web Services, viewed 8 November 2026. https://docs.aws.amazon.com/AmazonS3/latest/API/API_Operations_Amazon_Simple_Storage_Service.html
9. Ceph Object Gateway S3 API. Ceph Documentation (Umbrella), Ceph Foundation, viewed 8 November 2026. https://docs.ceph.com/en/umbrella/radosgw/s3/
10. S3 Compatibility status. Garage documentation, Deuxfleurs, viewed 8 November 2026. https://garagehq.deuxfleurs.fr/documentation/reference-manual/s3-compatibility/
11. Bucket operations, Ceph Object Gateway S3 API. Ceph Documentation (Umbrella), Ceph Foundation, viewed 8 November 2026. https://docs.ceph.com/en/umbrella/radosgw/s3/bucketops/
12. Encryption. Ceph Documentation (Umbrella), Ceph Foundation, viewed 8 November 2026. https://docs.ceph.com/en/umbrella/radosgw/encryption/
13. SeaweedFS (README), seaweedfs/seaweedfs repository. SeaweedFS project, GitHub, viewed 8 November 2026. https://github.com/seaweedfs/seaweedfs
14. RustFS (README), rustfs/rustfs repository. RustFS project, GitHub, viewed 8 November 2026. https://github.com/rustfs/rustfs
15. S3 API. Apache Ozone documentation, version 2.2.2, The Apache Software Foundation, viewed 8 November 2026. https://ozone.apache.org/docs/user-guide/client-interfaces/s3/s3-api
16. Goals and use cases. Garage documentation, Deuxfleurs, viewed 8 November 2026. https://garagehq.deuxfleurs.fr/documentation/design/goals/
17. Ceph Object Gateway. Ceph Documentation (Umbrella), Ceph Foundation, viewed 8 November 2026. https://docs.ceph.com/en/umbrella/radosgw/
18. Pool Placement and Storage Classes. Ceph Documentation (Umbrella), Ceph Foundation, viewed 8 November 2026. https://docs.ceph.com/en/umbrella/radosgw/placement/
19. COPYING, ceph/ceph repository. Ceph project, GitHub, viewed 8 November 2026. https://github.com/ceph/ceph/blob/main/COPYING
20. apache/ozone repository. The Apache Software Foundation, GitHub, viewed 8 November 2026. https://github.com/apache/ozone
21. LICENSE, openstack/swift repository (a mirror of code maintained at opendev.org). OpenStack, GitHub, viewed 8 November 2026. https://github.com/openstack/swift/blob/master/LICENSE
22. deuxfleurs-org/garage (GitHub mirror of the Garage repository). Deuxfleurs, GitHub, viewed 8 November 2026. https://github.com/deuxfleurs-org/garage
23. GNU Affero General Public License, version 3. Free Software Foundation, 19 November 2007, viewed 8 November 2026. https://www.gnu.org/licenses/agpl-3.0.html
24. Amazon S3 Storage Providers. rclone documentation, rclone, viewed 8 November 2026. https://rclone.org/s3/
25. MinIO On-Disk Format Interoperability. RustFS project, GitHub, viewed 8 November 2026. https://github.com/rustfs/rustfs/blob/main/docs/architecture/minio-file-format-compat.md
26. Retaining multiple versions of objects with S3 Versioning. Amazon S3 User Guide, Amazon Web Services, viewed 8 November 2026. https://docs.aws.amazon.com/AmazonS3/latest/userguide/Versioning.html
27. Locking objects with Object Lock. Amazon S3 User Guide, Amazon Web Services, viewed 8 November 2026. https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html
28. Erasure Coding. MinIO AIStor Documentation, MinIO, Inc., viewed 8 November 2026. https://docs.min.io/aistor/operations/core-concepts/erasure-coding/
29. S3/Swift REST API Comparison Matrix. Swift 2.39.0.dev112 documentation, OpenStack, viewed 8 November 2026. https://docs.openstack.org/swift/latest/s3_compat.html
30. Releases, minio/minio. MinIO, Inc., GitHub, viewed 8 November 2026. https://github.com/minio/minio/releases
31. Introducing New Subscription Tiers for MinIO AIStor: Free, Enterprise Lite, and Enterprise. MinIO blog, MinIO, Inc., 23 December 2025, viewed 8 November 2026. https://blog.min.io/introducing-new-subscription-tiers-for-minio-aistor-free-enterprise-lite-and-enterprise/
32. minio/mc repository. MinIO, Inc., GitHub, archived 14 July 2026, viewed 8 November 2026. https://github.com/minio/mc
33. Path Traversal via msgpack Body in ReadMultiple Storage-REST Endpoint (GHSA-xh8f-g2qw-gcm7, CVE-2026-42600). MinIO, Inc., GitHub Security Advisories, 25 April 2026, viewed 8 November 2026. https://github.com/minio/minio/security/advisories/GHSA-xh8f-g2qw-gcm7
34. Privilege Escalation via Session Policy Bypass in Service Accounts and STS (GHSA-jjjj-jwhf-8rgr, CVE-2025-62506). MinIO, Inc., GitHub Security Advisories, 16 October 2025, viewed 8 November 2026. https://github.com/minio/minio/security/advisories/GHSA-jjjj-jwhf-8rgr
35. Commits, minio/minio master. MinIO, Inc., GitHub, viewed 8 November 2026. https://github.com/minio/minio/commits/master
36. update README.md format and clarify state of the project (commit 7aac2a2). MinIO, Inc., GitHub, 12 February 2026, viewed 8 November 2026. https://github.com/minio/minio/commit/7aac2a2c5b
37. Ceph Releases (index). Ceph Documentation, Ceph Foundation, viewed 8 November 2026. https://docs.ceph.com/en/latest/releases/
38. Umbrella (v21.2.0 release notes). Ceph Documentation, Ceph Foundation, 28 October 2026, viewed 8 November 2026. https://docs.ceph.com/en/latest/releases/umbrella/
39. Multi-Site. Ceph Documentation (Umbrella), Ceph Foundation, viewed 8 November 2026. https://docs.ceph.com/en/umbrella/radosgw/multisite/
40. Hardware Recommendations. Ceph Documentation (Umbrella), Ceph Foundation, viewed 8 November 2026. https://docs.ceph.com/en/umbrella/start/hardware-recommendations/
41. Bucket Notifications. Ceph Documentation (Umbrella), Ceph Foundation, viewed 8 November 2026. https://docs.ceph.com/en/umbrella/radosgw/notifications/
42. Foundation. Ceph, viewed 8 November 2026. https://ceph.io/en/foundation/
43. Rook. Cloud Native Computing Foundation, viewed 8 November 2026. https://www.cncf.io/projects/rook/
44. Object Storage Overview. Rook Ceph Documentation, Rook, viewed 8 November 2026. https://rook.io/docs/rook/latest/Storage-Configuration/Object-Storage-RGW/object-storage/
45. Releases, seaweedfs/seaweedfs. SeaweedFS project, GitHub, viewed 8 November 2026. https://github.com/seaweedfs/seaweedfs/releases
46. S3 Compatibility Matrix. RustFS project, GitHub, viewed 8 November 2026. https://github.com/rustfs/rustfs/blob/main/docs/architecture/s3-compatibility-matrix.md
47. Releases, rustfs/rustfs. RustFS project, GitHub, viewed 8 November 2026. https://github.com/rustfs/rustfs/releases
48. List of Garage features. Garage documentation, Deuxfleurs, viewed 8 November 2026. https://garagehq.deuxfleurs.fr/documentation/reference-manual/features/
49. Releases, Deuxfleurs/garage. Forge Deuxfleurs, Deuxfleurs, viewed 8 November 2026. https://git.deuxfleurs.fr/Deuxfleurs/garage/releases
50. Downloads. Apache Ozone, The Apache Software Foundation, viewed 8 November 2026. https://ozone.apache.org/download
51. Apache Ozone (home page). The Apache Software Foundation, viewed 8 November 2026. https://ozone.apache.org/
52. Apache License, Version 2.0. The Apache Software Foundation, January 2004, viewed 8 November 2026. https://www.apache.org/licenses/LICENSE-2.0
53. Release 4.53, seaweedfs/seaweedfs. SeaweedFS project, GitHub, 8 November 2026, viewed 9 November 2026. https://github.com/seaweedfs/seaweedfs/releases/tag/4.53