Self-hosted S3 object storage in 2027: what to run after MinIO

Self-hosted S3 object storage means running software that speaks Amazon's S3 API on your own server, so your websites and apps can store images, uploads and backups in buckets using the same SDKs and plugins they already use with AWS. In 2027 the open-source options worth considering are Garage (lightweight, easy to run), SeaweedFS (feature-rich) and Ceph RGW (for large clusters). MinIO, the best-known name, no longer maintains its community edition.

This guide covers when self-hosting S3 makes sense and when it doesn't, compares the options on concrete criteria, walks through the things you must get right in a manual setup, and shows how ZoPanel gives each hosting customer their own S3 buckets in a few clicks.

What is S3-compatible object storage, and why self-host it?

Object storage has no folders in the usual sense: each file is an "object" in a "bucket", read and written over HTTP. Amazon's S3 API has become the common standard, so thousands of tools speak it: WP Offload Media, Laravel's S3 driver, the AWS SDKs, rclone, restic.

Self-hosting has some clear benefits:

• No per-GB egress fees, which many cloud providers charge for downloads. You pay for the server and its disk.
• Your data stays on a server you control, in the data center and country you choose.
• Low latency when the websites and the bucket sit side by side.
• A bucket and key per customer if you sell hosting: a useful extra service that doesn't depend on a third party.

When shouldn't you self-host S3?

This is the part most guides skip.

Not as the only backup of that same server. A bucket on the same VPS as your websites goes down with it: hardware failure, accidental deletion or ransomware takes the backups too. The 3-2-1 rule (three copies, two kinds of media, one off-site) still applies, and the off-site copy has to live with another server or provider.

One disk is no redundancy. Services like Amazon S3 replicate data across devices and facilities. A single VPS is only as durable as its disk and your provider's snapshots. Real redundancy needs a multi-node cluster.

You need object lock against ransomware. An immutable backup (one that nobody can delete for N days, even with the keys) requires object lock. Not every self-hosted option has it (see the table below).

Very large, fast-growing data. From a few tens of terabytes up, running a storage cluster (replacing disks, rebalancing, monitoring) often costs more than it saves.

Which self-hosted S3 software should you choose?

What happened to MinIO?

MinIO used to be the default answer. According to its official GitHub repository, the community repository was archived on April 25, 2026; the README says it is no longer maintained, the community edition is distributed as source code only, and legacy binaries will not receive updates. MinIO points users to its commercial AIStor product, including an AIStor Free edition under its own licence. Existing MinIO servers keep running, but they will get no more security fixes. For a new deployment, choose something else or read the AIStor licence carefully.

Comparing the options (at the time of writing, October 2026)

Criterion	Garage	SeaweedFS	Ceph RGW
Licence	AGPL v3	Apache 2.0	Open source
Operational complexity	Low	Medium	High
Best for	One server to a few nodes, multiple sites	One server to large clusters, many small files	Large clusters with a dedicated ops team
Versioning	Not yet	Yes	Yes
Object lock	Not yet	Yes	Yes
Presigned URLs, multipart, CORS	Yes	Yes	Yes
Lifecycle (expiry)	Partial (expiration, abort incomplete uploads)	Yes	Yes

Sources: Garage's S3 compatibility table and the SeaweedFS README. These projects move quickly, so check the version you plan to deploy.

Garage, built by the Deuxfleurs collective, targets modest hardware (the project lists about 1 GB of RAM) and clusters spread across several locations with imperfect networks. Instead of AWS-style bucket policies, it grants permissions per key and bucket, which is simple and hard to misconfigure. The downside: no versioning or object lock yet. The AGPL v3 licence means that if you modify Garage and offer it as a network service, you must publish your changes; running it unmodified carries no such obligation.

SeaweedFS has far more features (versioning, object lock, IAM) under the permissive Apache 2.0 licence, and is designed for very large numbers of small files. The trade-off is more moving parts (master, volume servers, filer, S3 gateway) and a steeper learning curve.

Ceph RGW is what large storage providers run. On a single VPS it's far too heavy; consider it only if you have a multi-server cluster and someone who knows Ceph.

For the common case of "one VPS, buckets for websites and apps", Garage is a sensible starting point. If you need object lock, pick SeaweedFS, or keep immutable backups with a commercial S3 provider.

Manual setup: what you must get right

We won't reproduce a full install guide, since commands change between versions; follow Garage's official quick start. Whatever you pick, these points decide whether your buckets are safe.

1. Keep the API on 127.0.0.1

Publish the container port as -p 127.0.0.1:3900:3900 (3900 is Garage's default S3 port). Docker bypasses UFW for published ports, so -p 3900:3900 exposes the API to the internet without SSL. Our guide to running Docker apps securely on a VPS explains why.

2. Expose it through nginx with SSL

server {
    listen 443 ssl;
    server_name s3.example.com;
    # ssl_certificate ... (Let's Encrypt)

    client_max_body_size 0;          # no upload size limit
    proxy_request_buffering off;     # stream uploads instead of buffering to disk

    location / {
        proxy_pass http://127.0.0.1:3900;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

client_max_body_size 0 matters because nginx accepts only 1 MB per request by default. Keep the Host header intact: S3 signatures (SigV4) include the host, and a rewritten header makes every request fail with a signature error.

3. Use path-style addressing

On a self-hosted server, URLs like https://s3.example.com/my-bucket/file (path-style) are much simpler than https://my-bucket.s3.example.com/file (virtual-hosted), which needs wildcard DNS and a wildcard certificate. Turn on path-style in the client. With the AWS CLI:

aws configure set default.s3.addressing_style path
aws --endpoint-url https://s3.example.com s3 ls s3://my-bucket

4. One key per app, scoped to one bucket

Don't hand every app an admin key. A WordPress plugin's key should only read and write that site's media bucket, so a compromised site can't reach anyone else's data.

5. Back up the storage itself

Buckets are data like any other. Copy them somewhere else (an rclone sync to another provider is common) and test a restore.

Self-hosted S3 object storage with ZoPanel

ZoPanel includes an S3 storage component that runs the Garage engine in a container (Docker required). As described in the App Store and S3 storage documentation:

The administrator sets it up once:

1. Open S3 storage and click Install (or install S3 object storage in Components). Data is stored in /var/lib/zopanel-storage.
2. The S3 API listens on 127.0.0.1 only. To use it from outside, point a domain's A record at the server and use Publish on a domain; ZoPanel creates a reverse-proxy website with automatic SSL.
3. Apps connect to https://<that domain> with region us-east-1 and path-style addressing turned on.

Every hosting account creates its own buckets in S3 storage → New bucket:

• Each bucket has its own access key that works only for that bucket. The secret is shown once; if it's lost, Rotate key and the old key stops working at once.
• Each bucket is limited to the package's disk size, and an account can have up to 10 buckets.
• Bucket settings hold CORS origins and Delete objects after (days), handy for logs or rotating backups. Unfinished uploads are always cleaned after 7 days.
• Browse files uploads, downloads and deletes files and creates expiring Share links.
• Tick Public to serve website images directly at https://<storage domain>/<bucket>/<file>.

Bucket keys work with WP Offload Media, Laravel's S3 driver or any AWS SDK. The Free plan includes the S3 storage component with one bucket; Pro removes the bucket limit. Uninstall removes only the container; data is kept unless you also tick the option to delete it.

What about off-site backups? That's a different feature: Settings → Remote backups (Pro) encrypts backups on the server before uploading them to external S3-compatible storage such as AWS, Cloudflare R2, Backblaze B2, Wasabi or MinIO, with a path-style option. See the backups documentation. A sensible split is S3 buckets on the server for serving websites, and backups sent to another provider or server. Our guide to backing up a VPS to S3 covers that side.

Conclusion

Self-hosted S3 object storage is worth it when you need buckets for media, uploads and apps, want the data close and don't want egress bills. With MinIO's community edition gone, Garage is the lightweight choice for a single server and SeaweedFS the choice when you need versioning and object lock. Whichever you run, keep the API on 127.0.0.1, expose it over SSL, give every app its own key, and never treat a bucket on the same server as a backup.

Want to offer S3 buckets to hosting customers without building the proxy, keys and limits yourself? Install ZoPanel with curl -fsSL https://get.zopanel.net | sudo bash; the Free plan gives you one bucket to try it and Pro removes the limit, see pricing.

Frequently asked questions

Can I still use MinIO?

Existing installations still run, but the community repository was archived on April 25, 2026 and is no longer maintained, so no new security fixes will arrive. For new systems, choose Garage or SeaweedFS, or review the licence terms of AIStor.

Is self-hosted S3 on one VPS safe for my data?

Safe in terms of access if you configure it properly: SSL, a key per bucket, and an API that isn't exposed directly. In terms of durability, the data is only as safe as the VPS disk, so you still need copies elsewhere.

Can Garage replace Amazon S3?

For most everyday needs (uploads, downloads, multipart, presigned URLs, CORS), yes. Garage doesn't support versioning, object lock or AWS-style bucket policies yet, so features that rely on them won't work.

Why does my S3 client report SignatureDoesNotMatch?

Usually because the reverse proxy changes the Host header, the client uses virtual-hosted instead of path-style URLs, or the region is wrong. Keep Host intact, turn on path-style and use the region your server expects (us-east-1 on ZoPanel).

Should I store backups in self-hosted S3?

Yes, if the storage runs on a different server from the data being backed up. A bucket on the same VPS only protects you from accidental deletion, not from losing the server.