vaults3

2026-09-12 1159 words 3 minutes

Contents

VaultS3

轻量级S3存储

一、介绍

VaultS3 是一个轻量级、兼容 Amazon S3 API 的开源对象存储服务，使用 Go 开发，可以以单二进制或 Docker 容器方式运行，并内置 Web Dashboard。

项目定位比较明确：在资源占用较低、部署简单的前提下，为自建环境提供常见的 S3 对象存储能力。官方文档给出的轻量单节点空闲内存占用约为 17 MiB。

VaultS3 支持 AWS CLI、MinIO Client、boto3、s3fs 等常见 S3 客户端。当前项目提供 80+ S3 API 操作，并支持 Multipart Upload、Presigned URL、对象版本、IAM、生命周期、S3 Event、对象锁等功能。

项目地址：https://github.com/Kodiqa-Solutions/VaultS3

主要特点：

S3 Compatible API
AWS Signature V4
单二进制部署
Docker / Kubernetes 部署
内置 Web Dashboard
中文 Web UI
IAM 用户、用户组和 Policy
Access Key / Secret Key
Multipart Upload
Presigned URL
Bucket Policy
Bucket / Object ACL
Bucket CORS
对象版本管理
Object Lock / WORM
Lifecycle 生命周期管理
Bucket Quota
SSE-S3 加密
SSE-KMS
SSE-C
AES-256-GCM 静态数据加密
Erasure Coding
Replication
Prometheus Metrics
Webhook / Kafka / NATS / Redis / RabbitMQ 等事件通知
Health / Readiness 检查
S3 数据迁移
内置 CLI

VaultS3 的对象内容实际存储为普通文件，元数据主要保存在 BoltDB 中，因此整体架构相对简单。

基本架构可以理解为：

               ┌─────────────────────┐
               │     S3 Client       │
               │ AWS CLI / mc / SDK  │
               └─────────┬───────────┘
                         │
                         │ S3 API
                         ▼
               ┌─────────────────────┐
               │       VaultS3       │
               │                     │
               │ S3 API              │
               │ IAM                 │
               │ Dashboard           │
               │ Encryption          │
               │ Versioning          │
               │ Lifecycle           │
               └───────┬─────┬───────┘
                       │     │
                 Object│     │Metadata
                       ▼     ▼
                  /data     /metadata
                             BoltDB

当项目需要一个简单的 S3 Compatible Server，而又不希望运行较重的对象存储集群时，可以使用 VaultS3。

二、安装部署

docker 命令

docker run -d  --name vaults3  --restart unless-stopped  -p 9000:9000  -e VAULTS3_ACCESS_KEY=admin  -e VAULTS3_SECRET_KEY='ChangeMe-StrongPassword'  -v vaults3-data:/data  -v vaults3-meta:/metadata  eniz1806/vaults3:v4.4.75

启动以后：

S3 Endpoint:
http://服务器IP:9000

Dashboard:
http://服务器IP:9000/dashboard/

默认情况下 S3 API 和 Dashboard 共用 9000 端口。

docker-compose

services:
  vaults3:
    image: eniz1806/vaults3:v4.4.75
    container_name: vaults3
    restart: unless-stopped
    ports:
      - "9000:9000"

    environment:
      VAULTS3_ACCESS_KEY: "admin"
      VAULTS3_SECRET_KEY: "ChangeMe-StrongPassword"
      # 创建默认的bucket
      VAULTS3_DEFAULT_BUCKETS: "images,backups,attachments"

    volumes:
      - ./data:/data
      - ./metadata:/metadata

ArgoCD部署

# applicationset.yaml

apiVersion: v1
kind: Secret
metadata:
  name: vaults3-zot-helm-repository
  namespace: argocd
  labels:
    argocd.argoproj.io/secret-type: repository
stringData:
  name: vaults3-zot
  type: helm
  enableOCI: "true"
  url: zot.imau.cc/charts
---
apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: dev-vaults3
  namespace: argocd
  labels:
    product: dev
    env: dev
spec:
  generators:
    - list:
        elements:
          - chartName: vaults3
            chartVersion: "0.1.36"
  template:
    metadata:
      name: '{{chartName}}-dev'
      labels:
        product: dev
        env: dev
    spec:
      project: default
      sources:
        - repoURL: 'git@imau.cc:serialt/argo.git'
          targetRevision: main
          ref: values
        - repoURL: 'zot.imau.cc/charts'
          chart: '{{chartName}}'
          targetRevision: '{{chartVersion}}'
          helm:
            valueFiles:
              - '$values/vaults3/dev/values/vaults3.yaml'
      destination:
        name: in-cluster
        namespace: app
      syncPolicy:
        automated:
          prune: true
          selfHeal: true
        syncOptions:
          - ApplyOutOfSyncOnly=true
          - CreateNamespace=true
          - PrunePropagationPolicy=foreground

# value.yaml

controller:
  kind: StatefulSet

replicaCount: 1

image:
  repository: registry.cn-hangzhou.aliyuncs.com/serialt/vaults3
  tag: "4.4.75"
  pullPolicy: IfNotPresent

auth:
  existingSecret: vaults3-auth

service:
  type: ClusterIP
  port: 9000

ingress:
  enabled: true
  className: traefik
  annotations:
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
    traefik.ingress.kubernetes.io/router.tls: "true"
  hosts:
    - host: s3.imau.cc
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: imau-cc-wildcard-tls
      hosts:
        - s3.imau.cc

persistence:
  enabled: true
  data:
    size: 20Gi
    accessModes:
      - ReadWriteOnce
  metadata:
    size: 5Gi
    accessModes:
      - ReadWriteOnce

resources:
  requests:
    cpu: 100m
    memory: 128Mi
  limits:
    cpu: "1"
    memory: 512Mi

extraEnv:
  - name: VAULTS3_LOG_LEVEL
    value: info

serviceMonitor:
  enabled: false

cluster:
  enabled: false

测试验证

export AWS_ACCESS_KEY_ID='admin'
export AWS_SECRET_ACCESS_KEY='xxxx'
export AWS_REGION='us-east-1'


[serialt@Sugar jsonb]🐳 s5cmd --endpoint-url https://s3.imau.cc ls
2026/09/12 17:40:46  s3://dev
2026/09/12 17:34:36  s3://sugar

[serialt@Sugar jsonb]🐳 date >date.txt
[serialt@Sugar jsonb]🐳 s5cmd --endpoint-url https://s3.imau.cc cp date.txt s3://dev/
cp date.txt s3://dev/date.txt

分离dashboard端口

services:
  vaults3:
    image: eniz1806/vaults3:v4.4.75
    container_name: vaults3
    restart: unless-stopped

    ports:
      - "9000:9000" # S3 API
      - "9001:9001" # Dashboard

    environment:
      VAULTS3_ACCESS_KEY: "${VAULTS3_ACCESS_KEY}"
      VAULTS3_SECRET_KEY: "${VAULTS3_SECRET_KEY}"

    volumes:
      - ./data:/data
      - ./metadata:/metadata
      - ./vaults3.yaml:/etc/vaults3/vaults3.yaml:ro

# vaults3.yaml 
server:
  address: "0.0.0.0"

  # S3 API
  port: 9000

  # Web Dashboard
  console_port: 9001

storage:
  data_dir: "/data"
  metadata_dir: "/metadata"
  
# .env
VAULTS3_ACCESS_KEY=admin
VAULTS3_SECRET_KEY=ChangeMe-StrongPassword

访问：

S3 API:
http://服务器IP:9000

Dashboard:
http://服务器IP:9001/dashboard/