Silo

2026-11-04 504 words 2 minutes

Contents

Silo

Silo 是 Pigsty 社区维护的 MinIO 分支，旨在为现有 MinIO 部署提供持续的发行与安全维护路径，同时保留 S3 API、MINIO_* 环境变量、磁盘格式等兼容契约。

安装和部署

services:
  silo:
    image: docker.io/pgsty/silo:RELEASE.2026-10-26T00-00-00Z
    container_name: silo
    restart: unless-stopped
    command: server /data --console-address ":9001"
    # ports:
    # - "9000:9000"   # S3 API
    # - "9001:9001"   # Web 控制台
    environment:
      MINIO_ROOT_USER: admin
      MINIO_ROOT_PASSWORD: kooy3rbcrCNbh4uv9VqWFt  # 务必修改为强密码
      MINIO_BROWSER_REDIRECT_URL: https://s3console.local.com
      MINIO_SERVER_URL: https://s3.local.com
    volumes:
      - ./data:/data
    labels:
    - "traefik.enable=true"

    # ===== S3 API 路由 (端口 9000) =====
    # HTTP → HTTPS 重定向
    - "traefik.http.routers.silo-api-http.rule=Host(`s3.local.com`)"
    - "traefik.http.routers.silo-api-http.entrypoints=web"
    - "traefik.http.routers.silo-api-http.middlewares=silo-api-redirect"

    # 重定向中间件
    - "traefik.http.middlewares.silo-api-redirect.redirectscheme.scheme=https"
    - "traefik.http.middlewares.silo-api-redirect.redirectscheme.permanent=true"

    # HTTPS 路由
    - "traefik.http.routers.silo-api.rule=Host(`s3.local.com`)"
    - "traefik.http.routers.silo-api.entrypoints=websecure"
    - "traefik.http.routers.silo-api.tls=true"
    - "traefik.http.routers.silo-api.service=silo-api"
    - "traefik.http.services.silo-api.loadbalancer.server.port=9000"

    # ===== Web 控制台路由 (端口 9001) =====
    # HTTP → HTTPS 重定向
    - "traefik.http.routers.silo-console-http.rule=Host(`s3console.local.com`)"
    - "traefik.http.routers.silo-console-http.entrypoints=web"
    - "traefik.http.routers.silo-console-http.middlewares=silo-console-redirect"

    # 重定向中间件
    - "traefik.http.middlewares.silo-console-redirect.redirectscheme.scheme=https"
    - "traefik.http.middlewares.silo-console-redirect.redirectscheme.permanent=true"

    # HTTPS 路由
    - "traefik.http.routers.silo-console.rule=Host(`s3console.local.com`)"
    - "traefik.http.routers.silo-console.entrypoints=websecure"
    - "traefik.http.routers.silo-console.tls=true"
    - "traefik.http.routers.silo-console.service=silo-console"
    - "traefik.http.services.silo-console.loadbalancer.server.port=9001"

设置bucket 设置公共读

podman exec -it silo /bin/sh
# 容器内配置别名（若尚未配置）
mcli alias set local http://127.0.0.1:9000 <Root用户名> <Root密码>
# 设置公共读（仅下载）
mcli anonymous set download local/your-bucket-name

可选策略值：download（仅读）、upload（仅写）、public（读写）、none（禁用匿名）

开发示例

python

from minio import Minio

client = Minio(
    "s3.example.com",
    access_key="your-access-key",
    secret_key="your-secret-key",
    secure=True,  # 使用 TLS
)

# 上传
client.put_object("my-bucket", "hello.txt", data, length=len(data))

# 列出对象
for obj in client.list_objects("my-bucket", recursive=True):
    print(obj.object_name, obj.size)

go

go.mod

require github.com/minio/minio-go/v7 v7.3.1

replace github.com/minio/minio-go/v7 => github.com/pgsty/silo-go/v7 v7.3.1

# 或者
go mod edit -require=github.com/minio/minio-go/v7@v7.3.1
go mod edit -replace=github.com/minio/minio-go/v7=github.com/pgsty/silo-go/v7@v7.3.1
go mod tidy

package main

import (
	"context"
	"log"
	"os"

	"github.com/minio/minio-go/v7"
	"github.com/minio/minio-go/v7/pkg/credentials"
)

func main() {
	client, err := minio.New("127.0.0.1:9000", &minio.Options{
		Creds: credentials.NewStaticV4(
			os.Getenv("S3_ACCESS_KEY"),
			os.Getenv("S3_SECRET_KEY"),
			"",
		),
		Secure: false,
	})
	if err != nil {
		log.Fatal(err)
	}

	ctx := context.Background()
	if err := client.MakeBucket(ctx, "demo", minio.MakeBucketOptions{}); err != nil {
		exists, checkErr := client.BucketExists(ctx, "demo")
		if checkErr != nil || !exists {
			log.Fatal(err)
		}
	}

	_, err = client.FPutObject(ctx, "demo", "README.md", "README.md", minio.PutObjectOptions{
		ContentType: "text/markdown",
	})
	if err != nil {
		log.Fatal(err)
	}
}