minio

S3-compatible object store. Single-binary install; first-run init mints a random 32-character hex root password and stores it both on-disk (.unibench-data/<service>/.credentials) and in macOS Keychain under unibench-secret-minio_<service>_root_password (decision 2.36 phase 5).

Manifest knobs

[services.objects]
type = "minio"
version = "RELEASE.2025-09-07T16-13-09Z"   # date-stamped releases
port = "auto"
isolation = "per-project"

Healthcheck: GET /minio/health/live returning 200.

On-disk layout

<project>/.unibench-data/<service>/
├── .credentials               # line 1: user, line 2: password (chmod 600)
└── storage/
    └── <bucket>/...

The on-disk credentials file is the start-time source of truth in v1; the Keychain mirror is the long-term store v2 cuts over to.

unibench start --fresh wipes the storage dir but regenerates the credentials; the Keychain entry from a prior run remains visible under the old service-name-suffixed account.

Inspection drawer

  • Connection URL — http://127.0.0.1:<port> (S3 endpoint, no auth preamble).
  • Access key + secret key — read from .credentials, surfaced so the user can paste them into an SDK config without leaving the GUI.
  • Buckets — every bucket directory under storage/ with its object count (capped at 10k per bucket for the walk; truncated buckets get a flag).
  • External tools — jump to mc (the MinIO client) preconfigured to the running port.

Common gotchas

  • Default user is minio_root. Not minioadmin — we don't ship the well-known default so an accidentally-exposed instance can't be pwned by every internet scanner.
  • Browser console is off by default. MINIO_BROWSER=off is set on the spawned process to keep the install loopback-only and avoid needing a second allocated port. To enable, override via a post_start hook that restarts MinIO with MINIO_BROWSER=on.
  • Region. Default region is us-east-1. Bucket policies that hard-code another region will reject requests from clients that default to us-east-1.

Escape hatch

For an AWS S3 / R2 / Backblaze production target, use remote with the bucket's endpoint URL — same $<NAME>_* env shape, no local storage.