WIUNIX ACADEMY

MinIO after archival: a private S3 lab from pinned source

Page 4 of 4. Review the earlier steps and prerequisites before continuing.

YOUR SYSTEM. YOUR STEPS.

Where are you working?

Choose your OS and version. The prerequisites, commands and troubleshooting follow your environment.

Ubuntu26.10Reviewed against official documentation · 2026-10-21

USE YOUR OWN VALUES

Configure this tutorial

Set the example values for your environment; related explanations and copy panels update together. Never enter passwords, private keys or tokens. Values stay in this tab and are not sent to the server or share links. Check actual DNS, certificates and network policy before running commands.

Different IP addresses, domains or ports? Open the settings below, change the values and select “Apply to tutorial”, then copy the updated commands.

Set values for my environment6 editable values

Diagnose certificate, clock and storage failures

The default trust check must reject this self-signed certificate, while explicit lab trust succeeds. A refused connection suggests the wrong namespace/port or a stopped process. AccessDenied is expected for outside-bucket/deletion tests; elsewhere inspect the exact action/resource policy. SignatureDoesNotMatch suggests endpoint/Host/path/query, clock or credential mismatch. A space error needs capacity investigation before retries.

Inside the disposable container · terminal

set -eu
python3 - <<'PY'
import ssl,urllib.request,urllib.error
url='https://127.0.0.1:19000/minio/health/ready'
try: urllib.request.urlopen(url,timeout=3)
except urllib.error.URLError: print('Expected: untrusted certificate rejected')
else: raise AssertionError('Unexpected system trust')
ctx=ssl.create_default_context(cafile='/srv/academy-minio/certs/public.crt')
with urllib.request.urlopen(url,context=ctx,timeout=3) as q: assert q.status==200
print('Explicit trust: ready200')
PY
df -h '/srv/academy-minio/data'
date -u

LET’S BUILD

Stop only the verified lab process and container

Confirm executable and data-root identity before signaling the recorded PID. Preserve the stopped container/data if investigation is needed. Do not delete a MinIO data directory, copy internal erasure files or restart an old binary against upgraded metadata as a recovery shortcut. If startup failed, inspect its private log locally without uploading it; choose a fresh empty lab for a retry after fixing the cause.

Inside the disposable container · terminal

set -eu
python3 - <<'PY'
import os,signal
from pathlib import Path
r=Path('/srv/academy-minio');pid=int((r/'run/server.pid').read_text(encoding='utf-8'))
assert os.readlink('/proc/'+str(pid)+'/exe')==str(r/'bin/minio'), 'PID identity mismatch'
cmd=(Path('/proc')/str(pid)/'cmdline').read_bytes().split(b'\0')
assert str(r/'data').encode() in cmd, 'Wrong data root'
os.kill(pid,signal.SIGTERM)
print('SIGTERM sent only to verified lab child; data and private files retained')
PY
exit

How do I know it worked?

Verified child receives SIGTERM; only academy-minio-lab is stopped; no host service or real bucket changed.

LET’S BUILD

Stop the named container from the VM host

The preceding exit returned to the disposable VM host. Run this separate panel there. The stopped container retains its synthetic data and private files; no other container is stopped. Do not copy the container or its credentials into publication sources.

Disposable VM host · terminal

set -eu
podman stop --time 10 'academy-minio-lab'
podman inspect 'academy-minio-lab' --format '{{.State.Status}}'

How do I know it worked?

Only academy-minio-lab reports exited.

Choose a maintained operational path before real data

For new production use, review the vendor’s current AIStor Free standalone licensing/limits or AIStor Enterprise support terms, or evaluate an independently maintained alternative under its own identity. Those are different products/support paths, not a supported Community binary obtained by rebuilding this archive. This guide does not acquire a license or claim vendor SLA. For an existing MinIO estate, inventory exact builds and S3 features, establish a migration/rollback plan and test real application/object/metadata recovery in isolation before changing data paths.

What this lab establishes

Evidence covers an Ubuntu24.04 private Podman fixture, pinned source/toolchain downloads and compilation, private files, separate loopback TLS listeners, bucket-scoped authorization, two synthetic versions, denied outside listing/deletion and a byte-checked current-object export/reimport. Other OS paths are documentation reviews. No production services/accounts/credentials/network/firewall were touched. No public TLS renewal, all-OS installation, console login, HA/erasure/healing, Object Lock, KMS, full version/IAM restore or off-host disaster recovery acceptance is claimed.

GO TO THE SOURCE

Official references

Each environment states how it was reviewed. A documentation review does not claim a hands-on test of every version.

KEEP LEARNING

Your next step

Explore all tutorials ↗