2025-08-22 16:02:05,

MinIO (网站 https://min.io/) 是开源的对象存储项目， 用Go实现， 支持Linux环境， 客户端支Java，Python，JavaC++ript， Go等语言. 在分布式项目中， 可以代替本地磁盘存储和NFS等旧的存储共享方式， 方便程序以s3接口形式访问文件. 在项目使用 MinIO 代替直接文件操作， 便于扩展， 便于在本地和云服务的对象存储接口之间切换.

安装

Docker 安装

参考 https://min.io/docs/minio/container/operations/install-deploy-manage/deploy-minio-single-node-single-drive.html

从 quay.io 或 docker hub 拉取镜像

# quay.io
docker pull quay.io/minio/minio
# DockerHub
docker pull docker://minio/minio

创建配置文件 /etc/docker/minio/config.env

• 这个文件将被映射到 minio 容器
• MINIO_VOLUMES 是 minio 容器启动后使用的存储位置， 与后面创建容器时的映射要一致

# MINIO_ROOT_USER and MINIO_ROOT_PASSWORD sets the root account for the MinIO server.
# This user has unrestricted permissions to perform S3 and administrative API operations on any reso
urce in the deployment.
# Omit to use the default values 'minioadmin:minioadmin'.
# MinIO recommends setting non-default values as a best practice， regardless of environment

MINIO_ROOT_USER=minioadmin
MINIO_ROOT_PASSWORD=minio123

# MINIO_VOLUMES sets the storage volume or path to use for the MinIO server.

MINIO_VOLUMES="/mnt/data"

# MINIO_OPTS sets any additional commandline options to pass to the MinIO server.
# For example， `--console-address :9001` sets the MinIO Console listen port 
MINIO_OPTS="--console-address :9001"

设置好硬盘挂载， 如果是测试环境， 可以创建一个目录， 例如当前使用 /var/minio， 然后启动容器

• 如果不是从 quay 拉取的镜像， 需要更换一下镜像路径
• 用-v /var/minio:/mnt/data映射minio的存储目录， 要与配置文件中的定义一致
• 用-e "MINIO_CONFIG_ENV_FILE=/etc/config.env"指定配置文件路径， 要与上面的映射一致

docker run -dt --name minio \
  -p 9000:9000 -p 9001:9001 \
  -v /var/minio:/mnt/data \
  -v /etc/docker/minio/config.env:/etc/config.env \
  -e "MINIO_CONFIG_ENV_FILE=/etc/config.env" \
  quay.io/minio/minio \
  server --console-address ":9001"

启动后就可以用浏览器访问 9000 端口查看 MinIO 控制台

配置

MinIO的名词定义

• Policy
  • Policy 是权限管理的基础设置， JSON格式
• User
  • 用户用于登录控制台(Console)
  • 用户的权限通过两种方式设置， 一种是直接设置 Policies， 例如 readwrite 就对所有bucket都有读写权限; 另一种是用户组， 可以继承所在用户组的 Policies
• Group
  • 组权限通过 Policies 设置
• Access Key
  • access_key 由用户自己创建
  • 每个用户可以有多个 access key， 每个 access_key 与 secret_key 组成一对， 用于接口访问时验证身份
• Bucket
  • Bucket 是一个文件桶， 类似于目录的概念. 可以设置容量限制， 是否保持文件版本， 是否锁定文件(防止被删除)
  • 通过 Anonymous Access Rule 控制匿名访问的权限， 设置时需要设置一个路径前缀(不能使用通配符*).
  • 如果可匿名读取， 那么访问文件的路径就是 http://[host]:9000/[bucket]/[file path]

Policy设置

设置含义

• Version 指定要使用的策略语言版本. 建议使用最新的 2012-10-17 版本
• Statement 将该主要策略元素作为以下元素的容器， 可以在一个策略中包含多个语句
• Sid (optional) 包括可选的语句 ID 以区分不同的语句
• Effect Allow 或 Deny 标识策略是允许还是拒绝访问
• Principal 仅在某些情况下需要， 如果创建基于资源的策略， 必须指示要允许或拒绝访问的账户， 用户， 角色或联合身份用户. 如果要创建 IAM 权限策略以附加到用户或角色， 则不能包含该元素， 此时潜在的主体为该用户或角色.
• Action 包括策略允许或拒绝的操作列表
• Resource 如果创建 IAM 权限策略， 必须指定操作适用的资源列表. 如果创建基于资源的策略， 则该元素是可选的. 如果不包含该元素， 则该操作适用的资源是策略附加到的资源.
• Condition (optional) 指定策略在哪些情况下授予权限

通过指定Principal(谁)针对Resource(资源对象)在什么Condition(条件)下Effect(允许还是拒绝)做什么Action(事情)， 定义一条policy(策略)

全局只读

{
    "Version": "2012-10-17"，
    "Statement": [
        {
            "Effect": "Allow"，
            "Action": [
                "s3:GetObject"，
                "s3:GetBucketLocation"
            ]，
            "Resource": [
                "arn:aws:s3:::*"
            ]
        }
    ]
}

全局只写

{
    "Version": "2012-10-17"，
    "Statement": [
        {
            "Effect": "Allow"，
            "Action": [
                "s3:PutObject"
            ]，
            "Resource": [
                "arn:aws:s3:::*"
            ]
        }
    ]
}

全局读写

{
    "Version": "2012-10-17"，
    "Statement": [
        {
            "Effect": "Allow"，
            "Action": [
                "s3:*"
            ]，
            "Resource": [
                "arn:aws:s3:::*"
            ]
        }
    ]
}

桶操作

针对bucket2025这个桶做的 policy， 将这个policy关联到一个minio用户后， 这个用户就可以对 bucket2025 做全部操作

{
    "Version": "2012-10-17"，
    "Statement": [
        {
            "Effect": "Allow"，
            "Action": [
                "s3:*"
            ]，
            "Resource": [
                "arn:aws:s3:::bucket2025"，
                "arn:aws:s3:::bucket2025/*"
            ]
        }
    ]
}

如果要限制用户对桶的操作， 仅允许读写内部文件， 可以约束为下面的action列表

            "Action": [
                "s3:DeleteObject"，
                "s3:GetBucketLocation"，
                "s3:GetObject"，
                "s3:ListAllMyBuckets"，
                "s3:ListBucket"，
                "s3:PutObject"
            ]，

Java 调用

增加MinIO SDK依赖

<dependency>
    <groupId>io.minio</groupId>
    <artifactId>minio</artifactId>
    <version>8.5.17</version>
</dependency>

创建 MinioClient 实例， 这个可以复用， 但是程序退出时需要close 否则会阻塞退出， 实际使用时最好放到 try 里面

MinioClient minioClient =
             MinioClient.builder()
                     .endpoint("http://192.168.1.2:9000")
                     .credentials("A1DbqKtKkeukiznEM123"， "B3IZXZXYD7RbVJuFP8KEAc5U2q0kHZ7yaQx11122")
                     .build();

上传文件

使用 uploadObject 方法

# MINIO_ROOT_USER and MINIO_ROOT_PASSWORD sets the root account for the MinIO server.
# This user has unrestricted permissions to perform S3 and administrative API operations on any reso
urce in the deployment.
# Omit to use the default values 'minioadmin:minioadmin'.
# MinIO recommends setting non-default values as a best practice， regardless of environment

MINIO_ROOT_USER=minioadmin
MINIO_ROOT_PASSWORD=minio123

# MINIO_VOLUMES sets the storage volume or path to use for the MinIO server.

MINIO_VOLUMES="/mnt/data"

# MINIO_OPTS sets any additional commandline options to pass to the MinIO server.
# For example， `--console-address :9001` sets the MinIO Console listen port 
MINIO_OPTS="--console-address :9001"
0

使用 putObject， stream 方式上传大文件， 实测上传 2.3GB 文件没问题

# MINIO_ROOT_USER and MINIO_ROOT_PASSWORD sets the root account for the MinIO server.
# This user has unrestricted permissions to perform S3 and administrative API operations on any reso
urce in the deployment.
# Omit to use the default values 'minioadmin:minioadmin'.
# MinIO recommends setting non-default values as a best practice， regardless of environment

MINIO_ROOT_USER=minioadmin
MINIO_ROOT_PASSWORD=minio123

# MINIO_VOLUMES sets the storage volume or path to use for the MinIO server.

MINIO_VOLUMES="/mnt/data"

# MINIO_OPTS sets any additional commandline options to pass to the MinIO server.
# For example， `--console-address :9001` sets the MinIO Console listen port 
MINIO_OPTS="--console-address :9001"
1

下载文件

下载 MinIO 上的文件到本地， 实测 2.3GB 文件没问题， 下载速度大致是上传速度的两倍

# MINIO_ROOT_USER and MINIO_ROOT_PASSWORD sets the root account for the MinIO server.
# This user has unrestricted permissions to perform S3 and administrative API operations on any reso
urce in the deployment.
# Omit to use the default values 'minioadmin:minioadmin'.
# MinIO recommends setting non-default values as a best practice， regardless of environment

MINIO_ROOT_USER=minioadmin
MINIO_ROOT_PASSWORD=minio123

# MINIO_VOLUMES sets the storage volume or path to use for the MinIO server.

MINIO_VOLUMES="/mnt/data"

# MINIO_OPTS sets any additional commandline options to pass to the MinIO server.
# For example， `--console-address :9001` sets the MinIO Console listen port 
MINIO_OPTS="--console-address :9001"
2

备份与恢复

如果是容器版， 容器里自带 mc， 否则需要下载， 参考 https://min.io/docs/minio/linux/reference/minio-mc.html

# MINIO_ROOT_USER and MINIO_ROOT_PASSWORD sets the root account for the MinIO server.
# This user has unrestricted permissions to perform S3 and administrative API operations on any reso
urce in the deployment.
# Omit to use the default values 'minioadmin:minioadmin'.
# MinIO recommends setting non-default values as a best practice， regardless of environment

MINIO_ROOT_USER=minioadmin
MINIO_ROOT_PASSWORD=minio123

# MINIO_VOLUMES sets the storage volume or path to use for the MinIO server.

MINIO_VOLUMES="/mnt/data"

# MINIO_OPTS sets any additional commandline options to pass to the MinIO server.
# For example， `--console-address :9001` sets the MinIO Console listen port 
MINIO_OPTS="--console-address :9001"
3

将 minio 服务带上 access key 添加为 alias

# MINIO_ROOT_USER and MINIO_ROOT_PASSWORD sets the root account for the MinIO server.
# This user has unrestricted permissions to perform S3 and administrative API operations on any reso
urce in the deployment.
# Omit to use the default values 'minioadmin:minioadmin'.
# MinIO recommends setting non-default values as a best practice， regardless of environment

MINIO_ROOT_USER=minioadmin
MINIO_ROOT_PASSWORD=minio123

# MINIO_VOLUMES sets the storage volume or path to use for the MinIO server.

MINIO_VOLUMES="/mnt/data"

# MINIO_OPTS sets any additional commandline options to pass to the MinIO server.
# For example， `--console-address :9001` sets the MinIO Console listen port 
MINIO_OPTS="--console-address :9001"
4

命令参考 https://gist.github.com/MahdadGhasemian/416476b536f9a1334382065a7c44b33c

列出 BUCKET_NAME 桶内的文件

# MINIO_ROOT_USER and MINIO_ROOT_PASSWORD sets the root account for the MinIO server.
# This user has unrestricted permissions to perform S3 and administrative API operations on any reso
urce in the deployment.
# Omit to use the default values 'minioadmin:minioadmin'.
# MinIO recommends setting non-default values as a best practice， regardless of environment

MINIO_ROOT_USER=minioadmin
MINIO_ROOT_PASSWORD=minio123

# MINIO_VOLUMES sets the storage volume or path to use for the MinIO server.

MINIO_VOLUMES="/mnt/data"

# MINIO_OPTS sets any additional commandline options to pass to the MinIO server.
# For example， `--console-address :9001` sets the MinIO Console listen port 
MINIO_OPTS="--console-address :9001"
5

备份到本地

# MINIO_ROOT_USER and MINIO_ROOT_PASSWORD sets the root account for the MinIO server.
# This user has unrestricted permissions to perform S3 and administrative API operations on any reso
urce in the deployment.
# Omit to use the default values 'minioadmin:minioadmin'.
# MinIO recommends setting non-default values as a best practice， regardless of environment

MINIO_ROOT_USER=minioadmin
MINIO_ROOT_PASSWORD=minio123

# MINIO_VOLUMES sets the storage volume or path to use for the MinIO server.

MINIO_VOLUMES="/mnt/data"

# MINIO_OPTS sets any additional commandline options to pass to the MinIO server.
# For example， `--console-address :9001` sets the MinIO Console listen port 
MINIO_OPTS="--console-address :9001"
6

从本地恢复到MinIO

# MINIO_ROOT_USER and MINIO_ROOT_PASSWORD sets the root account for the MinIO server.
# This user has unrestricted permissions to perform S3 and administrative API operations on any reso
urce in the deployment.
# Omit to use the default values 'minioadmin:minioadmin'.
# MinIO recommends setting non-default values as a best practice， regardless of environment

MINIO_ROOT_USER=minioadmin
MINIO_ROOT_PASSWORD=minio123

# MINIO_VOLUMES sets the storage volume or path to use for the MinIO server.

MINIO_VOLUMES="/mnt/data"

# MINIO_OPTS sets any additional commandline options to pass to the MinIO server.
# For example， `--console-address :9001` sets the MinIO Console listen port 
MINIO_OPTS="--console-address :9001"
7