MinIO

MinIO is an S3-compatible object storage system commonly used for on-prem, cloud, and hybrid deployments.

The MinIO integration allows Plakar to interact with MinIO buckets through the standard S3 API.

The MinIO integration provides three connectors:

Requirements

• A running MinIO server.
• Network access to the MinIO endpoint.
• Credentials with sufficient permissions on the target bucket(s).

Typical use cases

• Backing up MinIO buckets to local, remote, or cloud-hosted Kloset stores.
• Hosting a Kloset store in MinIO for durable, object-storage-backed snapshots.
• Replicating data between MinIO environments using plakar sync.
• Migrating data between MinIO and other S3-compatible providers.

Installation

To interact with MinIO, you need to install the S3 Plakar package. It can be installed either by downloading a pre-built package or by building it from source.

1$ plakar pkg add s3

1$ plakar pkg list

1$ plakar pkg build s3

1$ plakar pkg add ./s3_v1.0.7_darwin_arm64.ptar

1$ plakar pkg list

1$ plakar pkg list

1$ plakar pkg rm s3
2$ plakar pkg add s3

Connectors

The S3 package provides three connectors: a storage connector for hosting Kloset stores in buckets, a source connector for backing up S3 buckets, and a destination connector for restoring data over S3.

You can use any combination of these connectors together with other supported Plakar connectors.

Storage connector

The Plakar S3 package provides a storage connector to host Kloset stores in S3-compatible buckets, including MinIO.

Configure

 1# Configure the Kloset store
 2$ plakar store add minio \
 3  s3://localhost:9000/plakar-kloset \
 4  access_key=minioadmin \
 5  secret_access_key=minioadmin \
 6  use_tls=false
 7
 8# Initialize the Kloset store
 9$ plakar at @minio create
10
11# List snapshots in the Kloset store
12$ plakar at @minio ls
13
14# Verify integrity of the Kloset store
15$ plakar at @minio check
16
17# Backup a local folder to the Kloset store
18$ plakar at @minio backup /etc
19
20# Backup a source configured in Plakar to the Kloset store
21$ plakar at @minio backup @my_source

Options

These options can be set when configuring the storage connector with plakar store add or plakar store set:

Source connector

The Plakar S3 package provides a source connector to back up S3-compatible buckets, including MinIO.

Configure

 1# Configure a source pointing to the remote MinIO bucket
 2$ plakar source add minio_src \
 3    s3://localhost:9000/mybucket \
 4    access_key=minioadmin \
 5    secret_access_key=minioadmin \
 6    use_tls=false
 7
 8# Back up the remote directory to the Kloset store on the filesystem
 9$ plakar at /var/backups backup @minio_src
10
11# Or back up the remote directory to the Kloset store on S3 created above
12$ plakar at @minio backup @minio_src

Options

These options can be set when configuring the source connector with plakar source add or plakar source set:

Destination connector

The Plakar S3 package provides a destination connector to restore snapshots to remote S3-compatible buckets, including MinIO.

Configure

 1# Configure a destination pointing to the remote MinIO bucket
 2$ plakar destination add minio_dst \
 3    s3://localhost:9000/mybucket \
 4    access_key=minioadmin \
 5    secret_access_key=minioadmin \
 6    use_tls=false
 7
 8# Restore a snapshot from a filesystem-hosted Kloset store to the remote MinIO bucket
 9$ plakar at /var/backups restore -to @minio_dst <snapshot_id>
10
11# Or restore a snapshot from a MinIO-hosted Kloset store to the remote MinIO bucket
12$ plakar at @minio restore -to @minio_dst <snapshot_id>

Options

These options can be set when configuring the destination connector with plakar destination add or plakar destination set:

Configure IAM permissions in MinIO

MinIO supports fine-grained access control using IAM-style policies. You can assign permissions to users or service accounts using one of the following methods:

Option 1: Using the mc CLI (MinIO Client)

This is the most common and scriptable method. You can:

• Create users with mc admin user add
• Define policies in JSON format
• Attach policies to users with mc admin policy attach

Contents of policy.json — Remember to remove comments or the JSON will be invalid

 1{
 2  "Version": "2012-10-17",
 3  "Statement": [
 4    {
 5      "Effect": "Allow",
 6      "Action": ["s3:GetObject", "s3:ListBucket"],
 7      // To allow restoring into the bucket, you need to add the PutObject action
 8      // "Action": ["s3:GetObject", "s3:ListBucket", "s3:PutObject"],
 9      // To allow using the bucket as a Kloset store, you also need to give permissions to create the bucket
10      // "Action": ["s3:GetObject", "s3:ListBucket", "s3:PutObject", "s3:CreateBucket"],
11      // plakar-kloset is the name of the bucket you want to backup, restore to or host a Kloset store in
12      "Resource": ["arn:aws:s3:::plakar-kloset", "arn:aws:s3:::plakar-kloset/*"]
13    },
14    // To allow deleting locks created by Plakar, you need to add the DeleteObject action on the locks prefix
15    // Those locks will be removed in future versions of Plakar
16    {
17      "Effect": "Allow",
18      "Action": ["s3:DeleteObject"],
19      "Resource": ["arn:aws:s3:::plakar-kloset/locks*"]
20    }
21  ]
22}

Create the user plakar_user with the password mysecretpassword and assign the policy plakar-policy to it

1$ mc alias set myminio http://localhost:9000 minioadmin minioadmin
2$ mc admin user add myminio plakar_user a-very-strong-secret
3$ mc admin policy create myminio plakar-policy /tmp/minio_policy # /tmp/plakar_policy contains the JSON of your policy
4$ mc admin policy attach myminio plakar-policy --user=plakar_user

Option 2: Using the MinIO Console (Web UI)

If you have enabled the admin console, you can:

• Create users via the Identity > Users panel
• Assign predefined or custom policies
• Review and manage access through the UI

Policy

The policy you should attach to the user depends on your use-case:

• Read-only policy: If you only need to back up a bucket, use a policy that allows s3:GetObject and s3:ListBucket actions. Write permissions are not needed.
• Read-write policy: If you need to restore a snapshot into a bucket or host a Kloset store in a bucket, use a policy that also includes s3:PutObject.

Limitations and considerations

Store MinIO configuration

The MinIO source connector makes a snapshot of a bucket by listing all objects in the bucket and downloading their contents. It does not store the bucket configuration itself, such as policies, lifecycle rules, or versioning settings.

Also, if your MinIO instance uses server-side encryption (SSE) for storage-level encryption, the SSE configuration is not part of the data captured by Plakar. However, Plakar performs its own encryption before storing any chunk, ensuring data-at-rest security even without relying on SSE.

Snapshot consistency and limitations

Plakar relies on the MinIO (S3-compatible) API to scan and snapshot bucket contents. However, object storage systems do not provide snapshot isolation guarantees, meaning that:

• If objects are added, modified or deleted during the snapshot process, the resulting snapshot may be inconsistent.
• There is no atomic point-in-time capture across all objects.

As a result, the snapshot represents a consistent read of all objects at the time they were listed and fetched, but not a frozen image of the bucket at a single moment in time.

Frequently asked questions

Why do I get 401/403 errors when Plakar tries to access my MinIO bucket?

Ensure that the access key and secret key are correct, and that the user has sufficient permissions on the target bucket.

Check plakar store show, plakar source show, or plakar destination show to verify the configured credentials.

Ensure that the use_tls option matches your MinIO server configuration.

Does Plakar back up all object versions?

No. Plakar only includes the latest visible version of each object in the bucket at snapshot time.

If versioning is enabled in MinIO, older versions are not backed up.

Can I synchronize a Kloset store hosted in MinIO to another MinIO bucket?

Yes.

Declare two Kloset stores pointing to your source and target MinIO buckets (e.g. @minio_prod and @minio_backup), then run a sync command.

Transfer a single snapshot from a Kloset store in MinIO to another one:

1$ plakar at @minio_prod sync <snapshot-id> to @minio_backup

Transfer all the snapshots of a Kloset store to another one:

1$ plakar at @minio_prod sync to @minio_backup

Note that this is not specific to MinIO: two Kloset stores can be synchronized regardless of their underlying storage backend, even if they are different (e.g., one on MinIO and the other on a local filesystem).

How to enable or disable TLS?

Update the configuration option use_tls to true or false depending on whether your MinIO instance uses TLS. For local development, you probably want to disable TLS.

1# Disable TLS for the Kloset store
2$ plakar store set minio_store use_tls=false
3# Disable TLS for the Source or Destination connector
4$ plakar source set minio_src use_tls=false
5$ plakar destination set minio_dst use_tls=false

Can I restore data from MinIO to another provider (e.g., AWS, Azure, GCP, Wasabi, Scaleway, OVH)?

Yes. Configure the storage connector to point to the MinIO bucket, and set the destination connector to point to the target provider.

How to generate a flat .ptar file from a MinIO store?

Like any other Kloset store, you can use plakar ptar to export a Kloset store into a portable .ptar file.

1$ plakar ptar -o ./export.ptar -k @minio_store

How to restore a flat .ptar file to a MinIO bucket?

Run the following command to restore a .ptar file into a MinIO bucket configured in the destination connector @minio_dst.

1$ plakar at ./export.ptar restore -to @minio_dst

See also

• Plakar Architecture (Kloset Engine)
• MinIO Documentation