MinIO CE: Object Storage Ledger 2026 Scorecard

Part of the Object Storage Ledger (edition 2026-10-16). How the scores work: methodology.

Snapshot

Type: community edition at end of life (source only, repository archived)
Owner: MinIO, Inc. (private, venture-backed, Redwood City, California); the same company sells AIStor, the commercial successor
Licence: GNU AGPLv3 since 2021 (Apache 2.0 before; a secondary source dates the change to RELEASE.2021-05-11T23-27-41Z); documentation under CC BY 4.0. The README says no party is obliged to support, maintain or warrant the software
Latest release: RELEASE.2025-10-15T17-29-55Z (tag 2025-10-15, published on GitHub 2025-10-16), a security release fixing a session policy bypass in service accounts and STS; the last binary build
Support lifecycle: None. Source only from 2025-10-15, maintenance mode from 2025-12-03 (critical security fixes case by case), no longer maintained from 2026-02-12, repository archived on GitHub 2026-04-25. Older binaries stay on GitHub Releases and dl.min.io without updates
Next milestone: none published; the README points to AIStor Free and Enterprise
Object lock: Governance and compliance modes with legal hold, tied to versioning (MinIO documentation). Veeam Ready Object and Object with Immutability announced for the MinIO line on 2020-07-27 (vendor announcement via StorageNewsletter); no later validation found, and no fixes of any kind after 2025-10-15
Tier: Open-source software
Archetype: Wound down for the commercial line
Evidence grade: B. Every step of the 2025 to 2026 wind-down was read from the GitHub repository, its release notes and the README commit history (grade A). The licence change of 2021 and the removal of admin functions from the console come from a third-party timeline (grade B). Capability steps from 2015 to 2022 follow the shared MinIO code base and are inferred (grade C); their years are approximate.

Not ranked: End of life: source-only from 2025-10-15, maintenance mode 2025-12-03, no longer maintained 2026-02-12, repository archived 2026-04-25

Scope of the scores: Kept as a flagged end-of-life entry because many clusters still run it; it is not ranked. Scores up to 2022 are those of the MinIO code base it shared with the commercial line, which became the Enterprise Object Store on 2024-03-12 and AIStor on 2024-11-13. From 2025 the lines fall only where a capability was removed: the console, external identity provider logins and FIPS builds on 2025-05-24, binaries on 2025-10-15, outside changes on 2025-12-03, maintenance on 2026-02-12 and the repository itself on 2026-04-25.

Scorecard

Dimension	Score	Direction
Capability today	61.0 / 100	higher is better
Momentum since end of 2022	-10.5 points (2015 to 2022: +45.3)	higher is better
Credibility	4.0 / 25	higher is better
Sustainability risk	23.0 / 25	lower is better
Technical lock-in	4.0 / 25	lower is better
Integrator fit	6.0 / 20	higher is better
AI leverage	3.0 / 20	higher is better
Ledger Index	38.3 / 100	balanced weights; see the methodology

Capability by domain, 2015 to today

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Domain (weight)	2015	2019	2022	Today
S3 API fidelity (15)	1.5	3	4	4
Immutability and compliance (12)	0	0	3.5	3.5
Durability and resilience (12)	1	3	4	4
Performance and scale (12)	2	3.5	4	4
Deployment freedom (10)	3	3.5	4	2.5
Security and multi-tenancy (10)	1	2.5	3.5	2.5
Operations (10)	1.5	2.5	3.5	2
Protocols beyond S3 (7)	0	0	0	0
Lifecycle and tiering (7)	0	1	3.5	3.5
Ecosystem and openness (5)	3.5	5	5	2.5
Total / 100	26.2	48.0	71.5	61.0

Year by year: 2015: 26.2 · 2016: 26.2 · 2017: 26.2 · 2018: 26.2 · 2019: 48.0 · 2020: 56.4 · 2021: 56.4 · 2022: 71.5 · 2023: 71.5 · 2024: 71.5 · 2025: 64.0 · 2026: 61.0

What moved the score

Year	Domain	Change	Points	Trigger
2019	Deployment freedom	3 → 3.5	+1.0	Helm chart and first Kubernetes Operator; year approximate (grade C)
2019	Durability and resilience	1 → 3	+4.8	Distributed erasure coding, bitrot verification and healing; year approximate (grade C)
2019	Ecosystem and openness	3.5 → 5	+1.5	The default S3-compatible target for backup tools, SDK test suites and Kubernetes charts; large outside contributor base
2019	Lifecycle and tiering	0 → 1	+1.4	Bucket lifecycle expiration; year approximate (grade C)
2019	Operations	1.5 → 2.5	+2.0	mc admin, Prometheus metrics, rolling upgrades; year approximate (grade C)
2019	Performance and scale	2 → 3.5	+3.6	Distributed mode across dozens of nodes; vendor NVMe benchmarks; year approximate (grade C)
2019	S3 API fidelity	1.5 → 3	+4.5	Bucket policies, event notifications, presigned URLs, SSE and STS federation; year approximate (grade C)
2019	Security and multi-tenancy	1 → 2.5	+3.0	STS, OIDC and LDAP federation, external KMS through KES; year approximate (grade C)
2020	Immutability and compliance	0 → 3.5	+8.4	Object Lock in governance and compliance modes with legal hold, tied to versioning; Veeam Ready Object with Immutability (vendor announcement 2020-07-27)
2022	Deployment freedom	3.5 → 4	+1.0	Operator with tenant management, Arm builds; year approximate (grade C)
2022	Durability and resilience	3 → 4	+2.4	Bucket replication and multi-site site replication; year approximate (grade C)
2022	Lifecycle and tiering	1 → 3.5	+3.5	Transition to other S3 and cloud tiers, tag and size filters, batch jobs; year approximate (grade C)
2022	Operations	2.5 → 3.5	+2.0	Embedded console, SUBNET diagnostics, server pool expansion and decommission; year approximate (grade C)
2022	Performance and scale	3.5 → 4	+1.2	Server pools for expansion; billions of objects in vendor references; year approximate (grade C). No RDMA in the community line
2022	S3 API fidelity	3 → 4	+3.0	Versioning, lifecycle, tagging, replication and S3 Select; year approximate (grade C). Frozen at RELEASE.2025-10-15
2022	Security and multi-tenancy	2.5 → 3.5	+2.0	Audit logging, policy conditions, console single sign-on; year approximate (grade C)
2025	Deployment freedom	4 → 2.5	-3.0	2025-10-15: source only; no pre-compiled binaries or official images from then on, older builds unmaintained
2025	Ecosystem and openness	5 → 3.5	-1.5	2025-12-03: maintenance mode; no new features, enhancements or pull requests accepted
2025	Operations	3.5 → 2.5	-2.0	RELEASE.2025-05-24: embedded console deprecated and moved to object-browser; admin functions removed from the community console (third-party report)
2025	Security and multi-tenancy	3.5 → 3	-1.0	RELEASE.2025-05-24: external LDAP and OIDC identity provider logins and FIPS builds removed from the open source build
2026	Ecosystem and openness	3.5 → 2.5	-1.0	2026-04-25: repository archived and read-only; integrations keep working but have no maintained upstream
2026	Operations	2.5 → 2	-1.0	2026-02-12: no longer maintained; the only upgrade path is a move to AIStor
2026	Security and multi-tenancy	3 → 2.5	-1.0	2026-02-12: no longer maintained; no security fix after RELEASE.2025-10-15

Direction, 2023 to 2026

Each release item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

Date	Item	Theme	Driver
2023	MinIO publicly accuses Weka of AGPL violation (third-party timeline)	Licensing	P
2024-03	Enterprise Object Store introduced as the commercial line beside the community edition	Packaging	P
2024-11	AIStor launched as the commercial successor; new features go there	Packaging	P
2025-04	RELEASE.2025-04-03: CVE-2025-31489 fixed, STS token revoke API	Security	C
2025-05	RELEASE.2025-05-24: console deprecated, external LDAP and OIDC logins and FIPS builds removed; AIStor recommended	Licensing	P
2025-06	RELEASE.2025-06-13: ILM listing, RISC-V cross-compile	Lifecycle	C
2025-07	RELEASE.2025-07-23: X25519MLKEM768 post-quantum key exchange	Security	C
2025-09	RELEASE.2025-09-07: console v2.0.3	Operations	C
2025-10	Source-only distribution: no more pre-compiled binaries	Packaging	P
2025-10	RELEASE.2025-10-15: final release, session policy bypass in service accounts and STS fixed	Security	C
2025-12	Maintenance mode: no new changes or pull requests, security fixes case by case	Packaging	P
2026-01	README points users to AIStor Free and Enterprise	Licensing	P
2026-02	README states the repository is no longer maintained	Packaging	P
2026-04	Repository archived on GitHub (2026-04-25)	Packaging	P

Centre of gravity: Packaging (6), Licensing (3), Security (3)
Blind spots (no items): S3 API, Immutability, Durability, Performance, Deployment, Protocols, Ecosystem, AI
Driver mix: Vision 0%, Customer need 36%, Market window 0%, Upstream 0%, Portfolio 64%
Idea-to-need index: 0.00 (0 = demand-pulled, 1 = thesis-pushed)

Credibility: 4.0 / 25

Criterion	Score	Basis
Cadence	0.5	Releases every few weeks through 2025, then none after 2025-10-15
Roadmap transparency	1	No roadmap; each wind-down step appeared as a README commit without notice
Say-do	1.5	No feature promises for the community edition 2023 to 2026; on 2025-10-26 a maintainer said source only would remain for the near future, and maintenance mode followed on 2025-12-03
Velocity	0.5	Mostly fixes in 2025; nothing since 2025-10-15
Lifecycle stability	0.5	Console, identity provider logins, binaries, maintenance and the repository removed in eleven months, 2025-05-24 to 2026-04-25

Sustainability risk: 23.0 / 25 (lower is better)

Criterion	Score	Basis
Maintainer concentration	5	One company, MinIO, Inc., owned the repository and cut every release, then archived it
Backer health	5	The only backer withdrew: maintenance mode 2025-12-03, no longer maintained 2026-02-12; its effort goes to AIStor
Licence-change risk	3	Relicensed from Apache 2.0 to AGPLv3 in 2021; the archived AGPLv3 code keeps its licence, but the free successor AIStor Free is closed and bars redistribution
Abandonment signs	5	Last release 2025-10-15; repository archived 2026-04-25
Security response	5	No fix after RELEASE.2025-10-15; maintenance mode offered critical fixes case by case, then the project stopped on 2026-02-12

Technical lock-in: 4.0 / 25 (lower is better)

Criterion	Score	Basis
Formats	1.5	Erasure-coded parts with xl.meta per object on a local filesystem; data is read out through S3
Export path	0.5	Any S3 client or mc mirror; the vendor says AIStor binaries are backward compatible with community deployments
Stack coupling	1	Own erasure sets on XFS drives; erasure sets cannot change after creation
Hardware / cloud coupling	0	Any server
Skills and tooling coupling	1	S3 and mc skills; wide pool of users

Integrator fit: 6.0 / 20

Criterion	Score	Basis
Partner programme openness	0.5	No partner programme; AGPL makes embedding or reselling a licence question
Multi-tenancy and self-service	1.5	IAM policies or separate deployments; external identity provider logins removed from the open source build on 2025-05-24
API and infrastructure-as-code	2	S3 and admin API with mc admin; a community Terraform provider was not re-verified; no maintained target
Skills and certification	2	Wide S3 and mc skills; the MinIO certification of 2024-05-21 relates to the commercial line

AI leverage: 3.0 / 20

How the product uses AI, scored per year like capability. Only GA counts.

Criterion	2019	2022	Today	Latest step
AI workload support	1	1	1	2015: S3 object store usable as a training data source; no RDMA or GPU path in the community line
AI platform stack	0	0	0	2015: None
AI-assisted operations	0	0	0	2015: None
Agent openness	2	2	2	2015: S3 and admin APIs that agents can drive; no MCP server for the community edition

Year by year: 2015: 3 · 2016: 3 · 2017: 3 · 2018: 3 · 2019: 3 · 2020: 3 · 2021: 3 · 2022: 3 · 2023: 3 · 2024: 3 · 2025: 3 · 2026: 3

AI say-do, 2023 to 2026: 0 AI items announced; 0 GA, 0 still preview, 0 pending, 0 dropped. No AI item was announced for the community edition from 2023 to 2026; the AI work went into AIStor.

The community edition has no AI features and will receive none. Its S3 API still serves as a data source for training jobs and can be driven by agents, but nothing on top of it is maintained.

Reading

The capability lines are those of the MinIO code base frozen at its last release, so S3 coverage, erasure coding and Object Lock still score as they did in 2022. Four lines fall, each on a dated removal: security and operations with the 2025-05-24 release, deployment when binaries stopped on 2025-10-15, and ecosystem when outside changes stopped and the repository was archived. Sustainability risk is close to the maximum because one company owned the project and has stopped it, and no community release followed the five AIStor stable releases of 2026 that listed security fixes. A buyer still running it should list the release on every cluster and plan a move, either to AIStor, whose binaries the vendor calls backward compatible, or to another S3 store through an S3 copy.

Open questions and items to re-score

Whether the security flaws fixed in AIStor releases from 2026-03 to 2026-07 also affect RELEASE.2025-10-15 was not checked.
Which admin functions left the community console in which release; the 2025-05 removal of policy, site replication and lifecycle screens rests on a third-party report.
The month of the AGPLv3 switch in 2021 (sources disagree between April and May) and the first public version date (2015-06-17 in one low-confidence source).
Whether SFTP or FTP access exists in the community build; it is documented for AIStor only in sources read.
Whether the community Terraform provider and the Kubernetes Operator are still maintained.
Whether any community fork (one secondary post names PGSTY Silo) is credible, and whether three CVEs claimed in one post are real.

	’19	’20	’22
S3 API fidelity	2		2
Immutability and compliance		1
Durability and resilience	1		3
Performance and scale	3
Deployment freedom
Security and multi-tenancy
Operations
Protocols beyond S3
Lifecycle and tiering			1
Ecosystem and openness