Developers

• 1: Go Quickstart Guide
• 2: Python Quickstart Guide
• 3: .NET Quickstart Guide
• 4: Java Quickstart Guide
• 5: Security Token Service (STS) for MinIO Operator
• 6: JavaScript Quickstart Guide
• 7: Haskell Quickstart Guide
• 8: Rust Quickstart Guide
• 9: Software Development Kits (SDK)
• 10: Security Token Service (STS)
  • 10.1: AssumeRoleWithCustomToken
  • 10.2: AssumeRoleWithLDAPIdentity
  • 10.3: AssumeRoleWithWebIdentity
• 11: Transforms with Object Lambda
• 12: File Transfer Protocol (FTP/SFTP)

1 - Go Quickstart Guide

MinIO Go SDK

SILO implements the S3-compatible server contract, so Go applications can use the upstream MinIO Go SDK directly. The current major module path is github.com/minio/minio-go/v7.

Install the module

From an existing Go module:

go get github.com/minio/minio-go/v7

Configure the connection

export S3_ENDPOINT=127.0.0.1:9000
export S3_ACCESS_KEY=silo-admin
export S3_SECRET_KEY=replace-with-a-strong-secret
export S3_USE_SSL=false

S3_ENDPOINT is a host and optional port, without an http:// or https:// prefix. Keep credentials outside source control and set S3_USE_SSL=true when the endpoint serves TLS.

Create a bucket and upload an object

Save the following as main.go:

package main

import (
	"bytes"
	"context"
	"fmt"
	"log"
	"os"

	"github.com/minio/minio-go/v7"
	"github.com/minio/minio-go/v7/pkg/credentials"
)

func required(name string) string {
	value := os.Getenv(name)
	if value == "" {
		log.Fatalf("%s is required", name)
	}
	return value
}

func main() {
	ctx := context.Background()
	client, err := minio.New(required("S3_ENDPOINT"), &minio.Options{
		Creds: credentials.NewStaticV4(
			required("S3_ACCESS_KEY"),
			required("S3_SECRET_KEY"),
			"",
		),
		Secure: os.Getenv("S3_USE_SSL") == "true",
	})
	if err != nil {
		log.Fatal(err)
	}

	const bucket = "go-quickstart"
	const object = "hello.txt"

	exists, err := client.BucketExists(ctx, bucket)
	if err != nil {
		log.Fatal(err)
	}
	if !exists {
		if err = client.MakeBucket(ctx, bucket, minio.MakeBucketOptions{
			Region: "us-east-1",
		}); err != nil {
			log.Fatal(err)
		}
	}

	payload := []byte("hello from SILO\n")
	info, err := client.PutObject(
		ctx,
		bucket,
		object,
		bytes.NewReader(payload),
		int64(len(payload)),
		minio.PutObjectOptions{ContentType: "text/plain"},
	)
	if err != nil {
		log.Fatal(err)
	}

	fmt.Printf("Uploaded %s: %d bytes\n", info.Key, info.Size)
}

Run it with:

go run .

Use the SDK’s API documentation and maintained examples for presigned URLs, object locking, encryption, notifications, multipart operations, and other APIs.

Production checklist

• Use TLS and verify the server certificate.
• Load credentials from a secret manager or protected environment.
• Grant the application only the bucket and object permissions it needs.
• Pin and test the SDK and Go versions together.
• Apply request deadlines and handle retries, cancellation, and incomplete multipart uploads explicitly.

See Identity and Access Management for server-side policy configuration.

2 - Python Quickstart Guide

MinIO Python SDK

SILO implements the S3-compatible server contract, so Python applications can use the upstream MinIO Python SDK directly.

Install the package

Install minio in a virtual environment:

python3 -m venv .venv
source .venv/bin/activate
python -m pip install minio

Configure the connection

export S3_ENDPOINT=127.0.0.1:9000
export S3_ACCESS_KEY=silo-admin
export S3_SECRET_KEY=replace-with-a-strong-secret
export S3_USE_SSL=false

S3_ENDPOINT is a host and optional port, without an http:// or https:// prefix. Keep credentials outside source control and set S3_USE_SSL=true when the endpoint serves TLS.

Create a bucket and upload an object

Save the following as quickstart.py:

import io
import os

from minio import Minio


def required(name: str) -> str:
    value = os.environ.get(name)
    if not value:
        raise RuntimeError(f"{name} is required")
    return value


client = Minio(
    required("S3_ENDPOINT"),
    access_key=required("S3_ACCESS_KEY"),
    secret_key=required("S3_SECRET_KEY"),
    secure=os.environ.get("S3_USE_SSL", "false").lower() == "true",
)

bucket = "python-quickstart"
object_name = "hello.txt"
payload = b"hello from SILO\n"

if not client.bucket_exists(bucket):
    client.make_bucket(bucket)

client.put_object(
    bucket,
    object_name,
    io.BytesIO(payload),
    length=len(payload),
    content_type="text/plain",
)

stat = client.stat_object(bucket, object_name)
print(f"Uploaded {object_name}: {stat.size} bytes")

Run it with:

python quickstart.py

Use the repository’s API reference and maintained examples for presigned URLs, server-side encryption, notifications, object locking, multipart operations, and other APIs.

Production checklist

• Use TLS and verify the server certificate.
• Load credentials from a secret manager or protected environment.
• Grant the application only the bucket and object permissions it needs.
• Pin and test the Python runtime, SDK, and HTTP dependencies together.
• Define timeouts and handle SDK exceptions, retries, streaming resources, and incomplete multipart uploads explicitly.

See Identity and Access Management for server-side policy configuration.

3 - .NET Quickstart Guide

MinIO SDK for .NET

SILO implements the S3-compatible server contract, so applications can use the upstream MinIO .NET SDK without a SILO-specific client fork. This guide uses the stable NuGet package and environment variables for credentials.

Install the package

From an existing .NET project, add the Minio package:

dotnet add package Minio

Configure the connection

Set the endpoint and credentials for your SILO deployment. Keep secrets outside source control.

export S3_ENDPOINT=127.0.0.1:9000
export S3_ACCESS_KEY=silo-admin
export S3_SECRET_KEY=replace-with-a-strong-secret
export S3_USE_SSL=false

S3_ENDPOINT is a host and optional port, without an http:// or https:// prefix. Set S3_USE_SSL=true when the endpoint serves TLS.

Create a bucket and upload an object

using Minio;
using Minio.DataModel.Args;

var endpoint = Environment.GetEnvironmentVariable("S3_ENDPOINT")
    ?? throw new InvalidOperationException("S3_ENDPOINT is required");
var accessKey = Environment.GetEnvironmentVariable("S3_ACCESS_KEY")
    ?? throw new InvalidOperationException("S3_ACCESS_KEY is required");
var secretKey = Environment.GetEnvironmentVariable("S3_SECRET_KEY")
    ?? throw new InvalidOperationException("S3_SECRET_KEY is required");
var useSsl = bool.TryParse(Environment.GetEnvironmentVariable("S3_USE_SSL"), out var ssl)
    && ssl;

var client = new MinioClient()
    .WithEndpoint(endpoint)
    .WithCredentials(accessKey, secretKey)
    .WithSSL(useSsl)
    .Build();

const string bucket = "dotnet-quickstart";
const string objectName = "hello.txt";
const string filePath = "hello.txt";

var exists = await client.BucketExistsAsync(
    new BucketExistsArgs().WithBucket(bucket));

if (!exists)
{
    await client.MakeBucketAsync(
        new MakeBucketArgs().WithBucket(bucket));
}

await client.PutObjectAsync(
    new PutObjectArgs()
        .WithBucket(bucket)
        .WithObject(objectName)
        .WithFileName(filePath)
        .WithContentType("text/plain"));

Console.WriteLine($"Uploaded {objectName} to {bucket}");

Create hello.txt, then run the project:

dotnet run

For ASP.NET Core dependency injection and additional operations, use the SDK’s current README. The maintained repository also contains simple and host-based example projects; review their target branch and package version before copying code into a pinned application.

Production checklist

• Use TLS and verify the server certificate.
• Load credentials from a secret manager or protected environment, not source code.
• Grant the application only the bucket and object permissions it needs.
• Pin and test the SDK version as part of the application’s dependency lifecycle.
• Handle SDK exceptions, request cancellation, retries, and multipart-upload cleanup explicitly.

See Identity and Access Management for server-side policy configuration.

4 - Java Quickstart Guide

MinIO Java SDK

SILO implements the S3-compatible server contract, so Java applications can use the upstream MinIO Java SDK directly. The SDK supports Java 8 and later; select a runtime that is also supported by your application framework.

Install the package

Add the dependency to Maven:

<dependency>
  <groupId>io.minio</groupId>
  <artifactId>minio</artifactId>
  <version>9.0.3</version>
</dependency>

Or to Gradle:

implementation("io.minio:minio:9.0.3")

Configure the connection

export S3_ENDPOINT=http://127.0.0.1:9000
export S3_ACCESS_KEY=silo-admin
export S3_SECRET_KEY=replace-with-a-strong-secret

Unlike some other MinIO SDKs, the Java builder accepts a complete endpoint URL, including the http:// or https:// scheme. Keep credentials outside source control.

Create a bucket and upload an object

import io.minio.BucketExistsArgs;
import io.minio.MakeBucketArgs;
import io.minio.MinioClient;
import io.minio.PutObjectArgs;
import java.io.ByteArrayInputStream;
import java.nio.charset.StandardCharsets;

public final class Quickstart {
  private static String required(String name) {
    String value = System.getenv(name);
    if (value == null || value.isBlank()) {
      throw new IllegalStateException(name + " is required");
    }
    return value;
  }

  public static void main(String[] args) throws Exception {
    MinioClient client =
        MinioClient.builder()
            .endpoint(required("S3_ENDPOINT"))
            .credentials(required("S3_ACCESS_KEY"), required("S3_SECRET_KEY"))
            .build();

    String bucket = "java-quickstart";
    String object = "hello.txt";
    byte[] payload = "hello from SILO\n".getBytes(StandardCharsets.UTF_8);

    boolean exists =
        client.bucketExists(BucketExistsArgs.builder().bucket(bucket).build());
    if (!exists) {
      client.makeBucket(MakeBucketArgs.builder().bucket(bucket).build());
    }

    try (ByteArrayInputStream stream = new ByteArrayInputStream(payload)) {
      client.putObject(
          PutObjectArgs.builder()
              .bucket(bucket)
              .object(object)
              .stream(stream, payload.length, -1)
              .contentType("text/plain")
              .build());
    }

    System.out.printf("Uploaded %s: %d bytes%n", object, payload.length);
  }
}

Use the SDK’s Javadoc and maintained examples for presigned URLs, encryption, notifications, object locking, multipart operations, and other APIs.

Production checklist

• Use TLS and verify the server certificate and trust store.
• Load credentials from a secret manager or protected environment.
• Grant the application only the bucket and object permissions it needs.
• Pin and test the JDK, SDK, HTTP client, and framework versions together.
• Configure timeouts and handle SDK exceptions, retries, streams, and incomplete multipart uploads explicitly.

See Identity and Access Management for server-side policy configuration.

5 - Security Token Service (STS) for MinIO Operator

Overview

Benefits of STS for MinIO Operator include:

• STS credentials allow an application to access objects on a MinIO Tenant without the need to create credentials for the application on the tenant.

• Allows applications to access objects in MinIO tenants using a Kubernetes-native authentication mechanism.

  Service Accounts or Service Account Tokens are a core concept of Role-Based Access Control (RBAC) authentication in Kubernetes.

• Implementing STS for MinIO Operator allows you to utilize infrastructure as code principles and configuration by using the tenant custom resource definition (CRD) and a MinIO PolicyBinding CRD.

How STS Authorization Works in Kubernetes

An application can use an AssumeRoleWithWebIdentity call including a Kubernetes Service Account’s JWT to send a request for temporary credentials to the MinIO Operator. When linked to a pod, such as through a deployment’s .spec.spec.serviceAccountName field, Kubernetes mounts a JWT for the service account from a well-known location, such as /var/run/secrets/kubernetes.io/serviceaccount/token. The Pod can access those service accounts from that location.

The Operator checks the validity of the request, retrieves policies for the application, obtains credentials from the tenant, and then passes the credentials back the application. The application uses the issued credentials to work with the object storage on the tenant.

The complete process includes the following steps:

1. An application sends an AssumeRoleWithWebidentity API request to the MinIO Operator containing the tenant namespace and a service account to use.
2. The MinIO Operator uses the Kubernetes API to check that the JSON Web Token (JWT) associated with the service account in the application’s request is valid.
3. The Kubernetes API returns the results of its validity check.
4. The MinIO Operator checks for Policy Bindings that matches the application.
5. The PolicyBinding CRD returns the policy or policies that match the request, if any.
6. The MinIO Operator sends the combined policy information for the application to the MinIO Tenant.
7. The tenant creates temporary credentials matching the policy or policies for the request and returns those to the MinIO Operator.
8. The MinIO Operator forwards the temporary credentials back to the application.
9. The application uses the credentials to send the object storage calls to the MinIO tenant.

Requirements

STS for the MinIO Operator requires the following:

• MinIO Operator v5.0.0 or later.
• The deployment must have TLS configured.
• (Required for Operator v5.0.0 - 5.0.10) OPERATOR_STS_ENABLED environment variable set to on.

Procedure

1. Enable STS functionality for the deployment

   Note

   Note

   This step is optional for Operator version 5.0.11 or later.

   kubectl -n minio-operator set env deployment/minio-operator OPERATOR_STS_ENABLED=on

   • Replace minio-operator with the namespace for your deployment.

   • Replace deployment/minio-operator with the value for your deployment’s MinIO Operator.

     You can find the deployment value by running kubectl get deployments -n <namespace>, where you replace <namespace> with the namespace for the MinIO Operator. Your MinIO Operator namespace is typically minio-operator, though this value can change during install.

2. Ensure an appropriate policy or policies exist on the MinIO Tenant for the application to use for the application

   The next step uses a YAML document to map one or more existing tenant policies to a service account through a custom resource called a PolicyBinding.

3. Create YAML resources for the Service Account and Policy Binding:

   • Create the Service Account in the MinIO Tenant for the application to use.

     For more on service accounts in Kubernetes, see the Kubernetes documentation.

   • Create a Policy Binding in the target tenant’s namespace that links the application to one or more of the MinIO Tenant’s policies.

4. Apply the YAML file to create the resources on the deployment

   kubectl apply -k path/to/yaml/file.yaml

5. Use an SDK that supports the AssumeRoleWithWebIdentity like behavior to send a call from your application to the deployment

   The STS API expects a JWT for the service account to exist in the Kubernetes environment. When linked to a pod, such as through a deployment’s .spec.spec.serviceAccountName field, Kubernetes mounts a JWT for the service account from a well-known location, such as /var/run/secrets/kubernetes.io/serviceaccount/token.

   Alternatively, you can define the token path as an environment variable:

   AWS_WEB_IDENTITY_TOKEN_FILE=/var/run/secrets/kubernetes.io/serviceaccount/token

   The following MinIO SDKs support AssumeRoleRoleWithWebIdentity:

   • Golang
   • Java
   • JavaScript
   • .NET
   • Python

   For examples of using the SDKs to assume a role, see the Operator v7.1.1 examples.

Example Resources

Service Account

A Service Account is a Kubernetes resource type that allows an external application to interact with the Kubernetes deployment. When linked to a pod, such as through a deployment’s .spec.spec.serviceAccountName field, Kubernetes mounts a JWT for the service account from a well-known location, such as /var/run/secrets/kubernetes.io/serviceaccount/token.

The following yaml creates a service account called stsclient-sa for the sts-client namespace.

apiVersion: v1
kind: ServiceAccount
metadata:
  namespace: sts-client # The namespace to add the service account to. Usually a tenant, but can be any namespace in the deployment.
  name: stsclient-sa # The name to use for the service account.

Policy Binding

A PolicyBinding is a MinIO-specific custom resource type for Kubernetes that links an application to a set of policies.

Create Policy Bindings in the namespace of the tenant they are for.

For the purposes of the MinIO Operator, an application is any requesting resource that identifies with a specific service account and tenant namespace. The PolicyBinding resource links the application to one or more policies for the tenant on that namespace.

The below yaml creates a PolicyBinding that links an application using the service account stsclient-sa that exists in the namespace sts-client to the policy test-bucket-rw in the target tenant located in the namespace minio-tenant-1. The policies granted in the yaml definition must already exist on the MinIO Tenant.

apiVersion: sts.min.io/v1alpha1
kind: PolicyBinding
metadata:
  name: binding-1
  namespace: minio-tenant-1 # The namespace of the tenant this binding is for
spec:
  application:
    namespace: sts-client # The namespace that contains the service account for the application
    serviceaccount: stsclient-sa # The service account to use for the application
  policies:
    - test-bucket-rw # A policy that already exists in the tenant
    # - test-bucket-policy-2 # Add as many policies as needed

Reference

• STS Examples by SDK
• Kubernetes documentation on Service Accounts
• MinIO STS API

6 - JavaScript Quickstart Guide

MinIO JavaScript SDK

SILO implements the S3-compatible server contract, so Node.js applications can use the upstream MinIO JavaScript SDK directly. Use a maintained Node.js release supported by the package version you select.

Install the package

npm install minio

The package includes TypeScript declarations; do not install the old @types/minio package.

Configure the connection

export S3_ENDPOINT=127.0.0.1
export S3_PORT=9000
export S3_ACCESS_KEY=silo-admin
export S3_SECRET_KEY=replace-with-a-strong-secret
export S3_USE_SSL=false

Keep credentials outside source control. Set S3_USE_SSL=true and use the TLS service port when connecting to a secured deployment.

Create a bucket and upload an object

Save the following as quickstart.mjs:

import * as Minio from 'minio'

const required = (name) => {
  const value = process.env[name]
  if (!value) throw new Error(`${name} is required`)
  return value
}

const client = new Minio.Client({
  endPoint: required('S3_ENDPOINT'),
  port: Number(process.env.S3_PORT || 9000),
  useSSL: process.env.S3_USE_SSL === 'true',
  accessKey: required('S3_ACCESS_KEY'),
  secretKey: required('S3_SECRET_KEY'),
})

const bucket = 'javascript-quickstart'
const objectName = 'hello.txt'

if (!(await client.bucketExists(bucket))) {
  await client.makeBucket(bucket, 'us-east-1')
}

await client.putObject(
  bucket,
  objectName,
  Buffer.from('hello from SILO\n'),
  { 'Content-Type': 'text/plain' },
)

const stat = await client.statObject(bucket, objectName)
console.log(`Uploaded ${objectName}: ${stat.size} bytes`)

Run it with:

node quickstart.mjs

Use the repository’s API reference and maintained examples for bucket policy, notifications, object lock, presigned URLs, multipart operations, and other APIs. Prefer directory-level links over copying assumptions about individual example filenames into long-lived documentation.

Production checklist

• Use TLS and verify the server certificate.
• Load credentials from a secret manager or protected environment.
• Grant the application only the bucket and object permissions it needs.
• Pin and test the SDK version, Node.js runtime, timeout behavior, and retry policy together.
• Handle streams, request errors, incomplete multipart uploads, and shutdown explicitly.

See Identity and Access Management for server-side policy configuration.

7 - Haskell Quickstart Guide

MinIO Haskell SDK

SILO implements the S3-compatible server contract, so Haskell applications can use the upstream minio-hs package directly.

Install the package

Add minio-hs to the build-depends section of your Cabal package or to the dependency list in package.yaml. For an interactive inspection of the installed API:

cabal repl

Then run :browse Network.Minio in GHCi.

Configure the connection

Version 1.7.0 provides fromMinioEnv, which reads the following credential variables:

export S3_ENDPOINT=http://127.0.0.1:9000
export MINIO_ACCESS_KEY=silo-admin
export MINIO_SECRET_KEY=replace-with-a-strong-secret

S3_ENDPOINT is a complete URL, including the http:// or https:// scheme. Keep credentials outside source control.

Create a bucket and upload an object

Save the following as Main.hs:

{-# LANGUAGE OverloadedStrings #-}

import Control.Monad (unless)
import Data.String (fromString)
import Network.Minio
import System.Environment (getEnv)

main :: IO ()
main = do
  endpoint <- getEnv "S3_ENDPOINT"
  connection <-
    setCredsFrom [fromMinioEnv] (fromString endpoint :: ConnectInfo)

  result <- runMinio connection $ do
    let bucket = "haskell-quickstart"
        object = "hello.txt"

    exists <- bucketExists bucket
    unless exists $ makeBucket bucket Nothing
    fPutObject bucket object "hello.txt" defaultPutObjectOptions

  case result of
    Left err -> putStrLn $ "Upload failed: " ++ show err
    Right () -> putStrLn "Uploaded hello.txt"

Create hello.txt, then run the program with the build tool and resolver selected for your project. The repository’s examples directory and API reference cover streaming, presigned URLs, encryption, notifications, object locking, and other operations.

Production checklist

• Use TLS and verify the server certificate; do not disable certificate validation.
• Load credentials from a secret manager or protected environment.
• Grant the application only the bucket and object permissions it needs.
• Pin and test the GHC, resolver, SDK, TLS, and HTTP dependency versions together.
• Define timeouts and handle MinioErr, retries, resource cleanup, and incomplete multipart uploads explicitly.

See Identity and Access Management for server-side policy configuration.

8 - Rust Quickstart Guide

MinIO Rust SDK

SILO implements the S3-compatible server contract, so Rust applications can use the upstream MinIO Rust SDK directly. The crate provides an asynchronous, strongly typed request-builder API.

Install the package

Add the SDK and Tokio runtime to Cargo.toml:

[dependencies]
minio = "0.4.0"
tokio = { version = "1", features = ["macros", "rt-multi-thread"] }

Configure the connection

export S3_ENDPOINT=http://127.0.0.1:9000
export S3_ACCESS_KEY=silo-admin
export S3_SECRET_KEY=replace-with-a-strong-secret

S3_ENDPOINT is a complete URL, including the http:// or https:// scheme. Keep credentials outside source control.

Create a bucket and upload an object

use minio::s3::builders::ObjectContent;
use minio::s3::creds::StaticProvider;
use minio::s3::http::BaseUrl;
use minio::s3::response::BucketExistsResponse;
use minio::s3::types::{BucketName, ObjectKey, S3Api};
use minio::s3::{MinioClient, MinioClientBuilder};
use std::env;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    let endpoint = env::var("S3_ENDPOINT")?;
    let access_key = env::var("S3_ACCESS_KEY")?;
    let secret_key = env::var("S3_SECRET_KEY")?;

    let base_url = endpoint.parse::<BaseUrl>()?;
    let provider = StaticProvider::new(&access_key, &secret_key, None);
    let client: MinioClient = MinioClientBuilder::new(base_url)
        .provider(Some(provider))
        .build()?;

    let bucket = BucketName::new("rust-quickstart")?;
    let object = ObjectKey::new("hello.txt")?;

    let exists: BucketExistsResponse = client
        .bucket_exists(bucket.clone())?
        .build()
        .send()
        .await?;

    if !exists.exists() {
        client
            .create_bucket(bucket.clone())?
            .build()
            .send()
            .await?;
    }

    client
        .put_object_content(
            bucket,
            object,
            ObjectContent::from("hello from SILO\n"),
        )?
        .build()
        .send()
        .await?;

    println!("Uploaded hello.txt");
    Ok(())
}

Run it with cargo run. The repository’s maintained examples and API documentation cover file uploads, streaming, encryption, notifications, object locking, and other operations.

Production checklist

• Use TLS and verify the server certificate.
• Load credentials from a secret manager or protected environment.
• Grant the application only the bucket and object permissions it needs.
• Pin and test the Rust toolchain, SDK, Tokio, HTTP, TLS, and crypto features together.
• Define timeouts and handle errors, retries, task cancellation, and incomplete multipart uploads explicitly.

See Identity and Access Management for server-side policy configuration.

9 - Software Development Kits (SDK)

MinIO publishes the following Software Development Kits (SDK):

• Go
• Python
• Java
• .NET
• JavaScript
• Haskell
• C++
• Rust

Go

GitHub: minio/minio-go

Latest Version: GOVERSION

Quickstart Guide: Go Quickstart Guide

Reference: MinIO Go SDK API

Download from GitHub

go get github.com/minio/minio-go/v7

Python

GitHub: minio/minio-py

Latest Version: PYTHONVERSION

Quickstart Guide: Python Quickstart Guide

Reference: MinIO Python SDK

Install Methods

• pip

  pip3 install minio

• source

  git clone https://github.com/minio/minio-py
  cd minio-py
  python setup.py install

Java

GitHub: minio/minio-java

Latest version: JAVAVERSION

Quickstart Guide: Java Quickstart Guide

Reference: MinIO Java SDK

Install methods

• Maven

  <dependency>
      <groupId>io.minio</groupId>
      <artifactId>minio</artifactId>
      <version>JAVAVERSION</version>
  </dependency>

• Gradle

  dependencies {
      implementation("io.minio:minio:JAVAVERSION")
  }

• JAR

  Download the latest JAR file for version JAVAVERSION of the SDK from the Sonatype Maven Central Repository.

.NET

GitHub: minio/minio-dotnet

Latest Version: DOTNETVERSION

Quickstart Guide: .NET Quickstart Guide

Reference: MinIO .NET SDK

Download from NuGet

Run the following command in the NuGet Package Manager Console.

PM> Install-Package Minio

JavaScript

GitHub: minio/minio-js

Latest Version: JAVASCRIPTVERSION

Quickstart Guide: JavaScript Quickstart Guide

Reference: MinIO JavaScript SDK

Install

• NPM

  npm install --save minio

• Source

  git clone https://github.com/minio/minio-js
  cd minio-js
  npm install
  npm install -g

Haskell

GitHub: minio/minio-hs

Latest Version: HASKELLVERSION

Quickstart Guide: Haskell Quickstart Guide

Install

Add minio-hs to your project’s .cabal dependencies section.

or

If you are using hpack, add minio-hs to your package.yaml file.

C++

GitHub: minio/minio-cpp

Reference: MinIO C++ SDK Reference

Install

• vcpkg

  vcpkg install minio-cpp

• Source

  git clone https://github.com/minio/minio-cpp
  cd minio-cpp
  wget --quiet -O vcpkg-master.zip https://github.com/microsoft/vcpkg/archive/refs/heads/master.zip
  unzip -qq vcpkg-master.zip
  ./vcpkg-master/bootstrap-vcpkg.sh
  ./vcpkg-master/vcpkg integrate install
  cmake -B ./build -DCMAKE_BUILD_TYPE=Debug -DCMAKE_TOOLCHAIN_FILE=./vcpkg-master/scripts/buildsystems/vcpkg.cmake
  cmake --build ./build --config Debug

Rust

GitHub: minio/minio-rs

Latest Version

RUSTVERSION

Reference: MinIO Rust SDK Reference

Quickstart Guide: Rust Quickstart Guide

10 - Security Token Service (STS)

The MinIO Security Token Service (STS) APIs allow applications to generate temporary credentials for accessing the MinIO deployment.

The STS API is required for MinIO deployments configured to use external identity managers, as the API allows conversion of the external IDP credentials into AWS Signature v4-compatible credentials.

STS API Endpoints

MinIO supports the following STS API endpoints:

10.1 - AssumeRoleWithCustomToken

The MinIO Security Token Service (STS) AssumeRoleWithCustomToken API endpoint generates a token for use with the MinIO External Identity Management Plugin.

Request Endpoint

The AssumeRoleWithCustomToken endpoint has the following form:

POST https://minio.example.net?Action=AssumeRoleWithCustomToken[&ARGS]

The following example uses all supported arguments. Replace the minio.example.net hostname with the appropriate URL for your MinIO cluster:

POST https://minio.example.net?Action=AssumeRoleWithCustomToken
&Token=TOKEN
&Version=2011-06-15
&DurationSeconds=86000
&RoleArn="external-auth-provider"

Request Query Parameters

This endpoint supports the following query parameters:

Response Elements

MinIO returns an AssumeRoleWithCustomTokenResult object, where the AssumedRoleUser.Credentials object contains the temporary credentials generated by MinIO:

• AccessKeyId - The access key applications use for authentication.
• SecretKeyId - The secret key applications use for authentication.
• Expiration - The RFC3339 date and time after which the credentials expire.
• SessionToken - The session token applications use for authentication. Some SDKs may require this field when using temporary credentials.

The following example is similar to the response returned by the MinIO STS AssumeRoleWithCustomToken endpoint:

<?xml version="1.0" encoding="UTF-8"?>
<AssumeRoleWithCustomTokenResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
<AssumeRoleWithCustomTokenResult>
   <Credentials>
      <AccessKeyId>ACCESS_KEY</AccessKeyId>
      <SecretAccessKey>SECRET_KEY</SecretAccessKey>
      <Expiration>YYYY-MM-DDTHH:MM:SSZ</Expiration>
      <SessionToken>TOKEN</SessionToken>
   </Credentials>
   <AssumedUser>custom:Alice</AssumedUser>
</AssumeRoleWithCustomTokenResult>
<ResponseMetadata>
   <RequestId>UNIQUE_ID</RequestId>
</ResponseMetadata>
</AssumeRoleWithCustomTokenResponse>

Error Elements

The XML error response for this API endpoint is similar to the AWS AssumeRoleWithWebIdentity response.

10.2 - AssumeRoleWithLDAPIdentity

The MinIO Security Token Service (STS) AssumeRoleWithLDAPIdentity API endpoint generates temporary access credentials using Active Directory or LDAP user credentials. This page documents the MinIO server AssumeRoleWithLDAPIdentity endpoint. For instructions on implementing STS using an S3-compatible SDK, defer to the documentation for that SDK.

The MinIO STS AssumeRoleWithLDAPIdentity API endpoint is modeled after the AWS AssumeRoleWithWebIdentity endpoint and shares certain request/response elements. This page documents the MinIO-specific syntax and links out to the AWS reference for all shared elements.

Request Endpoint

The AssumeRoleWithLDAPIdentity endpoint has the following form:

POST https://minio.example.net?Action=AssumeRoleWithLDAPIdentity[&ARGS]

The following example uses all supported arguments. Replace the minio.example.net hostname with the appropriate URL for your MinIO cluster:

POST https://minio.example.net?Action=AssumeRoleWithLDAPIdentity
&LDAPUsername=USERNAME
&LDAPPassword=PASSWORD
&Version=2011-06-15
&Policy={}

Request Query Parameters

This endpoint supports the following query parameters:

Response Elements

The XML response for this API endpoint is similar to the AWS AssumeRoleWithLDAPIdentity response. Specifically, MinIO returns an AssumeRoleWithLDAPIdentityResult object, where the AssumedRoleUser.Credentials object contains the temporary credentials generated by MinIO:

• AccessKeyId - The access key applications use for authentication.
• SecretKeyId - The secret key applications use for authentication.
• Expiration - The RFC3339 date and time after which the credentials expire.
• SessionToken - The session token applications use for authentication. Some SDKs may require this field when using temporary credentials.

The following example is similar to the response returned by the MinIO STS AssumeRoleWithLDAPIdentity endpoint:

<?xml version="1.0" encoding="UTF-8"?>
<AssumeRoleWithLDAPIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
<AssumeRoleWithLDAPIdentityResult>
   <AssumedRoleUser>
      <Arn/>
      <AssumeRoleId/>
   </AssumedRoleUser>
   <Credentials>
      <AccessKeyId>Y4RJU1RNFGK48LGO9I2S</AccessKeyId>
      <SecretAccessKey>sYLRKS1Z7hSjluf6gEbb9066hnx315wHTiACPAjg</SecretAccessKey>
      <Expiration>2019-08-08T20:26:12Z</Expiration>
      <SessionToken>eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJhY2Nlc3NLZXkiOiJZNFJKVTFSTkZHSzQ4TEdPOUkyUyIsImF1ZCI6IlBvRWdYUDZ1Vk80NUlzRU5SbmdEWGo1QXU1WWEiLCJhenAiOiJQb0VnWFA2dVZPNDVJc0VOUm5nRFhqNUF1NVlhIiwiZXhwIjoxNTQxODExMDcxLCJpYXQiOjE1NDE4MDc0NzEsImlzcyI6Imh0dHBzOi8vbG9jYWxob3N0Ojk0NDMvb2F1dGgyL3Rva2VuIiwianRpIjoiYTBiMjc2MjktZWUxYS00M2JmLTg3MzktZjMzNzRhNGNkYmMwIn0.ewHqKVFTaP-j_kgZrcOEKroNUjk10GEp8bqQjxBbYVovV0nHO985VnRESFbcT6XMDDKHZiWqN2vi_ETX_u3Q-w</SessionToken>
   </Credentials>
</AssumeRoleWithLDAPIdentityResult>
<ResponseMetadata/>
</AssumeRoleWithLDAPIdentityResponse>

Error Elements

The XML error response for this API endpoint is similar to the AWS AssumeRoleWithLDAPIdentity response.

10.3 - AssumeRoleWithWebIdentity

The MinIO Security Token Service (STS) AssumeRoleWithWebIdentity API endpoint generates temporary access credentials using a JSON Web Token (JWT) returned from a configured OpenID IDentity Provider (IDP). This page documents the MinIO server AssumeRoleWithWebIdentity endpoint. For instructions on implementing STS using an S3-compatible SDK, defer to the documentation for that SDK.

The MinIO STS AssumeRoleWithWebIdentity API endpoint is modeled after the AWS AssumeRoleWithWebIdentity endpoint and shares certain request/response elements. This page documents the MinIO-specific syntax and links out to the AWS reference for all shared elements.

Request Endpoint

The AssumeRoleWithWebIdentity endpoint has the following form:

POST https://minio.example.net?Action=AssumeRoleWithWebIdentity[&ARGS]

The following example uses all supported arguments. Replace the minio.example.net hostname with the appropriate URL for your MinIO cluster:

POST https://minio.example.net?Action=AssumeRoleWithWebIdentity
&WebIdentityToken=TOKEN
&Version=2011-06-15
&DurationSeconds=86000
&Policy={}

Request Query Parameters

This endpoint supports the following query parameters:

Response Elements

The XML response for this API endpoint is similar to the AWS AssumeRoleWithWebIdentity response. Specifically, MinIO returns an AssumeRoleWithWebIdentityResult object, where the AssumedRoleUser.Credentials object contains the temporary credentials generated by MinIO:

• AccessKeyId - The access key applications use for authentication.
• SecretKeyId - The secret key applications use for authentication.
• Expiration - The RFC3339 date and time after which the credentials expire.
• SessionToken - The session token applications use for authentication. Some SDKs may require this field when using temporary credentials.

The following example is similar to the response returned by the MinIO STS AssumeRoleWithWebIdentity endpoint:

<?xml version="1.0" encoding="UTF-8"?>
<AssumeRoleWithWebIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
<AssumeRoleWithWebIdentityResult>
   <AssumedRoleUser>
      <Arn/>
      <AssumeRoleId/>
   </AssumedRoleUser>
   <Credentials>
      <AccessKeyId>Y4RJU1RNFGK48LGO9I2S</AccessKeyId>
      <SecretAccessKey>sYLRKS1Z7hSjluf6gEbb9066hnx315wHTiACPAjg</SecretAccessKey>
      <Expiration>2019-08-08T20:26:12Z</Expiration>
      <SessionToken>eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJhY2Nlc3NLZXkiOiJZNFJKVTFSTkZHSzQ4TEdPOUkyUyIsImF1ZCI6IlBvRWdYUDZ1Vk80NUlzRU5SbmdEWGo1QXU1WWEiLCJhenAiOiJQb0VnWFA2dVZPNDVJc0VOUm5nRFhqNUF1NVlhIiwiZXhwIjoxNTQxODExMDcxLCJpYXQiOjE1NDE4MDc0NzEsImlzcyI6Imh0dHBzOi8vbG9jYWxob3N0Ojk0NDMvb2F1dGgyL3Rva2VuIiwianRpIjoiYTBiMjc2MjktZWUxYS00M2JmLTg3MzktZjMzNzRhNGNkYmMwIn0.ewHqKVFTaP-j_kgZrcOEKroNUjk10GEp8bqQjxBbYVovV0nHO985VnRESFbcT6XMDDKHZiWqN2vi_ETX_u3Q-w</SessionToken>
   </Credentials>
</AssumeRoleWithWebIdentityResult>
<ResponseMetadata/>
</AssumeRoleWithWebIdentityResponse>

Error Elements

The XML error response for this API endpoint is similar to the AWS AssumeRoleWithWebIdentity response.

11 - Transforms with Object Lambda

MinIO’s Object Lambda enables developers to programmatically transform objects on demand. You can transform objects as needed for your use case, such as redacting personally identifiable information (PII), enriching data with information from other sources, or converting between formats.

Overview

An Object Lambda handler is a small code module that transforms the contents of an object and returns the results. Like Amazon S3 Object Lambda functions, you trigger a MinIO Object Lambda handler function with a GET request from an application. The handler retrieves the requested object from MinIO, transforms it, and returns the modified data back to MinIO to send to the original application. The original object remains unchanged.

Each handler is an independent process, and multiple handlers can transform the same data. This allows you to use the same object for different purposes without maintaining different versions of the original.

Object Lambda Handlers

You can write a handler function in any language capable of sending and receiving HTTP requests. It must be able to:

• Listen for an HTTP POST request.
• Retrieve the original object using a URL.
• Return the transformed contents and authorization tokens.

Create a Function

A handler function should perform the following steps:

1. Extract the object details from the incoming POST request.

   The getObjectContext property of the JSON request payload contains details about the original object. To construct the response, you need the following values:

   Value	Description
   inputS3Url	A presigned URL for the original object. The calling application generates the URL and sends it in the original request. This allows the handler to access the original object without the MinIO credentials usually required. The URL is valid for one hour.
   outputRoute	A token that allows MinIO to validate the destination for the transformed object. Return this value with the response in an x-amz-request-route header.
   outputToken	A token that allows MinIO to validate the response. Return this value in the response in an x-amz-request-token header.

2. Retrieve the original object from MinIO.

   Use the presigned URL to retrieve the object from the MinIO deployment. The contents of the object are in the body of the response.

3. Transform the object as desired.

   Perform any operations needed to generate a transformed object. Since the calling application is waiting for a response, you may wish to avoid potentially long running operations.

4. Construct a response containing the following information:

   • The transformed object contents.
   • An x-amz-request-route header with the outputRoute token.
   • An x-amz-request-token header with the outputToken token.

5. Return the response back to Object Lambda.

   MinIO validates the response and sends the transformed data back to the original calling application.

Register the Handler

To enable MinIO to call the handler, register the handler function as a webhook with the following MinIO server Object Lambda environment variables:

MINIO_LAMBDA_WEBHOOK_ENABLE_functionname

Enable or disable Object Lambda for a handler function. For multiple handlers, set this environment variable for each function name.

MINIO_LAMBDA_WEBHOOK_ENDPOINT_functionname

Register an endpoint for a handler function. For multiple handlers, set this environment variable for each function endpoint.

MinIO also supports the following environment variables for authenticated webhook endpoints:

MINIO_LAMBDA_WEBHOOK_AUTH_TOKEN_functionanme

Specify the opaque string or JWT authorization token for authenticating to the webhook.

MINIO_LAMBDA_WEBHOOK_CLIENT_CERT_functionname

Specify the client certificate to use for mTLS authentication to the webhook.

MINIO_LAMBDA_WEBHOOK_CLIENT_KEY_functionname

Specify the private key to use for mTLS authentication to the webhook.

Restart MinIO to apply the changes.

Alternatively, configure Object Lambda with the MinIO Client command line tool. For more information, see Object Lambda function settings.

Trigger From an Application

To request a transformed object from your application:

1. Connect to the MinIO deployment.

2. Set the Object Lambda target by adding a lambdaArn parameter with the ARN of the desired handler.

3. Generate a presigned URL for the original object.

4. Use the generated URL to retrieve the transformed object.

   MinIO sends the request to the target Object Lambda handler. The handler returns the transformed contents back to MinIO, which validates the response and sends it back to the application.

Example

Transform the contents of an object using Python, Go, and curl:

• Create and register an Object Lambda handler.
• Create a bucket and an object to transform.
• Request and display the transformed object contents.

Prerequisites:

• An existing MinIO deployment
• Working Python (3.8+) and Golang development environments
• The MinIO Go SDK

Create a Handler

The sample handler, written in Python, retrieves the target object using a presigned URL generated by the caller. The handler then transforms the object’s contents and returns the new text. It uses the Flask web framework and Python 3.8+.

The following command installs Flask and other needed dependencies:

pip install flask requests

The handler calls swapcase() to change the case of each letter in the original text. It then sends the results back to MinIO, which returns it to the caller.

from flask import Flask, request, abort, make_response
import requests

app = Flask(__name__)
@app.route('/', methods=['POST'])
def get_webhook():
   if request.method == 'POST':
      # Get the request event from the 'POST' call
      event = request.json

      # Get the object context
      object_context = event["getObjectContext"]

      # Get the presigned URL
      # Used to fetch the original object from MinIO
      s3_url = object_context["inputS3Url"]

      # Extract the route and request tokens from the input context
      request_route = object_context["outputRoute"]
      request_token = object_context["outputToken"]

      # Get the original S3 object using the presigned URL
      r = requests.get(s3_url)
      original_object = r.content.decode('utf-8')

      # Transform the text in the object by swapping the case of each char
      transformed_object = original_object.swapcase()

      # Return the object back to Object Lambda, with required headers
      # This sends the transformed data to MinIO
      # and then to the user
      resp = make_response(transformed_object, 200)
      resp.headers['x-amz-request-route'] = request_route
      resp.headers['x-amz-request-token'] = request_token
      return resp

   else:
      abort(400)

if __name__ == '__main__':
   app.run()

Start the Handler

Use the following command to start the handler in your local development environment:

python lambda_handler.py

The output resembles the following:

 * Serving Flask app 'lambda_handler'
 * Debug mode: off
WARNING: This is a development server. Do not use it in a production deployment. Use a production WSGI server instead.
 * Running on http://127.0.0.1:5000
Press CTRL+C to quit

Start MinIO

Once the handler is running, start MinIO with the MINIO_LAMBDA_WEBHOOK_ENABLE and MINIO_LAMBDA_WEBHOOK_ENDPOINT environment variables to register the function with MinIO. To identify the specific Object Lambda handler, append the name of the function to the name of the environment variable.

The following command starts MinIO in your local development environment:

MINIO_LAMBDA_WEBHOOK_ENABLE_myfunction=on MINIO_LAMBDA_WEBHOOK_ENDPOINT_myfunction=http://localhost:5000 minio server /data

Replace myfunction with the name of your handler function and /data with the location of the MinIO directory for your local deployment. The output resembles the following:

MinIO Object Storage Server
Copyright: 2015-2023 MinIO, Inc.
License: GNU AGPLv3 <https://www.gnu.org/licenses/agpl-3.0.html>
Version: RELEASE.2023-03-24T21-41-23Z (go1.19.7 linux/arm64)

Status:         1 Online, 0 Offline.
API: http://192.168.64.21:9000  http://127.0.0.1:9000
RootUser: minioadmin
RootPass: minioadmin
Object Lambda ARNs: arn:minio:s3-object-lambda::myfunction:webhook

Test the Handler

To test the Lambda handler function, first create an object to transform. Then invoke the handler, in this case with curl, using the presigned URL from a Go function.

1. Create a bucket and object for the handler to transform.

   mc alias set myminio/ http://localhost:9000 minioadmin minioadmin
   mc mb myminio/myfunctionbucket
   cat > testobject << EOF
   Hello, World!
   EOF
   mc cp testobject myminio/myfunctionbucket/

2. Invoke the Handler

   The following Go code uses the The MinIO Go SDK to generate a presigned URL and print it to stdout.

   package main
   
   import (
      "context"
      "log"
      "net/url"
      "time"
      "fmt"
   
      "github.com/minio/minio-go/v7"
      "github.com/minio/minio-go/v7/pkg/credentials"
   )
   
   func main() {
   
      // Connect to the MinIO deployment
      s3Client, err := minio.New("localhost:9000", &minio.Options{
         Creds:  credentials.NewStaticV4("my_admin_user", "my_admin_password", ""),
         Secure: false,
      })
      if err != nil {
         log.Fatalln(err)
      }
   
      // Set the Lambda function target using its ARN
      reqParams := make(url.Values)
      reqParams.Set("lambdaArn", "arn:minio:s3-object-lambda::myfunction:webhook")
   
      // Generate a presigned url to access the original object
      presignedURL, err := s3Client.PresignedGetObject(context.Background(), "myfunctionbucket", "testobject", time.Duration(1000)*time.Second, reqParams)
      if err != nil {
         log.Fatalln(err)
      }
   
      // Print the URL to stdout
      fmt.Println(presignedURL)
   }

   In the code above, replace the following values:

   • Replace my_admin_user and my_admin_password with user credentials for a MinIO deployment.
   • Replace myfunction with the same function name set in the MINIO_LAMBDA_WEBHOOK_ENABLE and MINIO_LAMBDA_WEBHOOK_ENDPOINT environment variables.

   To retrieve the transformed object, execute the Go code with curl to generate a GET request:

   curl -v $(go run presigned.go)

   curl runs the Go code and then retrieves the object with a GET request to the presigned URL. The output resembles the following:

   *   Trying 127.0.0.1:9000...
   * Connected to localhost (127.0.0.1) port 9000 (#0)
   > GET /myfunctionbucket/testobject?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=minioadmin%2F20230406%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20230406T184749Z&X-Amz-Expires=1000&X-Amz-SignedHeaders=host&lambdaArn=arn%3Aminio%3As3-object-lambda%3A%3Amyfunction%3Awebhook&X-Amz-Signature=68fe7e03929a7c0da38255121b2ae09c302840c06654d1b79d7907d942f69915 HTTP/1.1
   > Host: localhost:9000
   > User-Agent: curl/7.81.0
   > Accept: */*
   >
   * Mark bundle as not supporting multiuse
   < HTTP/1.1 200 OK
   < Content-Security-Policy: block-all-mixed-content
   < Strict-Transport-Security: max-age=31536000; includeSubDomains
   < Vary: Origin
   < Vary: Accept-Encoding
   < X-Amz-Id-2: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
   < X-Amz-Request-Id: 17536CF16130630E
   < X-Content-Type-Options: nosniff
   < X-Xss-Protection: 1; mode=block
   < Date: Thu, 06 Apr 2023 18:47:49 GMT
   < Content-Length: 14
   < Content-Type: text/plain; charset=utf-8
   <
   hELLO, wORLD!
   * Connection #0 to host localhost left intact

12 - File Transfer Protocol (FTP/SFTP)

• File Transport Using FTP and SFTP with MinIO

Supported Protocols

Supported Commands

When enabled, MinIO supports the following SFTP operations:

• get
• put
• ls
• mkdir
• rmdir
• delete

MinIO does not support either append or rename operations.

Considerations

Versioning

SFTP clients can only operate on the latest version of an object. Specifically:

• For read operations, MinIO only returns the latest version of the requested object(s) to the SFTP client.
• For write operations, MinIO applies normal versioning behavior and creates a new object version at the specified namespace. rm and rmdir operations create DeleteMarker objects.

Authentication and Access

SFTP access requires the same authentication as any other S3 client. MinIO supports the following authentication providers:

• MinIO IDP users and their service accounts
• Active Directory/LDAP users and their service accounts
• OpenID/OIDC service accounts

STS credentials cannot access buckets or objects over SFTP.

Authenticated users can access buckets and objects based on the policies assigned to the user or parent user account.

The SFTP protocol does not require any of the admin:* permissions. You may not perform other MinIO admin actions with SFTP.

Prerequisites

Procedure

kubectl get tenants/my-tenant -n my-tenant-ns -o yaml | yq '.spec.features'

enableSFTP: true

minio server http://server{1...4}/disk{1...4} \
--ftp="address=:8021"                         \
--ftp="passive-port-range=30000-40000"        \
--ftp="tls-private-key=path/to/private.key"   \
--ftp="tls-public-cert=path/to/public.crt"    \
...

minio server http://server{1...4}/disk{1...4}        \
--ftp="address=:8021"                                \
--ftp="passive-port-range=30000-40000"               \
--sftp="address=:8022"                               \
--sftp="ssh-private-key=/home/miniouser/.ssh/id_rsa" \
...

MinIO FTP Server listening on :8021
MinIO SFTP Server listening on :8022

> sftp -P 8022 minio@localhost
minio@localhost's password:
Connected to localhost.
sftp> ls runner/
chunkdocs  testdir

> ftp localhost -P 8021
Connected to localhost.
220 Welcome to MinIO FTP Server
Name (localhost:user): minio
331 User name ok, password required
Password:
230 Password ok, continue
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls runner/
229 Entering Extended Passive Mode (|||39155|)
150 Opening ASCII mode data connection for file list
drwxrwxrwx 1 nobody nobody            0 Jan  1 00:00 chunkdocs/
drwxrwxrwx 1 nobody nobody            0 Jan  1 00:00 testdir/
...

> sftp -P 8022 minio@localhost
minio@localhost's password:
Connected to localhost.
sftp> ls runner/
chunkdocs  testdir
sftp> get runner/chunkdocs/metadata metadata
Fetching /runner/chunkdocs/metadata to metadata
metadata                               100%  226    16.6KB/s   00:00
sftp>

> ftp localhost -P 8021
Connected to localhost.
220 Welcome to MinIO FTP Server
Name (localhost:user): minio
331 User name ok, password required
Password:
230 Password ok, continue
Remote system type is UNIX.
Using binary mode to transfer files.ftp> ls runner/chunkdocs/metadata
229 Entering Extended Passive Mode (|||44269|)
150 Opening ASCII mode data connection for file list
-rwxrwxrwx 1 nobody nobody           45 Apr  1 06:13 chunkdocs/metadata
226 Closing data connection, sent 75 bytes
ftp> get
(remote-file) runner/chunkdocs/metadata
(local-file) test
local: test remote: runner/chunkdocs/metadata
229 Entering Extended Passive Mode (|||37785|)
150 Data transfer starting 45 bytes
   45        3.58 KiB/s
226 Closing data connection, sent 45 bytes
45 bytes received in 00:00 (3.55 KiB/s)
...