From eed0e3dae31a55989d7697ebd1aee969ecb83db0 Mon Sep 17 00:00:00 2001 From: Olivier Sotin Date: Thu, 29 Oct 2026 21:30:11 +0100 Subject: [PATCH 1/3] chore(compose): run RustFS as object storage (#620) --- .env.sample | 2 +- README.md | 6 ++++++ docker-compose.dev.yml | 17 +++++++++++++---- docker-compose.opensearch.yml | 10 +++++----- docker-compose.yml | 10 +++++----- 5 files changed, 30 insertions(+), 15 deletions(-) diff --git a/.env.sample b/.env.sample index 302c1481..ed31be0c 100644 --- a/.env.sample +++ b/.env.sample @@ -74,7 +74,7 @@ XTM_ONE_SECRET_KEY=ChangeMeWithGeneratedRandomString # Credentials for the dedicated pgsql-xtm-one Postgres instance. XTM_ONE_POSTGRES_USER=xtmone XTM_ONE_POSTGRES_PASSWORD=ChangeMe -# Optional: bucket name in the shared S3 object storage (Silo, auto-created on first boot) +# Optional: bucket name in the shared S3 object storage (RustFS, auto-created on first boot) XTM_ONE_S3_BUCKET=xtm-one-files # Optional: enterprise license PEM (leave empty in xtm_one mode) XTM_ONE_ENTERPRISE_LICENSE= diff --git a/README.md b/README.md index 8184e2e6..13b3c198 100644 --- a/README.md +++ b/README.md @@ -4,6 +4,12 @@ You can find the detailed documentation about the Docker installation in the [OpenCTI documentation space](https://docs.opencti.io/latest/deployment/installation/#using-docker). +## Object storage + +The `minio` service runs [RustFS](https://rustfs.com), an open source (Apache 2.0) S3-compatible object storage. The service name, the `s3data` volume and the `MINIO_ROOT_USER` / `MINIO_ROOT_PASSWORD` variables keep their former names, so the OpenCTI and XTM One settings do not change. + +Upgrading a stack that ran MinIO or Silo: RustFS does not start on the existing `s3data` volume as it is (`Permission denied`: the volume belongs to root, RustFS runs as uid 10001). Back up the volume and follow the migration guide listed in the [breaking changes of the OpenCTI documentation](https://docs.opencti.io/latest/deployment/breaking-changes/) before running `docker compose up -d`. + ## XTM One This stack bundles [XTM One](https://filigran.io), Filigran's AI-powered assistant, alongside OpenCTI. The following services are started by default: diff --git a/docker-compose.dev.yml b/docker-compose.dev.yml index 56a3207d..8848a65a 100644 --- a/docker-compose.dev.yml +++ b/docker-compose.dev.yml @@ -36,14 +36,20 @@ services: - opencti-dev-elasticsearch opencti-dev-minio: container_name: opencti-dev-minio - image: pgsty/silo:latest + image: rustfs/rustfs:1.0.4 ports: - "9000:9000" - "9001:9001" environment: - MINIO_ROOT_USER: ${MINIO_ROOT_USER} - MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD} - command: server /data --console-address ":9001" + RUSTFS_ACCESS_KEY: ${MINIO_ROOT_USER} + RUSTFS_SECRET_KEY: ${MINIO_ROOT_PASSWORD} + RUSTFS_CONSOLE_ENABLE: "true" + RUSTFS_CONSOLE_ADDRESS: ":9001" + RUSTFS_OBS_LOG_DIRECTORY: "" # logs to stdout instead of /logs + volumes: + # Named volume: the anonymous /data volume of a previous MinIO or Silo container is owned by root, + # and RustFS (uid 10001) cannot start on it + - rustfsdata:/data restart: unless-stopped opencti-dev-rabbitmq: container_name: opencti-dev-rabbitmq @@ -56,3 +62,6 @@ services: ports: - "5672:5672" - "15672:15672" + +volumes: + rustfsdata: diff --git a/docker-compose.opensearch.yml b/docker-compose.opensearch.yml index 87d5ae81..f9f30aea 100644 --- a/docker-compose.opensearch.yml +++ b/docker-compose.opensearch.yml @@ -54,18 +54,18 @@ services: timeout: 10s retries: 50 minio: - image: pgsty/silo:latest + image: rustfs/rustfs:1.0.4 volumes: - s3data:/data ports: - "9000:9000" environment: - MINIO_ROOT_USER: ${MINIO_ROOT_USER} - MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD} - command: server /data + RUSTFS_ACCESS_KEY: ${MINIO_ROOT_USER} + RUSTFS_SECRET_KEY: ${MINIO_ROOT_PASSWORD} + RUSTFS_OBS_LOG_DIRECTORY: "" # logs to stdout (docker logs) instead of files inside the container restart: always healthcheck: - test: ["CMD", "mc", "ready", "local"] + test: ["CMD", "curl", "-f", "http://localhost:9000/health/ready"] interval: 10s timeout: 5s retries: 3 diff --git a/docker-compose.yml b/docker-compose.yml index d055f43c..b102dd18 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -70,18 +70,18 @@ services: timeout: 5s retries: 5 minio: - image: pgsty/silo:latest + image: rustfs/rustfs:1.0.4 volumes: - s3data:/data ports: - "9000:9000" environment: - MINIO_ROOT_USER: ${MINIO_ROOT_USER} - MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD} - command: server /data + RUSTFS_ACCESS_KEY: ${MINIO_ROOT_USER} + RUSTFS_SECRET_KEY: ${MINIO_ROOT_PASSWORD} + RUSTFS_OBS_LOG_DIRECTORY: "" # logs to stdout (docker logs) instead of files inside the container restart: always healthcheck: - test: ["CMD", "mc", "ready", "local"] + test: ["CMD", "curl", "-f", "http://localhost:9000/health/ready"] interval: 10s timeout: 5s retries: 3 From 28168f90710b37b1bec7b3ad97015a6b4d3094b2 Mon Sep 17 00:00:00 2001 From: Olivier Sotin Date: Fri, 30 Oct 2026 16:34:21 +0100 Subject: [PATCH 2/3] chore(compose): add start period and upgrade notes (#620) --- README.md | 4 +++- docker-compose.opensearch.yml | 1 + docker-compose.yml | 1 + 3 files changed, 5 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 13b3c198..3c67be47 100644 --- a/README.md +++ b/README.md @@ -8,7 +8,9 @@ You can find the detailed documentation about the Docker installation in the [Op The `minio` service runs [RustFS](https://rustfs.com), an open source (Apache 2.0) S3-compatible object storage. The service name, the `s3data` volume and the `MINIO_ROOT_USER` / `MINIO_ROOT_PASSWORD` variables keep their former names, so the OpenCTI and XTM One settings do not change. -Upgrading a stack that ran MinIO or Silo: RustFS does not start on the existing `s3data` volume as it is (`Permission denied`: the volume belongs to root, RustFS runs as uid 10001). Back up the volume and follow the migration guide listed in the [breaking changes of the OpenCTI documentation](https://docs.opencti.io/latest/deployment/breaking-changes/) before running `docker compose up -d`. +Upgrading a stack that ran MinIO or Silo: RustFS does not start on an `s3data` volume written by MinIO or Silo (`Permission denied`: that volume belongs to root, RustFS runs as uid 10001). Back up the volume and follow the migration guide listed in the [breaking changes of the OpenCTI documentation](https://docs.opencti.io/latest/deployment/breaking-changes/) before starting the stack with the new compose file. Its first steps run with the previous compose file: if you update this clone with `git pull`, run them before the pull. + +Development stack (`docker-compose.dev.yml`): `opencti-dev-minio` now keeps its data in the named volume `rustfsdata`, which starts empty. Files stored by the previous Silo container stay in its anonymous volume and are not carried over. ## XTM One diff --git a/docker-compose.opensearch.yml b/docker-compose.opensearch.yml index f9f30aea..bba795d8 100644 --- a/docker-compose.opensearch.yml +++ b/docker-compose.opensearch.yml @@ -69,6 +69,7 @@ services: interval: 10s timeout: 5s retries: 3 + start_period: 60s rabbitmq: image: rabbitmq:4.3-management environment: diff --git a/docker-compose.yml b/docker-compose.yml index b102dd18..8d4cee0f 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -85,6 +85,7 @@ services: interval: 10s timeout: 5s retries: 3 + start_period: 60s rabbitmq: image: rabbitmq:4.3-management environment: From a5c6b1927fb0278a66dcb984f1eccaf62f9cd0bf Mon Sep 17 00:00:00 2001 From: Olivier Sotin Date: Mon, 2 Nov 2026 21:20:00 +0100 Subject: [PATCH 3/3] chore(compose): disable the RustFS update check (#620) --- docker-compose.dev.yml | 1 + docker-compose.opensearch.yml | 1 + docker-compose.yml | 1 + 3 files changed, 3 insertions(+) diff --git a/docker-compose.dev.yml b/docker-compose.dev.yml index 8848a65a..1368f04b 100644 --- a/docker-compose.dev.yml +++ b/docker-compose.dev.yml @@ -46,6 +46,7 @@ services: RUSTFS_CONSOLE_ENABLE: "true" RUSTFS_CONSOLE_ADDRESS: ":9001" RUSTFS_OBS_LOG_DIRECTORY: "" # logs to stdout instead of /logs + RUSTFS_CHECK_UPDATE: "false" # no call to version.rustfs.com at each start volumes: # Named volume: the anonymous /data volume of a previous MinIO or Silo container is owned by root, # and RustFS (uid 10001) cannot start on it diff --git a/docker-compose.opensearch.yml b/docker-compose.opensearch.yml index bba795d8..2e109b2e 100644 --- a/docker-compose.opensearch.yml +++ b/docker-compose.opensearch.yml @@ -63,6 +63,7 @@ services: RUSTFS_ACCESS_KEY: ${MINIO_ROOT_USER} RUSTFS_SECRET_KEY: ${MINIO_ROOT_PASSWORD} RUSTFS_OBS_LOG_DIRECTORY: "" # logs to stdout (docker logs) instead of files inside the container + RUSTFS_CHECK_UPDATE: "false" # no call to version.rustfs.com at each start restart: always healthcheck: test: ["CMD", "curl", "-f", "http://localhost:9000/health/ready"] diff --git a/docker-compose.yml b/docker-compose.yml index 8d4cee0f..cb28e9fd 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -79,6 +79,7 @@ services: RUSTFS_ACCESS_KEY: ${MINIO_ROOT_USER} RUSTFS_SECRET_KEY: ${MINIO_ROOT_PASSWORD} RUSTFS_OBS_LOG_DIRECTORY: "" # logs to stdout (docker logs) instead of files inside the container + RUSTFS_CHECK_UPDATE: "false" # no call to version.rustfs.com at each start restart: always healthcheck: test: ["CMD", "curl", "-f", "http://localhost:9000/health/ready"]