chore(compose): run RustFS as the object storage of the stacks (#620)

.env.sample

@@ -74,7 +74,7 @@ XTM_ONE_SECRET_KEY=ChangeMeWithGeneratedRandomString
 # Credentials for the dedicated pgsql-xtm-one Postgres instance.
 XTM_ONE_POSTGRES_USER=xtmone
 XTM_ONE_POSTGRES_PASSWORD=ChangeMe
-# Optional: bucket name in the shared S3 object storage (Silo, auto-created on first boot)
+# Optional: bucket name in the shared S3 object storage (RustFS, auto-created on first boot)
 XTM_ONE_S3_BUCKET=xtm-one-files
 # Optional: enterprise license PEM (leave empty in xtm_one mode)
 XTM_ONE_ENTERPRISE_LICENSE=

README.md

@@ -4,6 +4,14 @@
 
 You can find the detailed documentation about the Docker installation in the [OpenCTI documentation space](https://docs.opencti.io/latest/deployment/installation/#using-docker).
 
+## Object storage
+
+The `minio` service runs [RustFS](https://rustfs.com), an open source (Apache 2.0) S3-compatible object storage. The service name, the `s3data` volume and the `MINIO_ROOT_USER` / `MINIO_ROOT_PASSWORD` variables keep their former names, so the OpenCTI and XTM One settings do not change.
+
+Upgrading a stack that ran MinIO or Silo: RustFS does not start on an `s3data` volume written by MinIO or Silo (`Permission denied`: that volume belongs to root, RustFS runs as uid 10001). Back up the volume and follow the migration guide listed in the [breaking changes of the OpenCTI documentation](https://docs.opencti.io/latest/deployment/breaking-changes/) before starting the stack with the new compose file. Its first steps run with the previous compose file: if you update this clone with `git pull`, run them before the pull.
+
+Development stack (`docker-compose.dev.yml`): `opencti-dev-minio` now keeps its data in the named volume `rustfsdata`, which starts empty. Files stored by the previous Silo container stay in its anonymous volume and are not carried over.
+
 ## XTM One
 
 This stack bundles [XTM One](https://filigran.io), Filigran's AI-powered assistant, alongside OpenCTI. The following services are started by default:

docker-compose.dev.yml

@@ -36,14 +36,21 @@ services:
       - opencti-dev-elasticsearch
   opencti-dev-minio:
     container_name: opencti-dev-minio
-    image: pgsty/silo:latest
+    image: rustfs/rustfs:1.0.4
     ports:
       - "9000:9000"
       - "9001:9001"
     environment:
-      MINIO_ROOT_USER: ${MINIO_ROOT_USER}
-      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
-    command: server /data --console-address ":9001"
+      RUSTFS_ACCESS_KEY: ${MINIO_ROOT_USER}
+      RUSTFS_SECRET_KEY: ${MINIO_ROOT_PASSWORD}
+      RUSTFS_CONSOLE_ENABLE: "true"
+      RUSTFS_CONSOLE_ADDRESS: ":9001"
+      RUSTFS_OBS_LOG_DIRECTORY: "" # logs to stdout instead of /logs
+      RUSTFS_CHECK_UPDATE: "false" # no call to version.rustfs.com at each start
+    volumes:
+      # Named volume: the anonymous /data volume of a previous MinIO or Silo container is owned by root,
+      # and RustFS (uid 10001) cannot start on it
+      - rustfsdata:/data
     restart: unless-stopped
   opencti-dev-rabbitmq:
     container_name: opencti-dev-rabbitmq
@@ -56,3 +63,6 @@ services:
     ports:
       - "5672:5672"
       - "15672:15672"
+
+volumes:
+  rustfsdata:

docker-compose.opensearch.yml

@@ -54,21 +54,23 @@ services:
       timeout: 10s
       retries: 50
   minio:
-    image: pgsty/silo:latest
+    image: rustfs/rustfs:1.0.4
     volumes:
       - s3data:/data
     ports:
       - "9000:9000"
     environment:
-      MINIO_ROOT_USER: ${MINIO_ROOT_USER}
-      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
-    command: server /data
+      RUSTFS_ACCESS_KEY: ${MINIO_ROOT_USER}
+      RUSTFS_SECRET_KEY: ${MINIO_ROOT_PASSWORD}
+      RUSTFS_OBS_LOG_DIRECTORY: "" # logs to stdout (docker logs) instead of files inside the container
+      RUSTFS_CHECK_UPDATE: "false" # no call to version.rustfs.com at each start
     restart: always
     healthcheck:
-      test: ["CMD", "mc", "ready", "local"]
+      test: ["CMD", "curl", "-f", "http://localhost:9000/health/ready"]
       interval: 10s
       timeout: 5s
       retries: 3
+      start_period: 60s
   rabbitmq:
     image: rabbitmq:4.3-management
     environment:

docker-compose.yml

@@ -70,21 +70,23 @@ services:
       timeout: 5s
       retries: 5
   minio:
-    image: pgsty/silo:latest
+    image: rustfs/rustfs:1.0.4
     volumes:
       - s3data:/data
     ports:
       - "9000:9000"
     environment:
-      MINIO_ROOT_USER: ${MINIO_ROOT_USER}
-      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}    
-    command: server /data
+      RUSTFS_ACCESS_KEY: ${MINIO_ROOT_USER}
+      RUSTFS_SECRET_KEY: ${MINIO_ROOT_PASSWORD}
+      RUSTFS_OBS_LOG_DIRECTORY: "" # logs to stdout (docker logs) instead of files inside the container
+      RUSTFS_CHECK_UPDATE: "false" # no call to version.rustfs.com at each start
     restart: always
     healthcheck:
-      test: ["CMD", "mc", "ready", "local"]
+      test: ["CMD", "curl", "-f", "http://localhost:9000/health/ready"]
       interval: 10s
       timeout: 5s
       retries: 3
+      start_period: 60s
   rabbitmq:
     image: rabbitmq:4.3-management
     environment: