Stop paying unpredictable egress fees! Here is how to host your own scalable, high-performance object storage for AI, RAG, and enterprise workloads.
While storing data in public cloud object storage is relatively inexpensive, data transfer, cross-region traffic, and internet egress charges can become a massive burden as workloads grow. With the continuous rise of AI datasets, LLM training, RAG pipelines, and Kubernetes clusters in 2026, many organizations are realizing the cost-efficiency of moving their large datasets back to private infrastructure.
The solution? Self-hosted Object Storage.
By running MinIO on a dedicated server, you get full Amazon S3-compatible API support for the vast majority of applications—without the unpredictable egress fees.
In this guide, we will walk you through deploying a secure MinIO server on Ubuntu 24.04 that provides a solid foundation for production deployments.
🛠️ Prerequisites
Before getting our hands dirty with the terminal, ensure you have:
A Linux storage server running Ubuntu 24.04 (Need powerful bare-metal? Check out Servers99).
sudo privileges.
A registered domain name (optional, but highly recommended for production HTTPS).
Update your system first to ensure all packages are current:
sudo apt update && sudo apt upgrade -y
Step 1: Download and Install MinIO
MinIO is shipped as a single binary, making installation incredibly simple. Download the latest 64-bit Linux executable:
wget https://dl.min.io/server/minio/release/linux-amd64/minio
Make the downloaded file executable and move it to your system’s binaries directory so it can be run globally:
chmod +x minio
sudo mv minio /usr/local/bin/
Step 2: Create a Secure User and Directory
Running services as the root user is a major security risk. We will create a dedicated system user with no login privileges, along with a secure directory for your data.
sudo groupadd -r minio-user
sudo useradd -r -s /usr/sbin/nologin -g minio-user minio-user
Create the data directory (e.g., /mnt/data) and set strict permissions:
sudo mkdir -p /mnt/data
sudo chown -R minio-user:minio-user /mnt/data
sudo chmod 750 /mnt/data
Step 3: Configure the UFW Firewall
MinIO uses port 9000 for the S3-compatible API and port 9001 for the Web Console. If you are using UFW (Uncomplicated Firewall), allow these ports before starting the service:
sudo ufw allow 9000/tcp
sudo ufw allow 9001/tcp
sudo ufw reload
Step 4: Create the Systemd Service
To manage MinIO like a standard background service, create a systemd configuration file:
sudo nano /etc/systemd/system/minio.service
Paste the following configuration.
⚠️ Security Warning: Replace the MINIO_ROOT_PASSWORD with a long, random password generated by a password manager. Do not use default or weak passwords!
[Unit]
Description=MinIO High Performance Object Storage
Documentation=https://docs.min.io
Wants=network-online.target
After=network-online.target
[Service]
User=minio-user
Group=minio-user
WorkingDirectory=/mnt/data
# Environment Variables for easy configuration
Environment="MINIO_VOLUMES=/mnt/data"
Environment="MINIO_OPTS=--console-address :9001"
Environment="MINIO_ROOT_USER=admin"
Environment="MINIO_ROOT_PASSWORD=ReplaceWithYourSecurePassword!"
ExecStart=/usr/local/bin/minio server $MINIO_VOLUMES $MINIO_OPTS
Restart=always
RestartSec=5
# Security restrictions
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
AmbientCapabilities=CAP_NET_BIND_SERVICE
NoNewPrivileges=true
[Install]
WantedBy=multi-user.target
Save and exit (Ctrl+O, Enter, Ctrl+X).
Step 5: Start and Verify the Service
Reload systemd to detect the new service, then start and enable MinIO to launch on boot:
sudo systemctl daemon-reload
sudo systemctl start minio
sudo systemctl enable minio
Check if the service is running without errors:
sudo systemctl status minio
To confirm that MinIO is actively listening on the correct ports (9000 and 9001), run:
sudo ss -tulpn | grep minio
Step 6: Access the MinIO Console & Set Policies
Now for the fun part!
- Open your web browser and navigate to:
http://YOUR_SERVER_IP:9001(Note: Use 9001 for the console). - Log in with your configured Root User and Password.
- Go to Buckets -> Create a Bucket.
- Access Control: By default, buckets are Private. In the console, you can configure Anonymous Rules (if you want public read access for assets) or generate Access Keys (for your applications to connect securely).
Step 7: Install the MinIO Client (mc)
For command-line management, the MinIO Client (mc) is an essential tool. It functions as a modern alternative to UNIX commands like ls, cat, and cp.
Install it using:
wget https://dl.min.io/client/mc/release/linux-amd64/mc
chmod +x mc
sudo mv mc /usr/local/bin/
Connect mc to your new local MinIO server:
mc alias set local_s3 http://127.0.0.1:9000 admin ReplaceWithYourSecurePassword!
Now you can list your buckets or create a new one directly from the terminal:
mc ls local_s3
mc mb local_s3/my-new-bucket
🔒 Production and Security Best Practices
If you are using this MinIO setup for production data, please implement the following before going live:
- Enable HTTPS (SSL): Never send API requests in plain text over the public internet. Use a reverse proxy like Nginx, Caddy, or Traefik with a free Let's Encrypt SSL certificate to route traffic securely to ports 9000 and 9001.
- Remember, MinIO is Not a Backup: If your server's single hard drive fails, your data dies. Always have an off-site backup strategy.
- High Availability: For enterprise workloads, consider deploying MinIO in a distributed cluster across multiple drives (RAID) or multiple servers to ensure fault tolerance and data redundancy.
Top comments (0)