# AIStor Memory (aimem) RELEASE.2026-10-21T18-29-18Z Released: 2026-10-21 AIStor Memory (aimem) can now mount as a non-root user, from the release image and in Kubernetes (including OpenShift). Each Kubernetes mount now runs in its own unprivileged pod, so a NetworkPolicy can restrict which pods reach AIStor. --- ## Downloads ### Binaries | Platform | Architecture | Download | | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------- | | Linux | amd64 | [aimem.RELEASE.2026-10-21T18-29-18Z](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem.RELEASE.2026-10-21T18-29-18Z) | | Linux | arm64 | [aimem.RELEASE.2026-10-21T18-29-18Z](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem.RELEASE.2026-10-21T18-29-18Z) | The setuid `aimem-fusermount` mount helper, the `aimem-bio` binary that `aimem bio` runs, and the Kubernetes CSI node driver are published beside it: | Binary | Architecture | Download | | ------------------ | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------- | | `aimem-fusermount` | amd64 | [aimem-fusermount.RELEASE.2026-10-21T18-29-18Z](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem-fusermount.RELEASE.2026-10-21T18-29-18Z) | | `aimem-fusermount` | arm64 | [aimem-fusermount.RELEASE.2026-10-21T18-29-18Z](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem-fusermount.RELEASE.2026-10-21T18-29-18Z) | | `aimem-bio` | amd64 | [aimem-bio.RELEASE.2026-10-21T18-29-18Z](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem-bio.RELEASE.2026-10-21T18-29-18Z) | | `aimem-bio` | arm64 | [aimem-bio.RELEASE.2026-10-21T18-29-18Z](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem-bio.RELEASE.2026-10-21T18-29-18Z) | | `aimem-csi-driver` | amd64 | [aimem-csi-driver.RELEASE.2026-10-21T18-29-18Z](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem-csi-driver.RELEASE.2026-10-21T18-29-18Z) | | `aimem-csi-driver` | arm64 | [aimem-csi-driver.RELEASE.2026-10-21T18-29-18Z](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem-csi-driver.RELEASE.2026-10-21T18-29-18Z) | Each binary has `.sha256sum`, `.minisig`, and `.asc` files at the same path. These links point into `archive/`, where a release's files stay after a newer release ships, so they always serve this build. The unversioned `…/linux-{arch}/aimem` path serves whatever release is newest. ### Packages `.deb`, `.rpm`, and `.apk` install the `aimem` client, the setuid `aimem-fusermount` mount helper (`/usr/bin/aimem-fusermount`, mode 4755), and `aimem-bio`. They also install a disabled example `mnt-aimem.mount` systemd unit and the `/sbin/mount.aimem` helper it needs. | Format | Architecture | Download | | ------ | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------- | | DEB | amd64 | [aimem_20261021182918.0.0_amd64.deb](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem_20261021182918.0.0_amd64.deb) | | DEB | arm64 | [aimem_20261021182918.0.0_arm64.deb](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem_20261021182918.0.0_arm64.deb) | | RPM | amd64 | [aimem-20261021182918.0.0-1.x86_64.rpm](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem-20261021182918.0.0-1.x86_64.rpm) | | RPM | arm64 | [aimem-20261021182918.0.0-1.aarch64.rpm](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem-20261021182918.0.0-1.aarch64.rpm) | | APK | amd64 | [aimem_20261021182918.0.0_x86_64.apk](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem_20261021182918.0.0_x86_64.apk) | | APK | arm64 | [aimem_20261021182918.0.0_aarch64.apk](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem_20261021182918.0.0_aarch64.apk) | The packages depend only on libc (`libc-bin` / `glibc-common`); no `libfuse` is needed. ### Container Images ```bash # The aimem client, pinned to this release: docker pull quay.io/minio/aistor/aimem:RELEASE.2026-10-21T18-29-18Z # The Kubernetes CSI node driver, pinned to this release: docker pull quay.io/minio/aistor/aimem-csi-driver:RELEASE.2026-10-21T18-29-18Z ``` The `latest` tag of each image also points at this release, but moves when the next one ships. To verify a build, pin the release tag or a `@sha256:` digest, never `latest`. Both images are now built on Wolfi instead of Ubuntu; see Behaviour Changes below. Mounting from a container needs `/dev/fuse`. As root, it also needs `CAP_SYS_ADMIN` (or `--privileged`). As a non-root user, the container needs `SYS_ADMIN` added to its capabilities and `allowPrivilegeEscalation: true`, so the setuid helper can run. ### Verification Each binary is signed with minisign (preferred) and GPG, and has a sha256sum file. ```bash BASE=https://dl.min.io/aistor/aimem/release/linux-amd64/archive curl -fsSLO $BASE/aimem.RELEASE.2026-10-21T18-29-18Z curl -fsSLO $BASE/aimem.RELEASE.2026-10-21T18-29-18Z.minisig curl -fsSLO $BASE/aimem.RELEASE.2026-10-21T18-29-18Z.sha256sum # minisign minisign -Vm aimem.RELEASE.2026-10-21T18-29-18Z \ -P RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGav # sha256: the checksum file names the versioned binary, so keep that file name sha256sum -c aimem.RELEASE.2026-10-21T18-29-18Z.sha256sum ``` The minisign public key above is the MinIO release-signing key, used across the AIStor product line. --- ## Changes since RELEASE.2026-10-15T19-16-20Z ### New Features - **Cap the space aimem uses under `--local`.** New `--local-size` (`AIMEM_LOCAL_SIZE`, config key `local_size`) limits staging files and the read cache together. It takes bytes or a Kubernetes quantity (`10G` is 10⁹ bytes, `10Gi` is 2³⁰). When the cap is reached, aimem evicts cached data first; if open writes alone fill it, the write that does not fit fails with `ENOSPC` and the file stays usable. Without the option, nothing changes. (#245) - **Mount as a non-root user from the release image.** `quay.io/minio/aistor/aimem` now ships the setuid `aimem-fusermount` helper and an `aimem` user (uid 1000, group 0), and a pinned uid or an OpenShift-assigned random uid can mount. A new `aimem-workspace` script mounts the bucket at `/workspace` and then runs your workload; set `/usr/bin/tini -- /usr/local/bin/aimem-workspace` as the entrypoint (Kubernetes `command:`) to use it. The default entrypoint and user are unchanged. The [OpenShift guide](https://docs.min.io/aimem/integrations/openshift/) now uses the release image. (#241) - **Kubernetes: non-root pods can use their volume, including on OpenShift.** Every pod that shares an `fsGroup` can read and write the volume, and `chmod` the files it creates, so installers such as `pip`, `npm` and `uv` work. Files created by a uid other than the mount's owner record it in the `aimem-uid` / `aimem-gid` object metadata. The driver now works under OpenShift's `restricted-v2` SCC and in namespaces that enforce the restricted Pod Security profile. See [Non-root pods and OpenShift](https://docs.min.io/aimem/integrations/kubernetes/#non-root-pods-and-openshift). (#243) - **New config keys `shared_gid` and `selinux_context`.** `shared_gid` makes every entry owned by that group, with group permissions copied from the owner's. `selinux_context` labels the mount with the `context=` mount option. The CSI driver sets both for you. (#243) - **Kubernetes: each mount runs in its own unprivileged pod.** Each volume is now served by a mounter pod in the `aimem-csi-mounters` namespace, labelled `app: aimem-csi-mounter`. It runs as non-root with no host access, and reaches AIStor over the pod network, so a NetworkPolicy in front of AIStor can admit only these pods. Mounts survive a driver restart. (#246) - **Kubernetes: size each mount's cache.** New volume attribute `cacheSize` (default `10Gi`) sets the size of the mounter pod's cache, and aimem keeps under it. New driver options: `--max-cache-size` (`AIMEM_CSI_MAX_CACHE_SIZE`, default `100Gi`) caps `cacheSize`, and `--mounter-priority-class` (`AIMEM_CSI_MOUNTER_PRIORITY_CLASS`) sets the mounter pods' priority class. The shipped DaemonSet sets it to `system-node-critical`, so the node does not evict a mounter under pressure. (#246) - **Kubernetes: recover a mount after its mounter pod dies.** The next republish mounts again on top of the dead mount. A container that mounts the volume with `mountPropagation: HostToContainer` picks it up without a restart; other containers must restart. Files that were open stay broken. (#246) ### Bug Fixes #### Mounting - `aimem-fusermount` failed with a bare `Operation not permitted` when it was not running as root: not installed setuid, on a `nosuid` filesystem, or in a container with `allowPrivilegeEscalation: false`. It now says which and prints the install command. (#240) - `aimem-fusermount` refused every container mountpoint for a non-root caller, because it required the caller to own the directory. It now requires write access, as `fusermount3` does. It also refuses a sticky directory the caller does not own (such as `/tmp`) and filesystems such as procfs and sysfs. (#241) - A full `--local` disk now returns `ENOSPC` to the writer instead of `EIO`. (#245) #### Kubernetes - A pod running as non-root got `Permission denied` on its volume, even for `ls`, so the documented `runAsUser: 1000` example could not work. (#243) ### Behaviour Changes - **Container images are built on Wolfi instead of Ubuntu 24.04.** Images that build `FROM quay.io/minio/aistor/aimem` or `aimem-csi-driver` and run `apt-get` will fail; use `apk` instead. Grype reports no vulnerabilities in either image for this release, against 77 in the previous release's `aimem` image. (#241) - **CSI volume attributes `localDir` and `tlsCaFile` are rejected,** because a mounter pod cannot use a host path. Use `cacheSize` and `caCert` instead. (#246) - **The CSI driver no longer runs mounts on the node.** It drops `hostPID`, systemd, `nsenter`, the `install-aimem` init container and `/opt/aimem/bin`. The driver options `--aimem-path` (`AIMEM_HOST_PATH`), `--use-nsenter` (`AIMEM_USE_NSENTER`) and `--credentials-dir` (`AIMEM_CSI_CREDENTIALS_DIR`) are removed, and the driver now requires `AIMEM_CSI_MOUNTER_IMAGE`. The driver image runs as uid 65532; the shipped DaemonSet runs the driver container as root. (#246) - **A NetworkPolicy in front of AIStor must select the mounter pods:** namespace `aimem-csi-mounters`, label `app: aimem-csi-mounter`. Mount traffic no longer comes from the node's network. (#246) - **A non-root pod with no `fsGroup` can read its volume but not write to it.** OpenShift always sets one. (#243) ### Security Updates - **`aimem-fusermount` hardening.** The mount helper now always mounts `nosuid,nodev` for a non-root caller and ignores `suid` and `dev`, as `fusermount3` does. (#239) - **TLS certificate validation advisories.** `rustls-webpki` is updated to 0.103.16 for [RUSTSEC-2026-0382](https://rustsec.org/advisories/RUSTSEC-2026-0382.html) (may accept distrusted intermediates), and `webpki-roots` / `webpki-root-certs` to 1.0.10 for [RUSTSEC-2026-0381](https://rustsec.org/advisories/RUSTSEC-2026-0381.html) and [RUSTSEC-2026-0383](https://rustsec.org/advisories/RUSTSEC-2026-0383.html) (bundled roots trusted distrusted emSign intermediates). This covers `aimem` and `aimem-bio` (#242) and the CSI driver, which uses them for `--token-exchange-url` (#244). The CSI driver also takes `anyhow` 1.0.104 for [RUSTSEC-2026-0190](https://rustsec.org/advisories/RUSTSEC-2026-0190.html). (#244) ### Known Limitations - SELinux labelling of CSI mounts (`context=`) has not been verified on a node that enforces SELinux. (#243, #246) - With `--local-size`, the `aimem bio` telemetry spool under `.aimem/` is not counted against the cap. (#245) ### Platform / Compatibility - Linux amd64 and arm64, glibc 2.34 or later. - Mounting needs `/dev/fuse`. As root, or with `CAP_SYS_ADMIN`, aimem mounts directly; any other user mounts through the setuid `aimem-fusermount` helper. FUSE passthrough also needs `CAP_SYS_ADMIN`; without it, a mount serves ordinary FUSE reads. --- ## Security & Compliance Software bills of materials (SBOMs) for this release, generated from the `Cargo.lock` files at the release tag: | Component | SPDX | CycloneDX | | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | | `aimem` | [aimem-RELEASE.2026-10-21T18-29-18Z.spdx.json](https://dl.min.io/aistor/aimem/release/notes/aimem-RELEASE.2026-10-21T18-29-18Z.spdx.json) | [aimem-RELEASE.2026-10-21T18-29-18Z.cdx.json](https://dl.min.io/aistor/aimem/release/notes/aimem-RELEASE.2026-10-21T18-29-18Z.cdx.json) | | `aimem-bio` | [aimem-bio-RELEASE.2026-10-21T18-29-18Z.spdx.json](https://dl.min.io/aistor/aimem/release/notes/aimem-bio-RELEASE.2026-10-21T18-29-18Z.spdx.json) | [aimem-bio-RELEASE.2026-10-21T18-29-18Z.cdx.json](https://dl.min.io/aistor/aimem/release/notes/aimem-bio-RELEASE.2026-10-21T18-29-18Z.cdx.json) | | `aimem-csi-driver` | [aimem-csi-RELEASE.2026-10-21T18-29-18Z.spdx.json](https://dl.min.io/aistor/aimem/release/notes/aimem-csi-RELEASE.2026-10-21T18-29-18Z.spdx.json) | [aimem-csi-RELEASE.2026-10-21T18-29-18Z.cdx.json](https://dl.min.io/aistor/aimem/release/notes/aimem-csi-RELEASE.2026-10-21T18-29-18Z.cdx.json) | For `aimem`, also the [crate list](https://dl.min.io/aistor/aimem/release/notes/aimem-RELEASE.2026-10-21T18-29-18Z.crates.txt) and [dependency tree](https://dl.min.io/aistor/aimem/release/notes/aimem-RELEASE.2026-10-21T18-29-18Z.cargo-tree.txt). --- ## Upgrade Instructions - **Derived container images:** replace `apt-get` with `apk` in any image built `FROM` the aimem or aimem-csi-driver images. - **Kubernetes:** apply all three manifests from this release — `rbac.yaml` (it creates the `aimem-csi-mounters` namespace and the mounter RBAC), `csidriver.yaml` and `daemonset.yaml` — and pin both image references in the DaemonSet to `quay.io/minio/aistor/aimem-csi-driver:RELEASE.2026-10-21T18-29-18Z`. Then: - Restart workloads whose volumes the previous driver mounted. Those mounts keep working, but their credentials are no longer renewed. See [Upgrading from a driver that mounted with systemd](https://docs.min.io/aimem/integrations/kubernetes/#upgrading-from-a-driver-that-mounted-with-systemd). - Replace `localDir` with `cacheSize`, and `tlsCaFile` with `caCert`, in every PersistentVolume and inline volume. - Give non-root workload pods an `fsGroup` if they need to write. - If a NetworkPolicy guards AIStor, admit namespace `aimem-csi-mounters` with label `app: aimem-csi-mounter`. - Add `mountPropagation: HostToContainer` to a volume mount that should recover from a mounter-pod restart without restarting the container. - **Bounded `--local` directories:** if `--local` sits on storage whose free space `statfs` cannot report, such as a Kubernetes `emptyDir` with a `sizeLimit`, set `--local-size` below that limit. See [Local store size](https://docs.min.io/aimem/configuration/#local-store-size). ## Documentation - Hosted docs: ## Support - Security disclosures: security@min.io - Licensed customers and contributors: contact MinIO support.