Overview
A bucket stores files — uploads, images, videos, backups — and your apps use it through the S3 protocol, which nearly every language has a library for.
When to use it
- Users upload pictures or documents.
- Backups and exports.
- Images and videos served to visitors, with a CDN in front.
How it works
- MinIO
- One S3-compatible object store per machine, from Chainguard’s MinIO image pinned by digest.
- S3 API
- Any S3 library or tool works with the bucket’s endpoint and credentials.
- Versioning
- Optional: keep every version of a file that changes.
All buckets on a machine live in one object store container, created with the first bucket. Credentials are kept in the managed secret objectstore-credentials; apps use the internal endpoint, tools on this computer the published one.
Architecture
- Your app to Object store: internal endpoint
- Tools on this computer to Object store: published endpoint
- Object store to Buckets
Flows
An upload
- The app signs a PUT with the bucket credentials.
- The object store writes the file.
- Other apps, a CDN or a transcoder can read it by key.
Set it up
In the console
- Open Buckets and choose New bucket.
- Name it; turn on versioning if you want old versions kept.
- Choose Create; its page shows the endpoint and credentials.
With the CLI
enclave bucket create uploads --waitWith OpenTofu
OpenTofu configuration
resource "enclave_bucket" "uploads" {
name = "uploads"
}Settings reference
Every setting and output of the OpenTofu resource; the console and the CLI use the same names in their own words. Generated from platform 4d30582.
| Name | Type | Use | What it does |
|---|---|---|---|
name | text | required | Name of the bucket: 3–40 lowercase letters, digits or hyphens, starting with a letter. Changing it replaces the bucket. |
project | text | optional | The project to create it in. Defaults to the provider's project (ENCLAVE_PROJECT, else default). Changing it replaces the resource. |
versioning | true or false | optional | Keep previous versions of objects. Changes in place. |
credentials_secret | text | output | Name of the secret holding the object store's access and secret keys (JSON). |
endpoint | text | output | S3 endpoint reachable from this machine. |
id | text | output | Resource ID. |
internal_endpoint | text | output | S3 endpoint apps use on the EnclaveStack network. |
Limits and security
Good to know
- Bucket names are unique on the machine, across projects.
- Files use this machine’s disk; watch free disk on the overview.
Security
- Private unless you choose otherwise; credentials live in a managed secret.