02.01
Data / AI platforms
Object storage for data and AI.
Point DuckDB, S3 SDKs, and lakehouse tooling at one encrypted S3 endpoint instead of standing up and operating a separate object store.
§00 · Apache 2.0 · single node to cluster
Start on one node.
Grow into a production cluster.
GrainFS is a distributed, S3-compatible storage server with zero-config clustering and at-rest encryption on by default. Add nodes while the service stays online.
one binary · S3 in minutes
# start one local storage server
DATA_DIR=./tmp
make bin/grainfs
./bin/grainfs serve --data "$DATA_DIR" --port 9000
# write through the S3 API
echo "hello grainfs" > file.txt
aws --no-sign-request --endpoint-url http://localhost:9000 s3 cp file.txt s3://default/
# read it back through the same S3 endpoint
aws --no-sign-request --endpoint-url http://localhost:9000 s3 ls s3://default/
aws --no-sign-request --endpoint-url http://localhost:9000 s3 cp s3://default/file.txt - # hello grainfsOne S3 surface. Every client.
AWS CLI & SDKsaws · boto3 · sdk
cli
MinIO mcmc cp · mc admin
ops
single binary
GrainFS
↳ raft
↳ erasure
↳ DEK/KEK
rclonerclone copy · mount
sync
Analytics enginesDuckDB · Spark over S3
query
From one node to a production cluster.
02.02
On-prem / edge / lab
One small cluster near the workload.
Serve S3 storage in labs, edge sites, GPU racks, and private networks without bringing in a full storage platform.
02.03
Developer infrastructure
A real S3 backend for CI and tests.
Run one encrypted S3 server as a test fixture instead of pointing CI at cloud storage or mocking the S3 API.
What makes the cluster production-grade.
01
Consensus
Raft keeps metadata consistent.
Cluster membership, IAM state, protocol credentials, placement metadata, and admin changes commit through the Raft-backed metadata layer.
02
Durability
Erasure coding follows topology.
The cluster derives its erasure-coding profile from topology and stops writes when it cannot meet the required durability target.
03
Encryption
At-rest encryption covers data and secrets.
Object data, metadata snapshots, WAL records, service-account keys, and protocol secrets use the generation-aware DEK/KEK envelope.
Safety shows up in failure paths.
04.01
Zero-CA
Cutover removes shared bootstrap keys.
grainfs cluster complete-cutover moves voters to per-node transport identities and drops
the legacy shared cluster key only after readiness checks pass.
04.02
Credentials
Stale credentials fail before attach.
The S3 attach path rejects stale, revoked, expired, or mismatched credentials before clients connect.
04.03
At rest
Format changes fail closed.
Nodes refuse to open data directories with mismatched format markers. They fail closed rather than mix storage formats without a flag.
04.04
Real clients
Real clients run every release.
MinIO mc exercises bucket-scoped S3 credentials, and AWS SigV4 signing runs against real
clients on single-node GrainFS.
NoteThe public compatibility tables mark a feature supported only when e2e, conformance, or real-client integration tests cover it. Unit tests alone do not qualify.
Run the engine free, at any scale. Add support when you want it.
Tier 01 · Community
Apache 2.0
Start from GitHub
- Single node to production cluster, any scale
- Full S3-compatible object API
- CLI, docs, and operator runbooks
Tier 02 · Production support
For operators
Review the operating path
- Cluster dashboard and health inventory
- Diagnostics, backup/restore workflows, and upgrade checks
- Slack/email support for operators
Tier 03 · Enterprise
For regulated
Run in controlled environments
- Air-gapped install and long-term support builds
- SSO/RBAC, audit workflows, recovery assistance
- Architecture review for on-prem, edge, and lab clusters
§06 · grainfs.gritive.com
Try GrainFS locally in minutes.
Run a local node, exercise the S3 API, then bring GrainFS into production with review, upgrades, and recovery planning.