Sovereign S3
on your own infrastructure
S3-compatible object storage on any Kubernetes cluster, built on open-source SeaweedFS. Your hardware, your keys, your jurisdiction.
The four pillars of sovereign S3
Sovereign S3 is S3-compatible object storage you control on four counts. A local region of a foreign cloud gives you data residency, not sovereignty.
Jurisdiction
Whose law can compel access to the data?
Control
Who holds the keys and decides who gets in?
Software freedom
Can you keep running, patching and forking it forever?
Portability
Can you leave, with your data, without a penalty?
Why sovereign storage became urgent
In June 2025, a Microsoft France executive told the French Senate that Microsoft cannot guarantee French customer data will never be handed to US authorities. Eight months later, the default self-hosted alternative was archived.
The legal ground moved
- EU Data Act. Applies since 12 September 2025. Switching and egress fees must be cost-based, and from 12 January 2027 they are banned entirely.
- DORA. Applies to EU financial entities since 17 January 2025, with strict rules on ICT third-party risk and exit strategies. Backups that live with one hyperscaler are a concentration risk to justify.
- EU-US Data Privacy Framework. It survived its first court challenge in September 2025, but an appeal is possible. Safe Harbor and Privacy Shield were both struck down.
The open source ground moved
- 2021MinIO relicensed from Apache 2.0 to AGPLv3.
- 2025The admin web console was removed from the community edition.
- Dec 2025The community edition went into maintenance mode.
- Feb 2026The minio/minio repository was archived. Platforms that depend on it now run unmaintained software. Compare the alternatives
Three ways to run S3
Every backup tool and data engine speaks S3. What differs is who runs the storage, and under which law.
How it works
You describe the storage as one Instance. The open-source SeaweedFS provider for OpenEverest creates the cluster, generates access keys and certificates, and publishes connection details in a Secret.
apiVersion: core.openeverest.io/v1alpha1
kind: Instance
metadata:
name: sovereign-s3
spec:
providerRef:
name: provider-seaweedfs
topology:
type: standalone
parameters:
replication: "001" # every object stored twice, on different servers
tls:
enabled: true # mTLS between all SeaweedFS components
metrics:
prometheus:
enabled: true # PodMonitor for the Prometheus Operator
components:
master: { type: seaweedfs, replicas: 3 }
volume: { type: seaweedfs, replicas: 3, storage: { size: 20Gi } }
filer: { type: seaweedfs, replicas: 2, storage: { size: 10Gi } }
s3: { type: seaweedfs, replicas: 2 }See it in action
The same console you use for your databases.
Guided provisioning
A wizard walks through each component and creates the same Instance you would apply with kubectl or GitOps.
- Replicas, CPU, memory, disk and storage class per component
- Volume slots sized from the disk unless you set them
- Ready in under three minutes on our test cluster
Monitoring
One toggle exposes metrics and creates a Prometheus PodMonitor or a VictoriaMetrics VMPodScrape. The Metrics tab shows the essentials without a Grafana dashboard.
- S3 requests, p99 latency and errors by status code
- Bucket size, object count and disk usage
- Volume slots used, before you hit the bucket limit
What's included
Locked down by default
S3 authentication is always on, with access keys generated into your cluster's Secrets. Rotate them or bring your own. Components talk over mTLS with certificates from your cert-manager.
Provider on GitHub →Replicated and highly available
Every object is stored twice on different servers. Pods spread across nodes and each component has a PodDisruptionBudget, so node maintenance does not take storage down.
Provider on GitHub →Storage that sizes itself
Volume slots follow the disk size, new buckets start small, and storage grows online when your StorageClass allows expansion.
Sizing math →Database backups, at home
An OpenEverest backup storage can reference the connection Secret directly. We backed up a MongoDB replica set to SeaweedFS, dropped the data and restored all of it.
Backup walkthrough →Learn more
Sovereign S3: What It Means and How to Build It on Your Own Infrastructure
The four pillars, then a step-by-step build on Kubernetes: authentication, mTLS, sizing, monitoring, and a MongoDB backup and restore.
Read the guide → Blog4 MinIO Alternatives for Kubernetes Object Storage
SeaweedFS, RustFS, Ceph and Garage tested on a real cluster, compared on licensing and operations, and why SeaweedFS came out the most balanced.
Read the comparison →Frequently asked questions
What is sovereign S3?
Sovereign S3 is S3-compatible object storage that you control across four dimensions: jurisdiction (whose law can compel access), control (who holds the keys), software freedom (whether you can keep running and patching it) and portability (whether you can leave with your data without a penalty). Storing data in a local region of a foreign provider covers residency, not sovereignty.
Why SeaweedFS?
SeaweedFS is Apache 2.0 licensed, actively developed, and ships the S3 gateway, filer, IAM and admin UI in one binary, with no separate enterprise build for basic features. It packs objects into large volume files, which suits billions of small objects such as logs, backup chunks and ML samples. We tested it against RustFS, Ceph and Garage in 4 MinIO Alternatives.
Will my existing S3 tools and applications work?
Yes. Clients use the standard S3 API with path-style addressing, so the AWS CLI, SDKs, backup tools and database operators work unchanged. Connection details, including AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY, are published in a Secret that any pod can load.
Does it run on-premises or in air-gapped environments?
Yes. Everything is plain Kubernetes, so it runs the same on bare metal, with a local cloud provider or in an air-gapped data center. For air-gapped installs you mirror the images into your own registry. For encryption at rest, use a StorageClass with volume encryption.
How is Solanica Platform different from OpenEverest?
OpenEverest is the open-source project, and the SeaweedFS provider is part of it under the Apache 2.0 license. Solanica Platform is the enterprise distribution of OpenEverest: it adds RBAC and SSO, safe upgrades and 24/7 support from the team that builds it. See the Platform page for details.
Talk to us about sovereign storage
We will go through your requirements and show how S3 runs next to your databases on Solanica Platform.
Amazon S3 is a trademark of Amazon.com, Inc. or its affiliates. Azure and Microsoft are trademarks of the Microsoft group of companies. Google Cloud Storage is a trademark of Google LLC. MinIO is a trademark of MinIO, Inc. Solanica is not affiliated with, endorsed by, or sponsored by these companies. These names are used for identification purposes only.