# MinIO AIStor Memory RELEASE.2026-08-18T07-22-09Z Released: 2026-08-19 MinIO AIStor Memory gives an AI agent a durable memory it keeps: one FUSE mount of an AIStor Memory Bucket — a _cortex_ — that the agent both works in and remembers through. Files are ordinary POSIX files on your own storage with your own keys, so a disposable sandbox can be torn down and the next session re-mounts the same state byte for byte. > **First Release:** This is the inaugural production release of MinIO AIStor Memory. --- ## Downloads ### Binary | Platform | Architecture | Download | | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------- | | Linux | amd64 | [aimem.RELEASE.2026-08-18T07-22-09Z](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem.RELEASE.2026-08-18T07-22-09Z) | | Linux | arm64 | [aimem.RELEASE.2026-08-18T07-22-09Z](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem.RELEASE.2026-08-18T07-22-09Z) | Each binary is published with `.sha256sum`, `.minisig`, and `.asc` files beside it. These links point into `archive/`, which is where a release's artifacts stay once a newer release ships — so they keep resolving to *this* build. The unversioned `…/linux-{arch}/aimem` path always serves the newest release, which is a different binary as soon as one follows this. ### Packages `.deb`, `.rpm`, and `.apk` are the complete install: the `aimem` client, the setuid `aimem-fusermount` helper that lets an unprivileged user mount, and the `aimem-bio` sibling that `aimem bio` runs. They also add a disabled example `mnt-aimem.mount` systemd unit and the `/sbin/mount.aimem` helper it needs. | Format | Architecture | Download | | ------ | ------------ | ----------------------------------------------------------------------------------------------------------------------------------- | | DEB | amd64 | [aimem\_20260818072209.0.0_amd64.deb](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem_20260818072209.0.0_amd64.deb) | | DEB | arm64 | [aimem\_20260818072209.0.0_arm64.deb](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem_20260818072209.0.0_arm64.deb) | | RPM | amd64 | [aimem-20260818072209.0.0-1.x86_64.rpm](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem-20260818072209.0.0-1.x86_64.rpm) | | RPM | arm64 | [aimem-20260818072209.0.0-1.aarch64.rpm](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem-20260818072209.0.0-1.aarch64.rpm) | | APK | amd64 | [aimem\_20260818072209.0.0_x86_64.apk](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem_20260818072209.0.0_x86_64.apk) | | APK | arm64 | [aimem\_20260818072209.0.0_aarch64.apk](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem_20260818072209.0.0_aarch64.apk) | The FUSE path is pure Rust and links no `libfuse`, so the packages depend only on libc (`libc-bin` / `glibc-common`). ### Container Image ```bash # This release, pinned: docker pull quay.io/minio/aistor/aimem:RELEASE.2026-08-18T07-22-09Z # The rolling stable tag — it moves to the next release when one ships: docker pull quay.io/minio/aistor/aimem:latest ``` The image carries the `aimem` binary. Mounting from a container needs `/dev/fuse` and `CAP_SYS_ADMIN` (or `--privileged`). ### Verification Each binary is signed with both minisign (preferred) and GPG; sha256sums are published alongside. ```bash TAG=RELEASE.2026-08-18T07-22-09Z BASE=https://dl.min.io/aistor/aimem/release/linux-amd64/archive curl -fsSLO $BASE/aimem.$TAG curl -fsSLO $BASE/aimem.$TAG.minisig curl -fsSLO $BASE/aimem.$TAG.sha256sum # minisign minisign -Vm aimem.$TAG -P RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGav # sha256 — the checksum file names the versioned binary, so verify under that # name; `sha256sum -c` fails against a file saved as plain `aimem` sha256sum -c aimem.$TAG.sha256sum ``` (The minisign public key above is the MinIO release-signing key, shared across the AIStor product line.) A Software Bill of Materials (SPDX 2.3 and CycloneDX 1.6) and the full crate dependency list are published beside these notes under `https://dl.min.io/aistor/aimem/release/notes/`. --- ## What's in this release ### The workspace A cortex mounts as a POSIX filesystem, and ordinary tools work on it unchanged. `--local` is mandatory and holds copy-on-write staging plus the read cache; writes go through it to the cortex, and reads stream through a prefetcher. Conformance is enforced by eight end-to-end suites that run real tools against a live mount: `git`, SQLite, `tar`/archive, `rsync`, Python bytecode compilation, `flock`, a C build, and a nightly Linux kernel build. Between them they cover `rename()` under the lock-file pattern, `fcntl` and BSD `flock` advisory locks, random `pread`/`pwrite`, WAL journals, symlinks, `chmod`, `O_APPEND`, `ftruncate` in both directions, `utimensat`, and `exec()` of a binary linked on the mount. The nightly builds Linux at a pinned tag — an 86,000-file tree, roughly 3,000 objects, several link passes that rewrite `vmlinux` under readers — and asserts a valid ELF `vmlinux` and a bootable `bzImage`. - **Cortex-only by design.** A plain bucket is refused at mount with `not a Memory Bucket (cortex)`. Create one with `aimem cortex create`, or convert a bucket in place with `aimem cortex convert`. - **Unprivileged mounts.** `aimem` opens `/dev/fuse` itself and forwards the descriptor to the setuid `aimem-fusermount` helper, so no `libfuse` and no root is needed. Running as root or with `CAP_SYS_ADMIN` skips the helper. - **Consistent while in use.** A file open for writing can be read concurrently — the reader is served from staging — a file rewritten under an open reader keeps that reader working instead of failing it, and a newly created file is visible to the next open (close-to-open consistency), including when it is empty. - **File watching works.** The kernel generates `inotify` and `fanotify` events for the operations it processes, and an operation through the mount is one of them, so watchers such as vite, webpack, and `uvicorn --reload` work on a workspace. - **Distributed advisory locks.** BSD `flock` is arbitrated across mounts through the cortex, so two hosts mounting the same cortex serialize correctly. - **Multi-endpoint mounts.** `--endpoint-url` is repeatable and accepts MinIO-style patterns (`http://minio{1...4}:9000`). With `--health-path`, an unhealthy endpoint drops out of the round-robin pool; `--request-timeout` bounds a request and retries it on the next endpoint. ### Memory - **Warmup.** `--agent ` pre-caches the vendor memory files an agent reads first (`CLAUDE.md`, `AGENTS.md`, and the like) so the first read on a cold mount does not pay a round trip. - **SKILLS.** The cortex teaches the agent how to use it: skills install into the agent's home directory, and a read-time preamble overlay keeps that awareness durable. The overlay is on by default; `AIMEM_PREAMBLE_OVERLAY=0` disables it. - **Writable annotations.** The agent attaches its own notes to any object under `.aimem/annot/…`, so reasoning about a piece of data travels with the data. - **Memory Search.** `aimem search` runs a grep-style regex over a cortex's data at rest, server-side — with `--prefix`, `--ext`, `-i`, `-U`, `-B`/`-A`/`-C` context, `--content`, and `--max-total-bytes` to bound a result set to an agent's context window. ### Secrets — the vault `aimem secret provision` fetches the secrets an agent is granted and injects them as environment variables into a cleared environment, so the store credential never reaches the agent. The durable store is the cortex itself (`aimem secret put` / `get` / `list` / `delete`, values encrypted server-side); `--store-endpoint` bridges to an external secret store for organizations whose secrets already live in one. ### Cortex lifecycle `aimem cortex create`, `convert`, `list`, `get`, `delete`, and `credentials` manage Memory Buckets over the Memory API. `credentials` mints STS credentials scoped to a single cortex, able to mount that bucket and use the Memory API on it and nothing else. ### Agent biography `aimem bio` records agent activity to Iceberg tables with OTEL telemetry, for querying what an agent did across sessions. It ships as `/usr/bin/aimem-bio` in the packages and is dispatched automatically by `aimem bio `. --- ## Platform / Compatibility - **Linux only**, amd64 and arm64. amd64 is built against a glibc 2.34 floor (RHEL/Rocky 9+, Debian 12+, Ubuntu 22.04+); arm64 needs glibc 2.39 or newer (Ubuntu 24.04+). - **`/dev/fuse` must be available.** No `libfuse` dependency. - **FUSE passthrough** — the kernel serving reads and writes directly from the staging file — requires `CAP_SYS_ADMIN`. Without it the mount degrades to ordinary FUSE I/O rather than failing. - **`aimem cortex convert` requires a KMS configured on the AIStor server.** Without one the server refuses the conversion. - **Sandbox runtimes.** Mounting inside E2B, Daytona, Modal, Vercel Sandbox, OpenShift, Apple `container`, and devcontainers/Codespaces is exercised in CI. A runtime that cannot provide `/dev/fuse` cannot mount. ## Known Limitations - **Hard links return `EPERM`.** S3 has no inode aliasing. Tools that rely on them (`rsync --link-dest`, `cp -l`) need a different strategy. - **`mmap()` and `copy_file_range()` return `ENOSYS`**, and the kernel falls back to `read`+`write`. `exec()` of a binary on the mount works — the kernel maps its pages — but an application that maps a data file itself is untested. - **`fallocate()` returns `ENOSYS`**; callers fall back gracefully. - **A change written behind the mount is invisible.** File watching covers what goes through the mount; another client writing the bucket directly is something the kernel never sees, so no event fires. - **Cross-mount `fcntl` byte-range locks are uncoordinated.** Single-node `fcntl` locking works through the kernel VFS, and BSD `flock` is arbitrated across mounts, but byte-range coordination between hosts is not covered. - **Files larger than 4 GB and sparse-file patterns** are not covered by the conformance suites. - **`aimem-fusermount` and `aimem-bio` are not standalone downloads in this release.** Both ship inside the `.deb` / `.rpm` / `.apk`; install a package to get them. --- ## Documentation - Hosted docs: ## Support - Security disclosures: security@min.io - Licensed customers and contributors: contact MinIO support.