# MinIO AIStor Memory RELEASE.2026-08-20T10-21-09Z Released: 2026-08-20 A packaging and Kubernetes release. Three binaries that previously shipped only inside the packages — the setuid `aimem-fusermount` mount helper, the `aimem-bio` sibling, and the `aimem-csi-driver` node driver — are now published as signed downloads in their own right. The packages no longer leave a dangling mount helper behind on hosts where the client installs to `/usr/local/bin`. And the Kubernetes CSI driver became deployable: its image is published, and it mounts a cortex into a pod without granting that pod any privilege. No filesystem, memory, or secrets behavior changed from RELEASE.2026-08-18T07-22-09Z. --- ## Downloads ### Binaries | Binary | Architecture | Download | | ------------------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------- | | `aimem` | amd64 | [aimem.RELEASE.2026-08-20T10-21-09Z](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem.RELEASE.2026-08-20T10-21-09Z) | | `aimem` | arm64 | [aimem.RELEASE.2026-08-20T10-21-09Z](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem.RELEASE.2026-08-20T10-21-09Z) | | `aimem-fusermount` | amd64 | [aimem-fusermount.RELEASE.2026-08-20T10-21-09Z](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem-fusermount.RELEASE.2026-08-20T10-21-09Z) | | `aimem-fusermount` | arm64 | [aimem-fusermount.RELEASE.2026-08-20T10-21-09Z](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem-fusermount.RELEASE.2026-08-20T10-21-09Z) | | `aimem-bio` | amd64 | [aimem-bio.RELEASE.2026-08-20T10-21-09Z](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem-bio.RELEASE.2026-08-20T10-21-09Z) | | `aimem-bio` | arm64 | [aimem-bio.RELEASE.2026-08-20T10-21-09Z](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem-bio.RELEASE.2026-08-20T10-21-09Z) | | `aimem-csi-driver` | amd64 | [aimem-csi-driver.RELEASE.2026-08-20T10-21-09Z](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem-csi-driver.RELEASE.2026-08-20T10-21-09Z) | | `aimem-csi-driver` | arm64 | [aimem-csi-driver.RELEASE.2026-08-20T10-21-09Z](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem-csi-driver.RELEASE.2026-08-20T10-21-09Z) | `aimem` is the mount client. `aimem-fusermount` is the setuid-root mount helper that lets an unprivileged user mount; install it mode 4755 owned by root, or run `aimem` as root or with `CAP_SYS_ADMIN` and skip it. `aimem-bio` is the Tables/Iceberg data plane that `aimem bio` dispatches to. `aimem-csi-driver` is the Kubernetes node driver; a cluster runs it as a DaemonSet from the image below rather than installing this binary by hand. Each binary is published with `.sha256sum`, `.minisig`, and `.asc` files beside it. These links point into `archive/`, which is where a release's artifacts stay once a newer release ships — so they keep resolving to *this* build. The unversioned `…/linux-{arch}/aimem` path always serves the newest release, which is a different binary as soon as one follows this. ### Packages `.deb`, `.rpm`, and `.apk` install all three binaries: the `aimem` client in `/usr/local/bin`, the `aimem-fusermount` helper at `/usr/bin/aimem-fusermount` (setuid root, mode 4755), and `aimem-bio` at `/usr/bin/aimem-bio`. They also drop a disabled example `mnt-aimem.mount` systemd unit and create the `/sbin/mount.aimem` helper it needs. | Format | Architecture | Download | | ------ | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------- | | DEB | amd64 | [aimem_20260820102109.0.0_amd64.deb](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem_20260820102109.0.0_amd64.deb) | | DEB | arm64 | [aimem_20260820102109.0.0_arm64.deb](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem_20260820102109.0.0_arm64.deb) | | RPM | amd64 | [aimem-20260820102109.0.0-1.x86_64.rpm](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem-20260820102109.0.0-1.x86_64.rpm) | | RPM | arm64 | [aimem-20260820102109.0.0-1.aarch64.rpm](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem-20260820102109.0.0-1.aarch64.rpm) | | APK | amd64 | [aimem_20260820102109.0.0_x86_64.apk](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem_20260820102109.0.0_x86_64.apk) | | APK | arm64 | [aimem_20260820102109.0.0_aarch64.apk](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem_20260820102109.0.0_aarch64.apk) | The FUSE path is pure Rust and links no `libfuse`, so the packages depend only on libc (`libc-bin` / `glibc-common`). ### Container Image ```bash # This release, pinned: docker pull quay.io/minio/aistor/aimem:RELEASE.2026-08-20T10-21-09Z # The rolling stable tag — it moves to the next release when one ships: docker pull quay.io/minio/aistor/aimem:latest # The Kubernetes CSI node driver, run as a DaemonSet, not as this image: docker pull quay.io/minio/aistor/aimem-csi-driver:RELEASE.2026-08-20T10-21-09Z ``` For anything you need to reproduce, pin the release tag or a `@sha256:` digest; never `latest`. The image carries the `aimem` binary. Mounting from a container needs `/dev/fuse` and `CAP_SYS_ADMIN` (or `--privileged`). ### Verification Each binary is signed with both minisign and GPG, and a `.sha256sum` is published beside it. ```bash BASE=https://dl.min.io/aistor/aimem/release/linux-amd64/archive curl -fsSLO $BASE/aimem.RELEASE.2026-08-20T10-21-09Z curl -fsSLO $BASE/aimem.RELEASE.2026-08-20T10-21-09Z.minisig curl -fsSLO $BASE/aimem.RELEASE.2026-08-20T10-21-09Z.sha256sum # minisign minisign -Vm aimem.RELEASE.2026-08-20T10-21-09Z \ -P RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGav # sha256 — the checksum file names the versioned binary, so keep that name sha256sum -c aimem.RELEASE.2026-08-20T10-21-09Z.sha256sum ``` The minisign public key above is the MinIO release-signing key, shared across the AIStor product line. --- ## Changes since RELEASE.2026-08-18T07-22-09Z ### New Features - **The Kubernetes CSI node driver is deployable.** Its image is published as `quay.io/minio/aistor/aimem-csi-driver`, so the DaemonSet resolves without you building one first — until now it named an image that existed nowhere, which left the privileged in-pod mount as the only route. kubelet performs the mount on the node, so the workload pod needs no `CAP_SYS_ADMIN`, no `/dev/fuse`, and no privilege escalation. That is what makes a cortex mountable under a restrictive PodSecurity policy or an OpenShift SCC. See . - **Inline ephemeral volumes.** A pod can declare the mount itself, carrying the cortex and endpoint in `volumeAttributes` with credentials in `nodePublishSecretRef`, so there is no PersistentVolume and Claim pair to garbage-collect for each pod. That suits workloads created per unit of work — agent sandboxes, CI jobs. Two rules apply only to inline volumes: `bucketName` is required, because kubelet generates the volume handle from the pod rather than from a bucket; and `localDir` is refused, because it names a path on the node and an inline volume's attributes are written by whoever creates the pod. ### Improvements - `aimem-fusermount` and `aimem-bio` are published as standalone downloads for both architectures, each with its own `.sha256sum`, `.minisig`, and `.asc`. Until now they shipped only inside the `.deb` / `.rpm` / `.apk`, so a container image or sandbox that installed the binary on its own had no supported way to get the setuid mount helper — the piece that makes an unprivileged mount work. - The install steps and the sandbox example builds fetch binaries from the layout the CDN actually serves: `…/release/linux-{arch}/{name}` for the current release, with the release tag appended to the file name to pin an exact build. The devcontainer Feature and every sandbox example image had been requesting a path that no longer exists, so any build that fetched from the CDN rather than from a staged local binary failed at the download step. ### Bug Fixes - The package postinstall resolves the installed `aimem` before it creates `/sbin/mount.aimem`, instead of assuming `/usr/bin/aimem`. The released packages install the client to `/usr/local/bin`, so that symlink dangled and the bundled `mnt-aimem.mount` unit failed to mount with `Type=aimem`. `mount -t aimem` from `/etc/fstab` failed the same way. --- ## Documentation - Hosted docs: ## Support - Security disclosures: security@min.io - Licensed customers and contributors: contact MinIO support.