Ceph vs MinIO in 2026: the comparison changed on 25 April

This article compares both systems as they exist in August 2026, not as they existed in the tutorials you learned from. It includes the cases where Ceph is the wrong choice.

What happened to MinIO, with dates

The community edition did not die in one step. The sequence matters, because each step moved a feature behind a paywall or a licence:

Jun 2025   Web console stripped from the community build. Bucket policies, lifecycle rules, site replication → enterprise-only.

03 Dec 2025  README: "Maintenance Mode". No new features, no PR reviews, security fixes "evaluated case-by-case".

12 Feb 2026  README: "THIS REPOSITORY IS NO LONGER MAINTAINED".

25 Apr 2026  Repository archived on GitHub. Read-only.

MinIO Inc. continues as a company. Its product is now AIStor, in three tiers (as of August 2026):

AIStor Free standalone only — single node, no clustering, no HA. Proprietary licence, licence file required.

AIStor Enterprise Lite  distributed, self-support, up to 400 TiB. Price on request.

AIStor Enterprise distributed, premium support, > 400 TiB. Price on request.

Two consequences for anyone running the archived AGPL code:

1. Any distributed MinIO deployment — the thing most teams actually run — has no free, maintained successor from the vendor. AIStor Free is single-node by licence, not by technical limit.
2. The security posture of the archived code is "case-by-case". For SOC 2, ISO 27001 or TISAX audits, that phrase is a finding, not a policy.

What Ceph is in 2026

Ceph is the opposite kind of project. It is 20 years old, licensed under LGPL 2.1, governed by the Ceph Foundation under the Linux Foundation, and has never had a community/enterprise split in its licence. The current stable line is Tentacle (20.x):

18 Nov 2025  20.2.0 Tentacle released

06 Apr 2026  20.2.1

16 Jun 2026  20.2.2

05 Aug 2026  20.2.3

19 Aug 2026  20.2.4

Squid (19.2) EOL estimated 31 Oct 2026

Tentacle EOL estimated Jun 2027

Five releases in nine months, with a published EOL calendar. That cadence is the single most important difference in 2026. Not performance, not features — the fact that someone ships patches on a schedule you can put in a risk register.

Ceph provides three interfaces on one cluster: RADOS Gateway (RGW) for S3-compatible object storage, RBD for block devices (VM disks), and CephFS for a POSIX filesystem. If you migrate from MinIO, you use RGW. The other two come for free and matter later, especially if you also run Proxmox, which integrates Ceph natively.

Head-to-head: where each one wins

Read the table honestly: MinIO was easier, faster on a single box, and closer to the S3 API. Those were real advantages. None of them survive the absence of a maintainer.

Who is actually at risk, and who is not

Not every MinIO installation needs to move this quarter.

Low risk: single-node MinIO for dev, CI artefacts, local testing. Nothing breaks. Pin the last community image, isolate it from the internet, move on. Or switch to AIStor Free, which is functionally richer for single-node use.

Medium risk: small distributed cluster, under 10 TB, internal workloads. The code works today. The problem is the next CVE. Plan a migration within 6–12 months; you have time to do it properly.

High risk: distributed MinIO as the storage layer for customer-facing SaaS, backups, or anything inside an ISO/SOC 2/TISAX scope. Your auditor will ask who patches it. "Nobody, officially" is not an answer. Move in the next two quarters.

Already paying for AIStor Enterprise: you have a maintained product. The question for you is vendor concentration, not availability.

Migration path: MinIO → Ceph RGW in six steps

1. Inventory the S3 features you actually use. Versioning, lifecycle rules, object lock, bucket notifications, presigned URLs, SSE-S3/SSE-KMS. Check each against RGW. Most are supported; object lock and notification semantics differ in detail.
2. Size the cluster for replication first, erasure coding second. 3× replication on three nodes is the simplest thing that survives a node failure. EC 4+2 needs six OSD hosts for proper failure domains — do not start there.
3. Stand up RGW and validate with your real client libraries, not with aws s3 ls. SDK path-style vs virtual-hosted-style addressing is the most common first failure.
4. Copy with rclone sync (or mc mirror from the old side) bucket by bucket, with checksums on. Budget 24–48 hours for each 10 TB over 10 GbE, less over 25 GbE.
5. Dual-write window. Point writes to both endpoints for a week, read from Ceph. Compare object counts and checksums daily.
6. Cutover DNS, keep MinIO read-only for 30 days, then decommission.

The whole thing is 2–6 weeks of engineer time for a 15–50 TB cluster, most of it in steps 1 and 5.

When you should NOT move to Ceph

Ceph is a cluster filesystem with a learning curve measured in months. It is the wrong answer when:

• You have one server. Ceph on one node is a demo, not storage. Use AIStor Free, Garage, or SeaweedFS.
• You need storage running by Friday and nobody on the team has run Ceph. You will get a cluster that works until the first disk dies. Buy time with a managed option or a simpler system.
• Your workload is millions of tiny objects with latency SLAs in single-digit milliseconds on commodity hardware. MinIO and SeaweedFS were built for that profile; Ceph can do it, but only with NVMe and tuning.
• You want a MinIO-shaped drop-in in 2026. That is RustFS (Apache 2.0, S3-compatible, single binary). It moved from alpha to beta on 29 April 2026 and shipped 1.0.0-beta.10 on 21 July 2026 — still pre-GA. Promising, not yet battle-tested. We wrote about the RustFS-vs-S3 economics separately:
• You have under 2 TB. The operational overhead of Ceph exceeds the value of the data. Use a simpler tool or an EU-hosted S3 provider.

What we run at Hostzero

We operate Ceph clusters in our Frankfurt data centre for customers who need S3 object storage, VM block storage, or both, without hiring a storage engineer. Cluster planning and setup are priced after a free assessment; Managed Ceph Operations — 24/7 monitoring, updates and security patches, capacity management, direct engineer contact — start at €500 per month net, final quote by cluster size and service level. We also take emergency calls for Ceph clusters we did not build: €250 per hour, 24/7. For teams that want the MinIO-style footprint with a maintained codebase, we also run Managed RustFS at €0.03/GB/month plus a €3,000 setup — 15 TB is €5,529.60 per year, compared with €268,140 on AWS S3 for the same 15 TB with 200 TB monthly egress (as of 2026).

Hardware scales in days, not minutes. If you need to triple capacity by tomorrow, hyperscalers remain the right call.

FAQ

Is MinIO still safe to use in 2026?
The archived code has no maintainer. No new CVE will be patched by MinIO Inc. in the community repository. For isolated, single-node, non-production use it is fine. For anything audited or internet-facing, it is a documented risk.

Is Ceph S3-compatible?
Yes, via RADOS Gateway (RGW). Standard AWS SDKs, rclone, restic, Velero and most backup tools work without modification. A few newer S3 API features lag behind AWS; check your specific list before migrating.

How many nodes does Ceph need?
Three is the minimum for a cluster that survives one node failure with 3× replication. Erasure coding with sensible failure domains needs five or more. Fewer than three is a lab, not production.

Is AIStor Free a replacement for community MinIO?
For single-node use, yes — and it has more features than the late community builds. Distributed clustering and HA are excluded by licence, not by technical limitation. That is the line between Free and Enterprise Lite.

Ceph or RustFS?
Ceph if you need block storage too, have 3+ nodes, and want a 20-year-old codebase with a published EOL calendar. RustFS if you want a single-binary MinIO replacement and can accept a project in beta with GA still ahead.

How long does a MinIO → Ceph migration take?
2–6 weeks of engineer time for 15–50 TB, including a dual-write validation week. The data copy itself is the smallest part.

Talk to an engineer — 30 minutes, no sales pitch.