# AIStor Memory (aimem) RELEASE.2026-11-04T23-12-53Z Released: 2026-11-04 This AIStor Memory (aimem) release fixes files left empty when two programs write them at once, as under gVisor sandboxes, and stale copies left in the bucket by renaming a file open for writing. It also sizes aimem's memory use to a container's memory limit, lets the CSI driver give each pod from one template its own folder, and expires the `aimem-bio` collector's old table snapshots. --- ## Downloads ### Binaries | Platform | Architecture | Download | | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------- | | Linux | amd64 | [aimem.RELEASE.2026-11-04T23-12-53Z](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem.RELEASE.2026-11-04T23-12-53Z) | | Linux | arm64 | [aimem.RELEASE.2026-11-04T23-12-53Z](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem.RELEASE.2026-11-04T23-12-53Z) | The setuid `aimem-fusermount` mount helper, the `aimem-bio` binary that `aimem bio` runs, and the Kubernetes CSI node driver are published beside it: | Binary | Architecture | Download | | ------------------ | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------- | | `aimem-fusermount` | amd64 | [aimem-fusermount.RELEASE.2026-11-04T23-12-53Z](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem-fusermount.RELEASE.2026-11-04T23-12-53Z) | | `aimem-fusermount` | arm64 | [aimem-fusermount.RELEASE.2026-11-04T23-12-53Z](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem-fusermount.RELEASE.2026-11-04T23-12-53Z) | | `aimem-bio` | amd64 | [aimem-bio.RELEASE.2026-11-04T23-12-53Z](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem-bio.RELEASE.2026-11-04T23-12-53Z) | | `aimem-bio` | arm64 | [aimem-bio.RELEASE.2026-11-04T23-12-53Z](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem-bio.RELEASE.2026-11-04T23-12-53Z) | | `aimem-csi-driver` | amd64 | [aimem-csi-driver.RELEASE.2026-11-04T23-12-53Z](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem-csi-driver.RELEASE.2026-11-04T23-12-53Z) | | `aimem-csi-driver` | arm64 | [aimem-csi-driver.RELEASE.2026-11-04T23-12-53Z](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem-csi-driver.RELEASE.2026-11-04T23-12-53Z) | Each binary has `.sha256sum`, `.minisig`, and `.asc` files at the same path. These links point into `archive/`, where a release's files stay after a newer release ships, so they always serve this build. The unversioned `…/linux-{arch}/aimem` path serves whatever release is newest. ### Packages `.deb`, `.rpm`, and `.apk` install the `aimem` client, the setuid `aimem-fusermount` mount helper (`/usr/bin/aimem-fusermount`, mode 4755), and `aimem-bio`. They also install a disabled example `mnt-aimem.mount` systemd unit and the `/sbin/mount.aimem` helper it needs. | Format | Architecture | Download | | ------ | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------- | | DEB | amd64 | [aimem_20261104231253.0.0_amd64.deb](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem_20261104231253.0.0_amd64.deb) | | DEB | arm64 | [aimem_20261104231253.0.0_arm64.deb](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem_20261104231253.0.0_arm64.deb) | | RPM | amd64 | [aimem-20261104231253.0.0-1.x86_64.rpm](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem-20261104231253.0.0-1.x86_64.rpm) | | RPM | arm64 | [aimem-20261104231253.0.0-1.aarch64.rpm](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem-20261104231253.0.0-1.aarch64.rpm) | | APK | amd64 | [aimem_20261104231253.0.0_x86_64.apk](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem_20261104231253.0.0_x86_64.apk) | | APK | arm64 | [aimem_20261104231253.0.0_aarch64.apk](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem_20261104231253.0.0_aarch64.apk) | The packages depend only on libc (`libc-bin` / `glibc-common`); no `libfuse` is needed. ### Container Images ```bash # The aimem client, pinned to this release: docker pull quay.io/minio/aistor/aimem:RELEASE.2026-11-04T23-12-53Z # The Kubernetes CSI node driver, pinned to this release: docker pull quay.io/minio/aistor/aimem-csi-driver:RELEASE.2026-11-04T23-12-53Z ``` The `latest` tag of each image also points at this release, but moves when the next one ships. To verify a build, pin the release tag or a `@sha256:` digest, never `latest`. Mounting from a container needs `/dev/fuse`. As root, it also needs `CAP_SYS_ADMIN` (or `--privileged`). As a non-root user, the container needs `SYS_ADMIN` added to its capabilities and `allowPrivilegeEscalation: true`, so the setuid helper can run. ### Verification Each binary is signed with minisign (preferred) and GPG, and has a sha256sum file. ```bash BASE=https://dl.min.io/aistor/aimem/release/linux-amd64/archive curl -fsSLO $BASE/aimem.RELEASE.2026-11-04T23-12-53Z curl -fsSLO $BASE/aimem.RELEASE.2026-11-04T23-12-53Z.minisig curl -fsSLO $BASE/aimem.RELEASE.2026-11-04T23-12-53Z.sha256sum # minisign minisign -Vm aimem.RELEASE.2026-11-04T23-12-53Z \ -P RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGav # sha256: the checksum file names the versioned binary, so keep that file name sha256sum -c aimem.RELEASE.2026-11-04T23-12-53Z.sha256sum ``` The minisign public key above is the MinIO release-signing key, used across the AIStor product line. --- ## Changes since RELEASE.2026-10-30T22-40-52Z ### New Features #### Kubernetes CSI driver - A volume's `prefix` can now contain `{pod.name}`, which the driver replaces with the name of the pod the volume is mounted for. Every pod made from one template, such as a warm pool, then mounts a folder of its own. (#284) - Pods made from one template can share one credentials Secret. A `generation.` key in that Secret refreshes that one pod's session, and takes precedence over the shared `generation` key. (#284) #### Telemetry collector (`aimem-bio`) - `aimem bio serve` now expires its own tables' old snapshots. About once an hour, it removes snapshots older than 24 hours, always keeps the current one, and records that retention as the tables' `history.expire.max-snapshot-age-ms` and `history.expire.min-snapshots-to-keep` properties. Expiry does not delete rows and does not reclaim storage. (#283) ### Bug Fixes #### Writing files - When two descriptors had one file open for writing, writes through the second failed with `EBUSY`. If that second open used `O_TRUNC`, the file was left empty. It hit gVisor sandboxes, which hold a descriptor open after setting a file's times, and two programs appending to one file at once. Every descriptor open for writing can now write the file. (#279) - Renaming a file that already existed in the bucket while it was open for writing left a stale copy under the old name. The object now moves to the new name when `rename()` returns. (#280) #### Memory use - In a container or cgroup with a memory limit, aimem sized its memory use from the host's memory, not the limit. A large sequential read could then exceed the limit and get the mount killed, so every open file returned `ENOTCONN`. The default `max_memory_target` is now at most 75% of the cgroup memory limit. This includes CSI mounter pods and systemd units with `MemoryMax=`. (#281) #### Telemetry collector (`aimem-bio`) - A long-running `aimem bio serve` slowed down and grew in memory as its tables collected snapshots, until a container memory limit killed it. Snapshot expiry (above) removes that cause. Each table's manifest list still grows slightly with every commit, and expired metadata files stay in the bucket. (#283) ### Behaviour Changes - **`aimem-bio` deduplication window.** A payload is now written once per table within 24 hours of its first commit, not forever. Exporter retries, spool replays and retries after a lost response all happen well inside that window. A payload re-sent more than 24 hours later is written again. (#283) - **CSI prefix placeholders.** A volume publish is now refused when its `prefix` contains `{pod.name}` and kubelet passed no pod name, or when it contains any other `{pod.…}` placeholder. Earlier drivers mounted such a prefix as literal text. (#284) ### Security Updates - `aimem-bio` no longer depends on the `thrift` crate, which is affected by [RUSTSEC-2026-0435](https://rustsec.org/advisories/RUSTSEC-2026-0435.html) / [CVE-2026-43868](https://www.cve.org/CVERecord?id=CVE-2026-43868), an unbounded allocation in `thrift`'s binary protocol. Earlier releases did not use the affected code, but scanners reported it. Arrow and Parquet move to 60. (#282) - `chacha20` moves from a yanked version to 0.10.2 ([RUSTSEC-2026-0404](https://rustsec.org/advisories/RUSTSEC-2026-0404.html)). (#277) ### Platform / Compatibility - Linux amd64 and arm64, glibc 2.34 or later. - Mounting needs `/dev/fuse`. As root, or with `CAP_SYS_ADMIN`, aimem mounts directly; any other user mounts through the setuid `aimem-fusermount` helper. FUSE passthrough also needs `CAP_SYS_ADMIN`; without it, a mount serves ordinary FUSE reads. --- ## Security & Compliance Software bills of materials (SBOMs) for this release, generated from the `Cargo.lock` files at the release tag. | Component | SPDX | CycloneDX | | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | | `aimem` | [aimem-RELEASE.2026-11-04T23-12-53Z.spdx.json](https://dl.min.io/aistor/aimem/release/notes/aimem-RELEASE.2026-11-04T23-12-53Z.spdx.json) | [aimem-RELEASE.2026-11-04T23-12-53Z.cdx.json](https://dl.min.io/aistor/aimem/release/notes/aimem-RELEASE.2026-11-04T23-12-53Z.cdx.json) | | `aimem-bio` | [aimem-bio-RELEASE.2026-11-04T23-12-53Z.spdx.json](https://dl.min.io/aistor/aimem/release/notes/aimem-bio-RELEASE.2026-11-04T23-12-53Z.spdx.json) | [aimem-bio-RELEASE.2026-11-04T23-12-53Z.cdx.json](https://dl.min.io/aistor/aimem/release/notes/aimem-bio-RELEASE.2026-11-04T23-12-53Z.cdx.json) | | `aimem-csi-driver` | [aimem-csi-RELEASE.2026-11-04T23-12-53Z.spdx.json](https://dl.min.io/aistor/aimem/release/notes/aimem-csi-RELEASE.2026-11-04T23-12-53Z.spdx.json) | [aimem-csi-RELEASE.2026-11-04T23-12-53Z.cdx.json](https://dl.min.io/aistor/aimem/release/notes/aimem-csi-RELEASE.2026-11-04T23-12-53Z.cdx.json) | For `aimem`, also the [crate list](https://dl.min.io/aistor/aimem/release/notes/aimem-RELEASE.2026-11-04T23-12-53Z.crates.txt) and [dependency tree](https://dl.min.io/aistor/aimem/release/notes/aimem-RELEASE.2026-11-04T23-12-53Z.cargo-tree.txt). --- ## Upgrade Instructions - **Kubernetes:** pin both image references in the DaemonSet to `quay.io/minio/aistor/aimem-csi-driver:RELEASE.2026-11-04T23-12-53Z`. Mounts survive a driver upgrade, so a running mounter pod keeps its earlier `aimem` until the workload pod that uses the volume is deleted and recreated. If you removed or raised the mounter's memory limit because mounts were OOM-killed, restore it once the mounter pods run this release. - **Containers and systemd units with a memory limit:** if you set `max_memory_target` only to keep aimem under the limit, you can remove it. An explicit `max_memory_target` still overrides the default. - **`aimem-bio`:** no action is needed. The first snapshot expiry runs within an hour of start-up, and sets the retention properties on each table it writes to. - **Upgrading from a release before RELEASE.2026-10-30T18-15-12Z:** read the [RELEASE.2026-10-30T18-15-12Z notes](https://dl.min.io/aistor/aimem/release/notes/release-notes-RELEASE.2026-10-30T18-15-12Z.md) first. They reserve six bucket names for the new top-level commands and make `aimem delete` ask for confirmation. ## Documentation - Hosted docs: ## Support - Security disclosures: security@min.io - Licensed customers and contributors: contact MinIO support.