# AIStor Memory (aimem) RELEASE.2026-10-27T17-44-57Z Released: 2026-10-27 The AIStor Memory (aimem) CSI driver can now run from a private registry that needs credentials, and a `chmod 600` on a Kubernetes volume now stays `600`, so SSH keys and database password files on the mount work. A file that was open for reading through a duplicated descriptor no longer becomes unreadable when the file is then opened for writing. --- ## Downloads ### Binaries | Platform | Architecture | Download | | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------- | | Linux | amd64 | [aimem.RELEASE.2026-10-27T17-44-57Z](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem.RELEASE.2026-10-27T17-44-57Z) | | Linux | arm64 | [aimem.RELEASE.2026-10-27T17-44-57Z](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem.RELEASE.2026-10-27T17-44-57Z) | The setuid `aimem-fusermount` mount helper, the `aimem-bio` binary that `aimem bio` runs, and the Kubernetes CSI node driver are published beside it: | Binary | Architecture | Download | | ------------------ | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------- | | `aimem-fusermount` | amd64 | [aimem-fusermount.RELEASE.2026-10-27T17-44-57Z](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem-fusermount.RELEASE.2026-10-27T17-44-57Z) | | `aimem-fusermount` | arm64 | [aimem-fusermount.RELEASE.2026-10-27T17-44-57Z](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem-fusermount.RELEASE.2026-10-27T17-44-57Z) | | `aimem-bio` | amd64 | [aimem-bio.RELEASE.2026-10-27T17-44-57Z](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem-bio.RELEASE.2026-10-27T17-44-57Z) | | `aimem-bio` | arm64 | [aimem-bio.RELEASE.2026-10-27T17-44-57Z](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem-bio.RELEASE.2026-10-27T17-44-57Z) | | `aimem-csi-driver` | amd64 | [aimem-csi-driver.RELEASE.2026-10-27T17-44-57Z](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem-csi-driver.RELEASE.2026-10-27T17-44-57Z) | | `aimem-csi-driver` | arm64 | [aimem-csi-driver.RELEASE.2026-10-27T17-44-57Z](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem-csi-driver.RELEASE.2026-10-27T17-44-57Z) | Each binary has `.sha256sum`, `.minisig`, and `.asc` files at the same path. These links point into `archive/`, where a release's files stay after a newer release ships, so they always serve this build. The unversioned `…/linux-{arch}/aimem` path serves whatever release is newest. ### Packages `.deb`, `.rpm`, and `.apk` install the `aimem` client, the setuid `aimem-fusermount` mount helper (`/usr/bin/aimem-fusermount`, mode 4755), and `aimem-bio`. They also install a disabled example `mnt-aimem.mount` systemd unit and the `/sbin/mount.aimem` helper it needs. | Format | Architecture | Download | | ------ | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------- | | DEB | amd64 | [aimem_20261027174457.0.0_amd64.deb](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem_20261027174457.0.0_amd64.deb) | | DEB | arm64 | [aimem_20261027174457.0.0_arm64.deb](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem_20261027174457.0.0_arm64.deb) | | RPM | amd64 | [aimem-20261027174457.0.0-1.x86_64.rpm](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem-20261027174457.0.0-1.x86_64.rpm) | | RPM | arm64 | [aimem-20261027174457.0.0-1.aarch64.rpm](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem-20261027174457.0.0-1.aarch64.rpm) | | APK | amd64 | [aimem_20261027174457.0.0_x86_64.apk](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem_20261027174457.0.0_x86_64.apk) | | APK | arm64 | [aimem_20261027174457.0.0_aarch64.apk](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem_20261027174457.0.0_aarch64.apk) | The packages depend only on libc (`libc-bin` / `glibc-common`); no `libfuse` is needed. ### Container Images ```bash # The aimem client, pinned to this release: docker pull quay.io/minio/aistor/aimem:RELEASE.2026-10-27T17-44-57Z # The Kubernetes CSI node driver, pinned to this release: docker pull quay.io/minio/aistor/aimem-csi-driver:RELEASE.2026-10-27T17-44-57Z ``` The `latest` tag of each image also points at this release, but moves when the next one ships. To verify a build, pin the release tag or a `@sha256:` digest, never `latest`. Mounting from a container needs `/dev/fuse`. As root, it also needs `CAP_SYS_ADMIN` (or `--privileged`). As a non-root user, the container needs `SYS_ADMIN` added to its capabilities and `allowPrivilegeEscalation: true`, so the setuid helper can run. ### Verification Each binary is signed with minisign (preferred) and GPG, and has a sha256sum file. ```bash BASE=https://dl.min.io/aistor/aimem/release/linux-amd64/archive curl -fsSLO $BASE/aimem.RELEASE.2026-10-27T17-44-57Z curl -fsSLO $BASE/aimem.RELEASE.2026-10-27T17-44-57Z.minisig curl -fsSLO $BASE/aimem.RELEASE.2026-10-27T17-44-57Z.sha256sum # minisign minisign -Vm aimem.RELEASE.2026-10-27T17-44-57Z \ -P RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGav # sha256: the checksum file names the versioned binary, so keep that file name sha256sum -c aimem.RELEASE.2026-10-27T17-44-57Z.sha256sum ``` The minisign public key above is the MinIO release-signing key, used across the AIStor product line. --- ## Changes since RELEASE.2026-10-23T23-59-20Z ### New Features - **Kubernetes: mounter pods can pull from a registry that needs credentials.** Before, a driver mirrored to a private registry pulled its own image, but every mounter pod failed with `ImagePullBackOff`, so every mount failed. Two new driver options set the mounter pods' pull settings (#269): - `--mounter-image-pull-secrets` (`AIMEM_CSI_MOUNTER_IMAGE_PULL_SECRETS`): comma-separated names of Secrets in the mounter namespace. Unset by default. - `--mounter-image-pull-policy` (`AIMEM_CSI_MOUNTER_IMAGE_PULL_POLICY`): `Always`, `IfNotPresent` (default), or `Never`. A Secret name or policy that is not valid stops the driver at startup. ### Bug Fixes #### Filesystem - On a mount with a shared group (`shared_gid`, which the CSI driver sets from the pod's `fsGroup`), `chmod 600` read back as `660`. OpenSSH, libpq and other tools that check permissions refused the file. A mode set by `chmod` is now reported as set, and it persists across remounts as `aimem-mode-explicit` object metadata. Files that were never `chmod`ed still share their owner bits with the group. (#251) - A process reading a file through a duplicated or inherited descriptor could get `EBADF` ("file handle has been invalidated by a newer handle opened") after closing one copy of it, once the same file was opened for writing. Those reads now continue. (#268) #### Kubernetes CSI driver - `--token-exchange-ca-configmap` now accepts any valid ConfigMap name. Before, a name with a dot-separated part longer than 63 characters stopped the driver at startup. (#269) ### Security Updates - **`aimem-bio`: `zstd-sys` 2.1.2** for [RUSTSEC-2026-0410](https://rustsec.org/advisories/RUSTSEC-2026-0410.html). The flaw affects only WebAssembly builds, so the Linux binaries were not exposed; this update clears it from scanner reports. Scanners will still report [RUSTSEC-2026-0391](https://rustsec.org/advisories/RUSTSEC-2026-0391.html), [RUSTSEC-2026-0398](https://rustsec.org/advisories/RUSTSEC-2026-0398.html) and [RUSTSEC-2026-0403](https://rustsec.org/advisories/RUSTSEC-2026-0403.html) against `zstd` 0.13 in `aimem-bio`. None is reachable: `aimem-bio` does not call the affected functions or enable the affected feature. They clear when its Avro dependency moves to a fixed `zstd`. (#264) ### Platform / Compatibility - Linux amd64 and arm64, glibc 2.34 or later. - Mounting needs `/dev/fuse`. As root, or with `CAP_SYS_ADMIN`, aimem mounts directly; any other user mounts through the setuid `aimem-fusermount` helper. FUSE passthrough also needs `CAP_SYS_ADMIN`; without it, a mount serves ordinary FUSE reads. --- ## Security & Compliance Software bills of materials (SBOMs) for this release, generated from the `Cargo.lock` files at the release tag: | Component | SPDX | CycloneDX | | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | | `aimem` | [aimem-RELEASE.2026-10-27T17-44-57Z.spdx.json](https://dl.min.io/aistor/aimem/release/notes/aimem-RELEASE.2026-10-27T17-44-57Z.spdx.json) | [aimem-RELEASE.2026-10-27T17-44-57Z.cdx.json](https://dl.min.io/aistor/aimem/release/notes/aimem-RELEASE.2026-10-27T17-44-57Z.cdx.json) | | `aimem-bio` | [aimem-bio-RELEASE.2026-10-27T17-44-57Z.spdx.json](https://dl.min.io/aistor/aimem/release/notes/aimem-bio-RELEASE.2026-10-27T17-44-57Z.spdx.json) | [aimem-bio-RELEASE.2026-10-27T17-44-57Z.cdx.json](https://dl.min.io/aistor/aimem/release/notes/aimem-bio-RELEASE.2026-10-27T17-44-57Z.cdx.json) | | `aimem-csi-driver` | [aimem-csi-RELEASE.2026-10-27T17-44-57Z.spdx.json](https://dl.min.io/aistor/aimem/release/notes/aimem-csi-RELEASE.2026-10-27T17-44-57Z.spdx.json) | [aimem-csi-RELEASE.2026-10-27T17-44-57Z.cdx.json](https://dl.min.io/aistor/aimem/release/notes/aimem-csi-RELEASE.2026-10-27T17-44-57Z.cdx.json) | For `aimem`, also the [crate list](https://dl.min.io/aistor/aimem/release/notes/aimem-RELEASE.2026-10-27T17-44-57Z.crates.txt) and [dependency tree](https://dl.min.io/aistor/aimem/release/notes/aimem-RELEASE.2026-10-27T17-44-57Z.cargo-tree.txt). --- ## Upgrade Instructions - **Kubernetes:** pin both image references in the DaemonSet to `quay.io/minio/aistor/aimem-csi-driver:RELEASE.2026-10-27T17-44-57Z`. Existing settings keep working. - **Private registry:** create the pull Secret in the mounter namespace (default `aimem-csi-mounters`) as well as in the driver's namespace, then set `AIMEM_CSI_MOUNTER_IMAGE_PULL_SECRETS` to its name. This release's `daemonset.yaml` shows it as a commented example. - **Private files on a shared-group volume:** a file created with mode `0600` but never `chmod`ed still reads as `660`. Run `chmod 600` on SSH keys and similar files after writing them. Files `chmod`ed before this upgrade need it again, since earlier releases did not record the mode as set. ## Documentation - Hosted docs: ## Support - Security disclosures: security@min.io - Licensed customers and contributors: contact MinIO support.