Bring your own bucketSFTP to your own MinIO, on hardware you control
When files have to stay on your own hardware, run MinIO and let CloudFile handle the protocols. Partners connect to CloudFile, never to your network, and CloudFile writes into your MinIO bucket over HTTPS with a user limited to one bucket.
MinIO with CloudFile, at a glance.
| Endpoint | Your MinIO S3 API URL, e.g. https://minio.example.com, with a publicly trusted certificate |
|---|---|
| URL style | Path-style, unless you set up MINIO_DOMAIN with wildcard DNS |
| Credentials | A MinIO user with a policy for one bucket, created with mc admin. The user name is the access key. |
| Region | us-east-1, or the value of MINIO_SITE_REGION |
| Pricing model | No storage bill from a provider: you pay for your own hardware and bandwidth |
MinIO prices are from their public website as of October 2026, excluding taxes. Your bucket is billed by MinIO, not by us, and doesn't count toward your plan's storage.
Why pair SFTP with MinIO.
Files on your disks
Storage stays in your rack or your colo. CloudFile only streams uploads through to it.
Partners stay outside
No inbound SSH or FTP ports on your network. Only CloudFile connects, to one HTTPS endpoint you can firewall.
No SSH server to harden
CloudFile runs the SFTP, FTPS and FTP servers, brute-force protection and per-user isolation.
Other self-hosted S3 too
Ceph RGW and other S3-compatible servers work through the Other S3-compatible preset with path-style URLs.
How it works, in three steps.
- Step 1
Create a bucket, policy and user
With mc, create the bucket without locking, a policy for it, and a user with that policy.
mc admin policy attach myminio cloudfile --user cloudfile - Step 2
Connect it in CloudFile
Storage → Add bucket → MinIO. Paste your S3 API URL (not the console port) and the user's credentials.
https://minio.example.com us-east-1 path-style ✓ - Step 3
Uploads go to your MinIO
Each user writes under its own prefix in your bucket, and a webhook or email reports every upload.
acme → minio://acme-sftp/acme/scans/0193.pdf
Every click and field is in the MinIO setup guide.
What your partners see, and where it lands in MinIO.
$ sftp -P 22000 [email protected]
sftp> put invoice-2026-10.pdf
sftp> ls
invoice-2026-10.pdfYour MinIO bucket<bucket>/<folder>/acme/invoice-2026-10.pdf
<bucket>/<folder>/_shared/inbox/…Any SFTP, FTPS or FTP client: FileZilla, WinSCP, Cyberduck, the sftp command or their own system. WebDAV too, if you turn it on.
Their own home folder as /, and nothing else. They never see the bucket name, other users' folders or your keys.
A password, an SSH key or both, with the permissions you pick: full access, read only or upload only.
Shared folders at /shared/<name> when several users need the same files. They live under _shared/<name>/ in your MinIO bucket.
Get these right in MinIO.
The endpoint must be reachable from the internet over https with a certificate from a public CA. Self-signed certificates and private addresses don't work.
Use the S3 API port, not the web console's port.
Leave versioning and object locking off for a normal server. They keep deleted files on disk or block deletes.
Questions about SFTP on MinIO.
Can CloudFile reach MinIO on my LAN or VPN?
No. CloudFile only connects to public addresses over https. Expose the S3 API on a public hostname with a valid certificate, for example behind a reverse proxy, and limit access with your firewall.
Why not run an SFTP server next to MinIO myself?
You can. CloudFile saves you the SSH daemon, user management, FTP passive ports, TLS certificates and webhooks, and keeps partners off your network.
Does it work with Ceph or other S3 servers?
Yes, choose Other S3-compatible and turn on path-style URLs. The server needs https and a public address.
Which region do I enter?
us-east-1, MinIO's default. If you set MINIO_SITE_REGION, use that value.
More in the docs: MinIO setup · Your own bucket · Webhooks
