fmt

This fixes the mount read throughput issue where HTTP GET requests to the
same volume server were being serialized even with high -concurrentReaders.

The issue was that:
1. HTTP/2 multiplexes all requests over a single TCP connection
2. Even with HTTP/1.1, ForceAttemptHTTP2 defaults to true in Go

Changes:
- Set ForceAttemptHTTP2: false on http.Transport to disable HTTP/2
- Set MaxConnsPerHost: 0 (unlimited) to allow parallel connections per host
- For HTTPS, set NextProtos to only 'http/1.1' to prevent HTTP/2 negotiation

This allows multiple goroutines to use separate TCP connections to the same
volume server, enabling true parallel chunk fetching and better network
bandwidth utilization.

Relates to: #7504

.github/pull_request_template.md

@@ -5,6 +5,7 @@
 # How are we solving the problem?
 
 
+
 # How is the PR tested?
 
 
@@ -12,8 +13,3 @@
 # Checks
 - [ ] I have added unit tests if possible.
 - [ ] I will add related wiki document changes and link to this PR after merging.
-- [ ] All AI code review comments have been addressed. No more comments to fix if reviewed again. Reviewer may request additional gemini and copilot reviews.
-
-# Checks for AI generated PRs
-- [ ] I have reviewed every line of code.
-- [ ] The PR is kept as minimum as possible. Large PRs would not be accepted.

.github/workflows/binaries_dev.yml

@@ -38,13 +38,13 @@ jobs:
     steps:
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v2
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v2
 
       - name: Set BUILD_TIME env
         run: echo BUILD_TIME=$(date -u +%Y%m%d-%H%M) >> ${GITHUB_ENV}
 
       - name: Go Release Binaries Large Disk
-        uses: wangyoucao577/go-release-action@279495102627de7960cbc33434ab01a12bae144b # v1.22
+        uses: wangyoucao577/go-release-action@481a2c1a0f1be199722e3e9b74d7199acafc30a8 # v1.22
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           goos: ${{ matrix.goos }}
@@ -60,7 +60,7 @@ jobs:
           asset_name: "weed-large-disk-${{ env.BUILD_TIME }}-${{ matrix.goos }}-${{ matrix.goarch }}"
 
       - name: Go Release Binaries Normal Volume Size
-        uses: wangyoucao577/go-release-action@279495102627de7960cbc33434ab01a12bae144b # v1.22
+        uses: wangyoucao577/go-release-action@481a2c1a0f1be199722e3e9b74d7199acafc30a8 # v1.22
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           goos: ${{ matrix.goos }}
@@ -87,13 +87,13 @@ jobs:
     steps:
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v2
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v2
 
       - name: Set BUILD_TIME env
         run: echo BUILD_TIME=$(date -u +%Y%m%d-%H%M) >> ${GITHUB_ENV}
 
       - name: Go Release Binaries Large Disk
-        uses: wangyoucao577/go-release-action@279495102627de7960cbc33434ab01a12bae144b # v1.22
+        uses: wangyoucao577/go-release-action@481a2c1a0f1be199722e3e9b74d7199acafc30a8 # v1.22
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           goos: ${{ matrix.goos }}
@@ -109,7 +109,7 @@ jobs:
           asset_name: "weed-large-disk-${{ env.BUILD_TIME }}-${{ matrix.goos }}-${{ matrix.goarch }}"
 
       - name: Go Release Binaries Normal Volume Size
-        uses: wangyoucao577/go-release-action@279495102627de7960cbc33434ab01a12bae144b # v1.22
+        uses: wangyoucao577/go-release-action@481a2c1a0f1be199722e3e9b74d7199acafc30a8 # v1.22
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           goos: ${{ matrix.goos }}

.github/workflows/binaries_release0.yml

@@ -28,9 +28,9 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v2
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v2
       - name: Go Release Binaries Normal Volume Size
-        uses: wangyoucao577/go-release-action@279495102627de7960cbc33434ab01a12bae144b # v1.22
+        uses: wangyoucao577/go-release-action@481a2c1a0f1be199722e3e9b74d7199acafc30a8 # v1.22
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           goos: ${{ matrix.goos }}
@@ -44,7 +44,7 @@ jobs:
           binary_name: weed
           asset_name: "${{ matrix.goos }}_${{ matrix.goarch }}"
       - name: Go Release Large Disk Binaries
-        uses: wangyoucao577/go-release-action@279495102627de7960cbc33434ab01a12bae144b # v1.22
+        uses: wangyoucao577/go-release-action@481a2c1a0f1be199722e3e9b74d7199acafc30a8 # v1.22
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           goos: ${{ matrix.goos }}

.github/workflows/binaries_release1.yml

@@ -28,9 +28,9 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v2
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v2
       - name: Go Release Binaries Normal Volume Size
-        uses: wangyoucao577/go-release-action@279495102627de7960cbc33434ab01a12bae144b # v1.22
+        uses: wangyoucao577/go-release-action@481a2c1a0f1be199722e3e9b74d7199acafc30a8 # v1.22
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           goos: ${{ matrix.goos }}
@@ -44,7 +44,7 @@ jobs:
           binary_name: weed
           asset_name: "${{ matrix.goos }}_${{ matrix.goarch }}"
       - name: Go Release Large Disk Binaries
-        uses: wangyoucao577/go-release-action@279495102627de7960cbc33434ab01a12bae144b # v1.22
+        uses: wangyoucao577/go-release-action@481a2c1a0f1be199722e3e9b74d7199acafc30a8 # v1.22
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           goos: ${{ matrix.goos }}

.github/workflows/binaries_release2.yml

@@ -28,9 +28,9 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v2
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v2
       - name: Go Release Binaries Normal Volume Size
-        uses: wangyoucao577/go-release-action@279495102627de7960cbc33434ab01a12bae144b # v1.22
+        uses: wangyoucao577/go-release-action@481a2c1a0f1be199722e3e9b74d7199acafc30a8 # v1.22
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           goos: ${{ matrix.goos }}
@@ -44,7 +44,7 @@ jobs:
           binary_name: weed
           asset_name: "${{ matrix.goos }}_${{ matrix.goarch }}"
       - name: Go Release Large Disk Binaries
-        uses: wangyoucao577/go-release-action@279495102627de7960cbc33434ab01a12bae144b # v1.22
+        uses: wangyoucao577/go-release-action@481a2c1a0f1be199722e3e9b74d7199acafc30a8 # v1.22
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           goos: ${{ matrix.goos }}

.github/workflows/binaries_release3.yml

@@ -28,9 +28,9 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v2
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v2
       - name: Go Release Binaries Normal Volume Size
-        uses: wangyoucao577/go-release-action@279495102627de7960cbc33434ab01a12bae144b # v1.22
+        uses: wangyoucao577/go-release-action@481a2c1a0f1be199722e3e9b74d7199acafc30a8 # v1.22
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           goos: ${{ matrix.goos }}
@@ -44,7 +44,7 @@ jobs:
           binary_name: weed
           asset_name: "${{ matrix.goos }}_${{ matrix.goarch }}"
       - name: Go Release Large Disk Binaries
-        uses: wangyoucao577/go-release-action@279495102627de7960cbc33434ab01a12bae144b # v1.22
+        uses: wangyoucao577/go-release-action@481a2c1a0f1be199722e3e9b74d7199acafc30a8 # v1.22
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           goos: ${{ matrix.goos }}

.github/workflows/binaries_release4.yml

@@ -28,9 +28,9 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v2
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v2
       - name: Go Release Binaries Normal Volume Size
-        uses: wangyoucao577/go-release-action@279495102627de7960cbc33434ab01a12bae144b # v1.22
+        uses: wangyoucao577/go-release-action@481a2c1a0f1be199722e3e9b74d7199acafc30a8 # v1.22
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           goos: ${{ matrix.goos }}
@@ -45,7 +45,7 @@ jobs:
           binary_name: weed
           asset_name: "${{ matrix.goos }}_${{ matrix.goarch }}_full"
       - name: Go Release Large Disk Binaries
-        uses: wangyoucao577/go-release-action@279495102627de7960cbc33434ab01a12bae144b # v1.22
+        uses: wangyoucao577/go-release-action@481a2c1a0f1be199722e3e9b74d7199acafc30a8 # v1.22
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           goos: ${{ matrix.goos }}

.github/workflows/binaries_release5.yml

@@ -28,9 +28,9 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v2
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v2
       - name: Go Release Binaries Normal Volume Size
-        uses: wangyoucao577/go-release-action@279495102627de7960cbc33434ab01a12bae144b # v1.22
+        uses: wangyoucao577/go-release-action@481a2c1a0f1be199722e3e9b74d7199acafc30a8 # v1.22
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           goos: ${{ matrix.goos }}
@@ -44,7 +44,7 @@ jobs:
           binary_name: weed
           asset_name: "${{ matrix.goos }}_${{ matrix.goarch }}"
       - name: Go Release Large Disk Binaries
-        uses: wangyoucao577/go-release-action@279495102627de7960cbc33434ab01a12bae144b # v1.22
+        uses: wangyoucao577/go-release-action@481a2c1a0f1be199722e3e9b74d7199acafc30a8 # v1.22
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           goos: ${{ matrix.goos }}

.github/workflows/codeql.yml

@@ -18,7 +18,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL

.github/workflows/container_dev.yml

@@ -3,6 +3,7 @@ name: "docker: build dev containers"
 on:
   push:
     branches: [ master ]
+  workflow_dispatch: {}
 
 permissions:
   contents: read
@@ -15,11 +16,11 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v2
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v2
       -
         name: Docker meta
         id: docker_meta
-        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v3
+        uses: docker/metadata-action@318604b99e75e41977312d83839a89be02ca4893 # v3
         with:
           images: |
             chrislusf/seaweedfs
@@ -32,7 +33,7 @@ jobs:
             org.opencontainers.image.vendor=Chris Lu
       -
         name: Set up QEMU
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v1
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v1
       -
         name: Create BuildKit config
         run: |
@@ -42,28 +43,28 @@ jobs:
           EOF
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v1
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v1
         with:
           buildkitd-flags: "--debug"
           buildkitd-config: /tmp/buildkitd.toml
       -
         name: Login to Docker Hub
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v1
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v1
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
       -
         name: Login to GHCR
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v1
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v1
         with:
           registry: ghcr.io
           username: ${{ secrets.GHCR_USERNAME }}
           password: ${{ secrets.GHCR_TOKEN }}
       -
         name: Build
-        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v2
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v2
         with:
           context: ./docker
           push: ${{ github.event_name != 'pull_request' }}

.github/workflows/container_foundationdb_version.yml

@@ -126,14 +126,14 @@ jobs:
           echo "seaweedfs_ref=$seaweed" >> "$GITHUB_OUTPUT"
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@v3
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3
 
       - name: Login to Docker Hub
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
@@ -150,7 +150,7 @@ jobs:
           fi
 
       - name: Build and push image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v6
         with:
           context: ./docker
           push: ${{ github.event_name != 'pull_request' }}

.github/workflows/container_latest.yml

@@ -4,73 +4,29 @@ on:
   push:
     tags:
       - '*'
-  workflow_dispatch:
-    inputs:
-      source_ref:
-        description: 'Git ref to build (branch, tag, or commit SHA)'
-        required: true
-        default: 'master'
-      image_tag:
-        description: 'Docker tag to publish (without variant suffix)'
-        required: true
-        default: 'latest'
-      variant:
-        description: 'Variant to build manually'
-        required: true
-        type: choice
-        default: all
-        options:
-          - all
-          - standard
-          - large_disk
-      publish:
-        description: 'Publish images and manifests'
-        required: true
-        type: boolean
-        default: false
+  workflow_dispatch: {}
 
 permissions:
   contents: read
-  security-events: write
 
 jobs:
-  setup:
-    runs-on: ubuntu-latest
-    outputs:
-      variants: ${{ steps.set-variants.outputs.variants }}
-      publish: ${{ steps.set-publish.outputs.publish }}
-    steps:
-      - name: Select variants for this run
-        id: set-variants
-        run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ] && [ "${{ github.event.inputs.variant }}" != "all" ]; then
-            variants="[\"${{ github.event.inputs.variant }}\"]"
-          else
-            variants='["standard","large_disk"]'
-          fi
-          echo "variants=$variants" >> "$GITHUB_OUTPUT"
-      - name: Select publish mode
-        id: set-publish
-        run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            echo "publish=${{ github.event.inputs.publish }}" >> "$GITHUB_OUTPUT"
-          else
-            echo "publish=true" >> "$GITHUB_OUTPUT"
-          fi
-
   build:
-    needs: [setup]
     runs-on: ubuntu-latest
     strategy:
       matrix:
         platform: [amd64, arm64, arm, 386]
-        variant: ${{ fromJSON(needs.setup.outputs.variants) }}
-
+        include:
+          - platform: amd64
+            qemu: false
+          - platform: arm64
+            qemu: true
+          - platform: arm
+            qemu: true
+          - platform: 386
+            qemu: true
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.source_ref || github.ref }}
+        uses: actions/checkout@v4
       - name: Free Disk Space
         run: |
           echo "Available disk space before cleanup:"
@@ -87,33 +43,21 @@ jobs:
           [ -d /go/pkg ] && rm -rf /go/pkg || true
           echo "Available disk space after cleanup:"
           df -h
-      
-      - name: Configure variant
-        id: config
-        run: |
-          if [ "${{ matrix.variant }}" == "large_disk" ]; then
-            echo "tag_suffix=_large_disk" >> $GITHUB_OUTPUT
-            echo "build_args=TAGS=5BytesOffset" >> $GITHUB_OUTPUT
-          else
-            echo "tag_suffix=" >> $GITHUB_OUTPUT
-            echo "build_args=" >> $GITHUB_OUTPUT
-          fi
-
       - name: Docker meta
         id: docker_meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@v5
         with:
           images: |
             chrislusf/seaweedfs
             ghcr.io/chrislusf/seaweedfs
-          tags: type=raw,value=${{ github.event_name == 'workflow_dispatch' && github.event.inputs.image_tag || 'latest' }},suffix=${{ steps.config.outputs.tag_suffix }}
+          tags: type=raw,value=latest
           labels: |
             org.opencontainers.image.title=seaweedfs
             org.opencontainers.image.description=SeaweedFS is a distributed storage system for blobs, objects, files, and data lake, to store and serve billions of files fast!
             org.opencontainers.image.vendor=Chris Lu
       - name: Set up QEMU
-        if: matrix.platform != 'amd64'
-        uses: docker/setup-qemu-action@v4
+        if: matrix.qemu
+        uses: docker/setup-qemu-action@v3
       - name: Create BuildKit config
         run: |
           cat > /tmp/buildkitd.toml <<EOF
@@ -121,41 +65,40 @@ jobs:
             mirrors = ["https://mirror.gcr.io"]
           EOF
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3
         with:
           buildkitd-flags: "--debug"
           buildkitd-config: /tmp/buildkitd.toml
       - name: Login to Docker Hub
-        if: needs.setup.outputs.publish == 'true'
-        uses: docker/login-action@v4
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
       - name: Login to GHCR
-        if: needs.setup.outputs.publish == 'true'
-        uses: docker/login-action@v4
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ secrets.GHCR_USERNAME }}
           password: ${{ secrets.GHCR_TOKEN }}
-      - name: Build ${{ matrix.platform }} ${{ matrix.variant }}
-        uses: docker/build-push-action@v7
+      - name: Build ${{ matrix.platform }}
+        uses: docker/build-push-action@v5
         env:
           DOCKER_BUILDKIT: 1
         with:
           context: ./docker
-          push: ${{ needs.setup.outputs.publish == 'true' }}
+          push: ${{ github.event_name != 'pull_request' }}
           file: ./docker/Dockerfile.go_build
           platforms: linux/${{ matrix.platform }}
           # Push to GHCR only during build to avoid Docker Hub rate limits
-          tags: ghcr.io/chrislusf/seaweedfs:${{ github.event_name == 'workflow_dispatch' && github.event.inputs.image_tag || 'latest' }}${{ steps.config.outputs.tag_suffix }}-${{ matrix.platform }}
+          tags: ghcr.io/chrislusf/seaweedfs:latest-${{ matrix.platform }}
           labels: ${{ steps.docker_meta.outputs.labels }}
-          cache-from: type=gha,scope=${{ matrix.variant }}-${{ matrix.platform }}
-          cache-to: type=gha,mode=max,scope=${{ matrix.variant }}-${{ matrix.platform }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
           build-args: |
             BUILDKIT_INLINE_CACHE=1
-            BRANCH=${{ github.event_name == 'workflow_dispatch' && github.event.inputs.source_ref || github.sha }}
-            ${{ steps.config.outputs.build_args }}
+            BRANCH=${{ github.sha }}
       - name: Clean up build artifacts
         if: always()
         run: |
@@ -164,161 +107,28 @@ jobs:
           # Remove Go build cache
           sudo rm -rf /tmp/go-build*
 
-  trivy-scan:
-    runs-on: ubuntu-latest
-    needs: [setup, build]
-    strategy:
-      matrix:
-        variant: ${{ fromJSON(needs.setup.outputs.variants) }}
-    steps:
-      - name: Configure variant
-        id: config
-        run: |
-          if [ "${{ matrix.variant }}" == "large_disk" ]; then
-            echo "tag_suffix=_large_disk" >> $GITHUB_OUTPUT
-          else
-            echo "tag_suffix=" >> $GITHUB_OUTPUT
-          fi
-      - name: Login to GHCR
-        if: needs.setup.outputs.publish == 'true'
-        uses: docker/login-action@v4
-        with:
-          registry: ghcr.io
-          username: ${{ secrets.GHCR_USERNAME }}
-          password: ${{ secrets.GHCR_TOKEN }}
-      - name: Checkout for local scan build
-        if: needs.setup.outputs.publish != 'true'
-        uses: actions/checkout@v6
-        with:
-          ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.source_ref || github.ref }}
-      - name: Create BuildKit config for local scan build
-        if: needs.setup.outputs.publish != 'true'
-        run: |
-          cat > /tmp/buildkitd.toml <<EOF
-          [registry."docker.io"]
-            mirrors = ["https://mirror.gcr.io"]
-          EOF
-      - name: Set up Docker Buildx for local scan build
-        if: needs.setup.outputs.publish != 'true'
-        uses: docker/setup-buildx-action@v4
-        with:
-          buildkitd-flags: "--debug"
-          buildkitd-config: /tmp/buildkitd.toml
-      - name: Build local scan image tarball
-        if: needs.setup.outputs.publish != 'true'
-        uses: docker/build-push-action@v7
-        env:
-          DOCKER_BUILDKIT: 1
-        with:
-          context: ./docker
-          file: ./docker/Dockerfile.go_build
-          platforms: linux/amd64
-          outputs: type=docker,dest=/tmp/seaweedfs${{ steps.config.outputs.tag_suffix }}-amd64.tar
-          build-args: |
-            BUILDKIT_INLINE_CACHE=1
-            BRANCH=${{ github.event_name == 'workflow_dispatch' && github.event.inputs.source_ref || github.sha }}
-            ${{ matrix.variant == 'large_disk' && 'TAGS=5BytesOffset' || '' }}
-      - name: Trivy report (published image)
-        if: needs.setup.outputs.publish == 'true'
-        # Pin to SHA - mutable tags were compromised (GHSA-69fq-xp46-6x23)
-        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
-        with:
-          scan-type: image
-          # Scan amd64 only - OS packages are identical across architectures
-          # since they all use the same alpine base, so a single-arch scan
-          # provides sufficient coverage without multiplying CI time.
-          image-ref: ghcr.io/chrislusf/seaweedfs:${{ github.event_name == 'workflow_dispatch' && github.event.inputs.image_tag || 'latest' }}${{ steps.config.outputs.tag_suffix }}-amd64
-          scanners: vuln
-          vuln-type: os,library
-          severity: HIGH,CRITICAL
-          ignore-unfixed: true
-          limit-severities-for-sarif: true
-          format: sarif
-          output: trivy-results.sarif
-          exit-code: '0'
-      - name: Trivy report (local tarball)
-        if: needs.setup.outputs.publish != 'true'
-        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
-        with:
-          input: /tmp/seaweedfs${{ steps.config.outputs.tag_suffix }}-amd64.tar
-          scanners: vuln
-          vuln-type: os,library
-          severity: HIGH,CRITICAL
-          ignore-unfixed: true
-          limit-severities-for-sarif: true
-          format: sarif
-          output: trivy-results.sarif
-          exit-code: '0'
-      - name: Upload Trivy scan results to GitHub Security
-        uses: github/codeql-action/upload-sarif@v4
-        if: always()
-        with:
-          sarif_file: trivy-results.sarif
-      - name: Trivy gate (published image)
-        if: needs.setup.outputs.publish == 'true'
-        # Gate only on fixable high/critical vulnerabilities. Non-fixable
-        # findings are still visible in the SARIF upload above.
-        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
-        with:
-          scan-type: image
-          image-ref: ghcr.io/chrislusf/seaweedfs:${{ github.event_name == 'workflow_dispatch' && github.event.inputs.image_tag || 'latest' }}${{ steps.config.outputs.tag_suffix }}-amd64
-          scanners: vuln
-          vuln-type: os,library
-          severity: HIGH,CRITICAL
-          ignore-unfixed: true
-          format: table
-          exit-code: '1'
-          skip-setup-trivy: true
-      - name: Trivy gate (local tarball)
-        if: needs.setup.outputs.publish != 'true'
-        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
-        with:
-          input: /tmp/seaweedfs${{ steps.config.outputs.tag_suffix }}-amd64.tar
-          scanners: vuln
-          vuln-type: os,library
-          severity: HIGH,CRITICAL
-          ignore-unfixed: true
-          format: table
-          exit-code: '1'
-          skip-setup-trivy: true
-
   create-manifest:
     runs-on: ubuntu-latest
-    needs: [setup, build, trivy-scan]
-    if: needs.setup.outputs.publish == 'true' && github.event_name != 'pull_request'
-    strategy:
-      matrix:
-        variant: ${{ fromJSON(needs.setup.outputs.variants) }}
+    needs: [build]
+    if: github.event_name != 'pull_request'
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.source_ref || github.ref }}
-      
-      - name: Configure variant
-        id: config
-        run: |
-          if [ "${{ matrix.variant }}" == "large_disk" ]; then
-            echo "tag_suffix=_large_disk" >> $GITHUB_OUTPUT
-          else
-            echo "tag_suffix=" >> $GITHUB_OUTPUT
-          fi
-
+        uses: actions/checkout@v4
       - name: Docker meta
         id: docker_meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@v5
         with:
           images: |
             chrislusf/seaweedfs
             ghcr.io/chrislusf/seaweedfs
-          tags: type=raw,value=${{ github.event_name == 'workflow_dispatch' && github.event.inputs.image_tag || 'latest' }},suffix=${{ steps.config.outputs.tag_suffix }}
+          tags: type=raw,value=latest
       - name: Login to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
       - name: Login to GHCR
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ secrets.GHCR_USERNAME }}
@@ -332,16 +142,13 @@ jobs:
           crane version
       - name: Create and push manifest
         run: |
-          SUFFIX="${{ steps.config.outputs.tag_suffix }}"
-          BASE_TAG="${{ github.event_name == 'workflow_dispatch' && github.event.inputs.image_tag || 'latest' }}"
-          
           # Create manifest on GHCR first (no rate limits)
           echo "Creating GHCR manifest (no rate limits)..."
-          docker buildx imagetools create -t ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX} \
-            ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-amd64 \
-            ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-arm64 \
-            ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-arm \
-            ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-386
+          docker buildx imagetools create -t ghcr.io/chrislusf/seaweedfs:latest \
+            ghcr.io/chrislusf/seaweedfs:latest-amd64 \
+            ghcr.io/chrislusf/seaweedfs:latest-arm64 \
+            ghcr.io/chrislusf/seaweedfs:latest-arm \
+            ghcr.io/chrislusf/seaweedfs:latest-386
           
           # Copy the complete multi-arch image from GHCR to Docker Hub
           # This only requires one pull from GHCR (no rate limit) and one push to Docker Hub
@@ -377,16 +184,16 @@ jobs:
           # Use crane or skopeo to copy, fallback to docker if not available
           if command -v crane &> /dev/null; then
             echo "Using crane to copy..."
-            retry_with_backoff crane copy ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX} chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}
+            retry_with_backoff crane copy ghcr.io/chrislusf/seaweedfs:latest chrislusf/seaweedfs:latest
           elif command -v skopeo &> /dev/null; then
             echo "Using skopeo to copy..."
-            retry_with_backoff skopeo copy --all docker://ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX} docker://chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}
+            retry_with_backoff skopeo copy --all docker://ghcr.io/chrislusf/seaweedfs:latest docker://chrislusf/seaweedfs:latest
           else
             echo "Using docker buildx imagetools (pulling 4 images from Docker Hub)..."
             # Fallback: create manifest directly on Docker Hub (pulls from Docker Hub - rate limited)
-            retry_with_backoff docker buildx imagetools create -t chrislusf/seaweedfs:${BASE_TAG}${SUFFIX} \
-              ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-amd64 \
-              ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-arm64 \
-              ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-arm \
-              ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-386
+            retry_with_backoff docker buildx imagetools create -t chrislusf/seaweedfs:latest \
+              ghcr.io/chrislusf/seaweedfs:latest-amd64 \
+              ghcr.io/chrislusf/seaweedfs:latest-arm64 \
+              ghcr.io/chrislusf/seaweedfs:latest-arm \
+              ghcr.io/chrislusf/seaweedfs:latest-386
           fi

.github/workflows/container_release1.yml

@@ -0,0 +1,152 @@
+name: "docker: build release containers for normal volume"
+
+# DISABLED: Merged into container_release_unified.yml
+on:
+  workflow_dispatch:
+    inputs:
+      force_run:
+        description: 'This workflow is disabled. Use container_release_unified.yml instead'
+        required: true
+        default: 'disabled'
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        platform: [amd64, arm64, arm, 386]
+        include:
+          - platform: amd64
+            qemu: false
+          - platform: arm64
+            qemu: true
+          - platform: arm
+            qemu: true
+          - platform: 386
+            qemu: true
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Free Disk Space
+        run: |
+          echo "Available disk space before cleanup:"
+          df -h
+          # Remove pre-installed tools
+          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache/CodeQL
+          # Clean package managers
+          sudo apt-get clean
+          sudo rm -rf /var/lib/apt/lists/*
+          # Clean Docker aggressively
+          sudo docker system prune -af --volumes
+          # Clean Go cache if it exists
+          [ -d ~/.cache/go-build ] && rm -rf ~/.cache/go-build || true
+          [ -d /go/pkg ] && rm -rf /go/pkg || true
+          echo "Available disk space after cleanup:"
+          df -h
+      - name: Docker meta
+        id: docker_meta
+        uses: docker/metadata-action@v5
+        with:
+          images: chrislusf/seaweedfs
+          tags: type=ref,event=tag
+          flavor: latest=false
+      - name: Set up QEMU
+        if: matrix.qemu
+        uses: docker/setup-qemu-action@v3
+      - name: Create BuildKit config
+        run: |
+          cat > /tmp/buildkitd.toml <<EOF
+          [registry."docker.io"]
+            mirrors = ["https://mirror.gcr.io"]
+          EOF
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          buildkitd-config: /tmp/buildkitd.toml
+      - name: Login to Docker Hub
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+      - name: Build ${{ matrix.platform }}
+        uses: docker/build-push-action@v5
+        env:
+          DOCKER_BUILDKIT: 1
+        with:
+          context: ./docker
+          push: ${{ github.event_name != 'pull_request' }}
+          file: ./docker/Dockerfile.go_build
+          platforms: linux/${{ matrix.platform }}
+          tags: ${{ steps.docker_meta.outputs.tags }}-${{ matrix.platform }}
+          labels: ${{ steps.docker_meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          build-args: |
+            BUILDKIT_INLINE_CACHE=1
+            BRANCH=${{ github.sha }}
+      - name: Clean up build artifacts
+        if: always()
+        run: |
+          # Clean up Docker build cache and temporary files
+          sudo docker system prune -f
+          # Remove Go build cache
+          sudo rm -rf /tmp/go-build*
+
+  create-manifest:
+    runs-on: ubuntu-latest
+    needs: [build]
+    if: github.event_name != 'pull_request'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Docker meta
+        id: docker_meta
+        uses: docker/metadata-action@v5
+        with:
+          images: chrislusf/seaweedfs
+          tags: type=ref,event=tag
+          flavor: latest=false
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+      - name: Create and push manifest
+        run: |
+          # Function to retry command with exponential backoff
+          retry_with_backoff() {
+            local max_attempts=5
+            local timeout=1
+            local attempt=1
+            local exit_code=0
+            
+            while [ $attempt -le $max_attempts ]; do
+              if "$@"; then
+                return 0
+              else
+                exit_code=$?
+              fi
+              
+              if [ $attempt -lt $max_attempts ]; then
+                echo "Attempt $attempt failed. Retrying in ${timeout}s..." >&2
+                sleep $timeout
+                timeout=$((timeout * 2))
+              fi
+              
+              attempt=$((attempt + 1))
+            done
+            
+            echo "Command failed after $max_attempts attempts" >&2
+            return $exit_code
+          }
+          
+          # Create manifest with retry
+          retry_with_backoff docker buildx imagetools create -t ${{ steps.docker_meta.outputs.tags }} \
+            ${{ steps.docker_meta.outputs.tags }}-amd64 \
+            ${{ steps.docker_meta.outputs.tags }}-arm64 \
+            ${{ steps.docker_meta.outputs.tags }}-arm \
+            ${{ steps.docker_meta.outputs.tags }}-386

.github/workflows/container_release2.yml

@@ -0,0 +1,153 @@
+name: "docker: build release containers for large volume"
+
+# DISABLED: Merged into container_release_unified.yml
+on:
+  workflow_dispatch:
+    inputs:
+      force_run:
+        description: 'This workflow is disabled. Use container_release_unified.yml instead'
+        required: true
+        default: 'disabled'
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        platform: [amd64, arm64, arm, 386]
+        include:
+          - platform: amd64
+            qemu: false
+          - platform: arm64
+            qemu: true
+          - platform: arm
+            qemu: true
+          - platform: 386
+            qemu: true
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Free Disk Space
+        run: |
+          echo "Available disk space before cleanup:"
+          df -h
+          # Remove pre-installed tools
+          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache/CodeQL
+          # Clean package managers
+          sudo apt-get clean
+          sudo rm -rf /var/lib/apt/lists/*
+          # Clean Docker aggressively
+          sudo docker system prune -af --volumes
+          # Clean Go cache if it exists
+          [ -d ~/.cache/go-build ] && rm -rf ~/.cache/go-build || true
+          [ -d /go/pkg ] && rm -rf /go/pkg || true
+          echo "Available disk space after cleanup:"
+          df -h
+      - name: Docker meta
+        id: docker_meta
+        uses: docker/metadata-action@v5
+        with:
+          images: chrislusf/seaweedfs
+          tags: type=ref,event=tag,suffix=_large_disk
+          flavor: latest=false
+      - name: Set up QEMU
+        if: matrix.qemu
+        uses: docker/setup-qemu-action@v3
+      - name: Create BuildKit config
+        run: |
+          cat > /tmp/buildkitd.toml <<EOF
+          [registry."docker.io"]
+            mirrors = ["https://mirror.gcr.io"]
+          EOF
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          buildkitd-config: /tmp/buildkitd.toml
+      - name: Login to Docker Hub
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+      - name: Build ${{ matrix.platform }}
+        uses: docker/build-push-action@v5
+        env:
+          DOCKER_BUILDKIT: 1
+        with:
+          context: ./docker
+          push: ${{ github.event_name != 'pull_request' }}
+          file: ./docker/Dockerfile.go_build
+          build-args: |
+            TAGS=5BytesOffset
+            BUILDKIT_INLINE_CACHE=1
+            BRANCH=${{ github.sha }}
+          platforms: linux/${{ matrix.platform }}
+          tags: ${{ steps.docker_meta.outputs.tags }}-${{ matrix.platform }}
+          labels: ${{ steps.docker_meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+      - name: Clean up build artifacts
+        if: always()
+        run: |
+          # Clean up Docker build cache and temporary files
+          sudo docker system prune -f
+          # Remove Go build cache
+          sudo rm -rf /tmp/go-build*
+
+  create-manifest:
+    runs-on: ubuntu-latest
+    needs: [build]
+    if: github.event_name != 'pull_request'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Docker meta
+        id: docker_meta
+        uses: docker/metadata-action@v5
+        with:
+          images: chrislusf/seaweedfs
+          tags: type=ref,event=tag,suffix=_large_disk
+          flavor: latest=false
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+      - name: Create and push manifest
+        run: |
+          # Function to retry command with exponential backoff
+          retry_with_backoff() {
+            local max_attempts=5
+            local timeout=1
+            local attempt=1
+            local exit_code=0
+            
+            while [ $attempt -le $max_attempts ]; do
+              if "$@"; then
+                return 0
+              else
+                exit_code=$?
+              fi
+              
+              if [ $attempt -lt $max_attempts ]; then
+                echo "Attempt $attempt failed. Retrying in ${timeout}s..." >&2
+                sleep $timeout
+                timeout=$((timeout * 2))
+              fi
+              
+              attempt=$((attempt + 1))
+            done
+            
+            echo "Command failed after $max_attempts attempts" >&2
+            return $exit_code
+          }
+          
+          # Create manifest with retry
+          retry_with_backoff docker buildx imagetools create -t ${{ steps.docker_meta.outputs.tags }} \
+            ${{ steps.docker_meta.outputs.tags }}-amd64 \
+            ${{ steps.docker_meta.outputs.tags }}-arm64 \
+            ${{ steps.docker_meta.outputs.tags }}-arm \
+            ${{ steps.docker_meta.outputs.tags }}-386

.github/workflows/container_release3.yml

@@ -0,0 +1,73 @@
+name: "docker: build release containers for rocksdb"
+
+# DISABLED: Merged into container_release_unified.yml
+on:
+  workflow_dispatch:
+    inputs:
+      force_run:
+        description: 'This workflow is disabled. Use container_release_unified.yml instead'
+        required: true
+        default: 'disabled'
+
+permissions:
+  contents: read
+
+jobs:
+
+  build-large-release-container_rocksdb:
+    runs-on: [ubuntu-latest]
+
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v4
+      -
+        name: Free Disk Space
+        run: |
+          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc
+          sudo docker system prune -af
+      -
+        name: Docker meta
+        id: docker_meta
+        uses: docker/metadata-action@v5
+        with:
+          images: chrislusf/seaweedfs
+          tags: type=ref,event=tag,suffix=_large_disk_rocksdb
+          flavor: latest=false
+          labels: |
+            org.opencontainers.image.title=seaweedfs
+            org.opencontainers.image.description=SeaweedFS is a distributed storage system for blobs, objects, files, and data lake, to store and serve billions of files fast!
+            org.opencontainers.image.vendor=Chris Lu
+      -
+        name: Create BuildKit config
+        run: |
+          cat > /tmp/buildkitd.toml <<EOF
+          [registry."docker.io"]
+            mirrors = ["https://mirror.gcr.io"]
+          EOF
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          buildkitd-config: /tmp/buildkitd.toml
+      -
+        name: Login to Docker Hub
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+      -
+        name: Build
+        uses: docker/build-push-action@v5
+        with:
+          context: ./docker
+          push: ${{ github.event_name != 'pull_request' }}
+          file: ./docker/Dockerfile.rocksdb_large
+          build-args: |
+            BRANCH=${{ github.sha }}
+          platforms: linux/amd64
+          tags: ${{ steps.docker_meta.outputs.tags }}
+          labels: ${{ steps.docker_meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.github/workflows/container_release4.yml

@@ -0,0 +1,72 @@
+name: "docker: build release containers for all tags"
+
+# DISABLED: Merged into container_release_unified.yml
+on:
+  workflow_dispatch:
+    inputs:
+      force_run:
+        description: 'This workflow is disabled. Use container_release_unified.yml instead'
+        required: true
+        default: 'disabled'
+
+permissions:
+  contents: read
+
+jobs:
+  build-default-release-container:
+    runs-on: [ubuntu-latest]
+
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v4
+      -
+        name: Free Disk Space
+        run: |
+          echo "Before cleanup:"
+          df -h
+          sudo rm -rf /usr/share/dotnet
+          sudo rm -rf /usr/local/lib/android
+          sudo rm -rf /opt/ghc
+          sudo rm -rf /opt/hostedtoolcache/CodeQL
+          sudo docker system prune -af
+          echo "After cleanup:"
+          df -h
+      -
+        name: Docker meta
+        id: docker_meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            chrislusf/seaweedfs
+          tags: |
+            type=ref,event=tag,suffix=_full
+          flavor: |
+            latest=false
+          labels: |
+            org.opencontainers.image.title=seaweedfs
+            org.opencontainers.image.description=SeaweedFS is a distributed storage system for blobs, objects, files, and data lake, to store and serve billions of files fast!
+            org.opencontainers.image.vendor=Chris Lu
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      -
+        name: Login to Docker Hub
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+      -
+        name: Build
+        uses: docker/build-push-action@v5
+        with:
+          context: ./docker
+          push: ${{ github.event_name != 'pull_request' }}
+          file: ./docker/Dockerfile.go_build
+          build-args: TAGS=elastic,gocdk,rclone,sqlite,tarantool,tikv,ydb
+          platforms: linux/amd64
+          tags: ${{ steps.docker_meta.outputs.tags }}
+          labels: ${{ steps.docker_meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.github/workflows/container_release5.yml

@@ -0,0 +1,62 @@
+name: "docker: build release containers for all tags and large volume"
+
+# DISABLED: Merged into container_release_unified.yml
+on:
+  workflow_dispatch:
+    inputs:
+      force_run:
+        description: 'This workflow is disabled. Use container_release_unified.yml instead'
+        required: true
+        default: 'disabled'
+
+permissions:
+  contents: read
+
+jobs:
+  build-default-release-container:
+    runs-on: [ubuntu-latest]
+
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v4
+      -
+        name: Free Disk Space
+        run: |
+          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc
+          sudo docker system prune -af
+      -
+        name: Docker meta
+        id: docker_meta
+        uses: docker/metadata-action@v5
+        with:
+          images: chrislusf/seaweedfs
+          tags: type=ref,event=tag,suffix=_large_disk_full
+          flavor: latest=false
+          labels: |
+            org.opencontainers.image.title=seaweedfs
+            org.opencontainers.image.description=SeaweedFS is a distributed storage system for blobs, objects, files, and data lake, to store and serve billions of files fast!
+            org.opencontainers.image.vendor=Chris Lu
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      -
+        name: Login to Docker Hub
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+      -
+        name: Build
+        uses: docker/build-push-action@v5
+        with:
+          context: ./docker
+          push: ${{ github.event_name != 'pull_request' }}
+          file: ./docker/Dockerfile.go_build
+          build-args: TAGS=5BytesOffset,elastic,gocdk,rclone,sqlite,tarantool,tikv,ydb
+          platforms: linux/amd64
+          tags: ${{ steps.docker_meta.outputs.tags }}
+          labels: ${{ steps.docker_meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.github/workflows/container_release_foundationdb.yml

@@ -21,7 +21,7 @@ jobs:
       -
         name: Docker meta
         id: docker_meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@v5
         with:
           images: |
             chrislusf/seaweedfs
@@ -35,14 +35,14 @@ jobs:
             org.opencontainers.image.vendor=Chris Lu
       -
         name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@v3
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3
       -
         name: Login to Docker Hub
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
@@ -57,7 +57,7 @@ jobs:
           fi
       -
         name: Build
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v6
         with:
           context: ./docker
           push: ${{ github.event_name != 'pull_request' }}

.github/workflows/container_release_unified.yml

@@ -4,35 +4,11 @@ on:
   push:
     tags:
       - '*'
-  workflow_dispatch:
-    inputs:
-      variant:
-        description: 'Variant to build manually'
-        required: true
-        type: choice
-        default: all
-        options:
-          - all
-          - normal
-          - large_disk
-          - full
-          - large_disk_full
-          - rocksdb
-      release_tag:
-        description: 'Release tag to publish (e.g. 3.93)'
-        required: true
-        default: ''
-      rocksdb_version:
-        description: 'RocksDB git tag to use when variant=rocksdb'
-        required: false
-        default: 'v10.10.1'
+  workflow_dispatch: {}
 
 permissions:
   contents: read
 
-env:
-  RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.release_tag || github.ref_name }}
-
 # Limit concurrent builds to avoid rate limits
 concurrency:
   group: release-${{ github.ref }}
@@ -60,16 +36,16 @@ jobs:
             build_args: TAGS=5BytesOffset
             tag_suffix: _large_disk
             
-          # Full tags - multi-arch
+          # Full tags - amd64 only
           - variant: full
-            platforms: linux/amd64,linux/arm64
+            platforms: linux/amd64
             dockerfile: ./docker/Dockerfile.go_build
             build_args: TAGS=elastic,gocdk,rclone,sqlite,tarantool,tikv,ydb
             tag_suffix: _full
-
-          # Large disk + full tags - multi-arch
+            
+          # Large disk + full tags - amd64 only
           - variant: large_disk_full
-            platforms: linux/amd64,linux/arm64
+            platforms: linux/amd64
             dockerfile: ./docker/Dockerfile.go_build
             build_args: TAGS=5BytesOffset,elastic,gocdk,rclone,sqlite,tarantool,tikv,ydb
             tag_suffix: _large_disk_full
@@ -83,11 +59,9 @@ jobs:
             
     steps:
       - name: Checkout
-        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
         
       - name: Free Disk Space
-        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
         run: |
           echo "Available disk space before cleanup:"
           df -h
@@ -101,14 +75,13 @@ jobs:
           df -h
           
       - name: Docker meta
-        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
         id: docker_meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@v5
         with:
           images: |
             chrislusf/seaweedfs
             ghcr.io/chrislusf/seaweedfs
-          tags: type=raw,value=${{ env.RELEASE_TAG }}${{ matrix.tag_suffix }}
+          tags: type=ref,event=tag,suffix=${{ matrix.tag_suffix }}
           flavor: latest=false
           labels: |
             org.opencontainers.image.title=seaweedfs
@@ -116,11 +89,10 @@ jobs:
             org.opencontainers.image.vendor=Chris Lu
             
       - name: Set up QEMU
-        if: (github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant) && contains(matrix.platforms, 'arm')
-        uses: docker/setup-qemu-action@v4
+        if: contains(matrix.platforms, 'arm')
+        uses: docker/setup-qemu-action@v3
         
       - name: Create BuildKit config
-        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
         run: |
           cat > /tmp/buildkitd.toml <<EOF
           [registry."docker.io"]
@@ -128,29 +100,27 @@ jobs:
           EOF
           
       - name: Set up Docker Buildx
-        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3
         with:
           buildkitd-config: /tmp/buildkitd.toml
           
       - name: Login to Docker Hub
-        if: (github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant) && github.event_name != 'pull_request'
-        uses: docker/login-action@v4
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
           
       - name: Login to GHCR
-        if: (github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant) && github.event_name != 'pull_request'
-        uses: docker/login-action@v4
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ secrets.GHCR_USERNAME }}
           password: ${{ secrets.GHCR_TOKEN }}
           
       - name: Build and push ${{ matrix.variant }}
-        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v5
         env:
           DOCKER_BUILDKIT: 1
         with:
@@ -160,7 +130,7 @@ jobs:
           platforms: ${{ matrix.platforms }}
           # Push to GHCR to avoid Docker Hub rate limits on pulls
           tags: |
-            ghcr.io/chrislusf/seaweedfs:${{ env.RELEASE_TAG }}${{ matrix.tag_suffix }}
+            ghcr.io/chrislusf/seaweedfs:${{ github.ref_name }}${{ matrix.tag_suffix }}
           labels: ${{ steps.docker_meta.outputs.labels }}
           cache-from: type=gha,scope=${{ matrix.variant }}
           cache-to: type=gha,mode=max,scope=${{ matrix.variant }}
@@ -168,10 +138,9 @@ jobs:
             ${{ matrix.build_args }}
             BUILDKIT_INLINE_CACHE=1
             BRANCH=${{ github.sha }}
-            ${{ matrix.variant == 'rocksdb' && format('ROCKSDB_VERSION={0}', github.event.inputs.rocksdb_version || 'v10.10.1') || '' }}
             
       - name: Clean up build artifacts
-        if: always() && (github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant)
+        if: always()
         run: |
           sudo docker system prune -f
           sudo rm -rf /tmp/go-build*
@@ -197,22 +166,19 @@ jobs:
             
     steps:
       - name: Login to Docker Hub
-        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
           
       - name: Login to GHCR
-        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ secrets.GHCR_USERNAME }}
           password: ${{ secrets.GHCR_TOKEN }}
           
       - name: Install crane
-        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
         run: |
           cd $(mktemp -d)
           curl -sL "https://github.com/google/go-containerregistry/releases/latest/download/go-containerregistry_Linux_x86_64.tar.gz" | tar xz
@@ -220,7 +186,6 @@ jobs:
           crane version
           
       - name: Copy ${{ matrix.variant }} from GHCR to Docker Hub
-        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
         run: |
           # Function to retry with exponential backoff
           retry_with_backoff() {
@@ -253,25 +218,8 @@ jobs:
           # This is much more efficient than pulling/pushing individual arch images
           echo "Copying ${{ matrix.variant }} from GHCR to Docker Hub..."
           retry_with_backoff crane copy \
-            ghcr.io/chrislusf/seaweedfs:${{ env.RELEASE_TAG }}${{ matrix.tag_suffix }} \
-            chrislusf/seaweedfs:${{ env.RELEASE_TAG }}${{ matrix.tag_suffix }}
+            ghcr.io/chrislusf/seaweedfs:${{ github.ref_name }}${{ matrix.tag_suffix }} \
+            chrislusf/seaweedfs:${{ github.ref_name }}${{ matrix.tag_suffix }}
           
           echo "✓ Successfully copied ${{ matrix.variant }} to Docker Hub"
 
-  helm-release:
-    runs-on: ubuntu-latest
-    needs: [copy-to-dockerhub]
-    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
-    permissions:
-      contents: write
-      pages: write
-    steps:
-      - uses: actions/checkout@v6
-      - name: Publish Helm charts
-        uses: stefanprodan/helm-gh-pages@v1.7.0
-        with:          
-          token: ${{ secrets.GITHUB_TOKEN }}
-          charts_dir: k8s/charts
-          target_dir: helm
-          branch: gh-pages
-          helm_version: "3.18.4"

.github/workflows/container_rocksdb_version.yml

@@ -4,9 +4,9 @@ on:
   workflow_dispatch:
     inputs:
       rocksdb_version:
-        description: 'RocksDB git tag or branch to build (e.g. v10.10.1)'
+        description: 'RocksDB git tag or branch to build (e.g. v10.5.1)'
         required: true
-        default: 'v10.10.1'
+        default: 'v10.5.1'
       seaweedfs_ref:
         description: 'SeaweedFS git tag, branch, or commit to build'
         required: true
@@ -25,7 +25,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v2
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v2
 
       - name: Prepare Docker tag
         id: tag
@@ -82,19 +82,19 @@ jobs:
           echo "seaweedfs_ref=$seaweed" >> "$GITHUB_OUTPUT"
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v1
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v1
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v1
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v1
 
       - name: Login to Docker Hub
-        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v1
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v1
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
       - name: Build and push image
-        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v2
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v2
         with:
           context: ./docker
           push: true

.github/workflows/deploy_telemetry.yml

@@ -26,7 +26,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version-file: 'go.mod'
+          go-version: '1.24'
 
       - name: Build Telemetry Server
         if: github.event_name == 'workflow_dispatch' && inputs.deploy

.github/workflows/depsreview.yml

@@ -9,6 +9,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Checkout Repository'
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48
+        uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261

.github/workflows/e2e.yml

@@ -23,19 +23,20 @@ jobs:
     runs-on: ubuntu-22.04
     timeout-minutes: 30
     steps:
-    - name: Check out code into the Go module directory
-      uses: actions/checkout@v6
-
-    - name: Set up Go
-      uses: actions/setup-go@v6
+    - name: Set up Go 1.x
+      uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v2
       with:
-        go-version-file: 'go.mod'
+        go-version: ^1.13
+      id: go
+
+    - name: Check out code into the Go module directory
+      uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v2
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v4
+      uses: docker/setup-buildx-action@v3
       
     - name: Cache Docker layers
-      uses: actions/cache@v5
+      uses: actions/cache@v4
       with:
         path: /tmp/.buildx-cache
         key: ${{ runner.os }}-buildx-e2e-${{ github.sha }}
@@ -45,7 +46,6 @@ jobs:
     - name: Install dependencies
       run: |
         # Use faster mirrors and install with timeout
-        sudo rm -f /etc/apt/sources.list.d/azure-cli.list /etc/apt/sources.list.d/microsoft-prod.list
         echo "deb http://azure.archive.ubuntu.com/ubuntu/ $(lsb_release -cs) main restricted universe multiverse" | sudo tee /etc/apt/sources.list
         echo "deb http://azure.archive.ubuntu.com/ubuntu/ $(lsb_release -cs)-updates main restricted universe multiverse" | sudo tee -a /etc/apt/sources.list
         
@@ -134,7 +134,7 @@ jobs:
 
     - name: Archive logs
       if: always()
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@v5
       with:
         name: output-logs
         path: docker/output.log

.github/workflows/ec-integration-tests.yml

@@ -1,61 +0,0 @@
-name: "EC Integration Tests"
-
-on:
-  push:
-    branches: [ master ]
-  pull_request:
-    branches: [ master ]
-
-permissions:
-  contents: read
-
-jobs:
-  ec-integration-tests:
-    name: EC Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 30
-    steps:
-    - name: Set up Go 1.x
-      uses: actions/setup-go@v6
-      with:
-        go-version: ^1.25
-      id: go
-
-    - name: Check out code into the Go module directory
-      uses: actions/checkout@v6
-
-    - name: Build weed binary
-      run: |
-        cd weed && go build -o weed .
-
-    - name: Run EC Integration Tests
-      working-directory: test/erasure_coding
-      run: |
-        go test -v
-
-    - name: Collect server logs on failure
-      if: failure()
-      run: |
-        echo "Collecting server logs from temp directories..."
-        mkdir -p /tmp/ec-test-logs
-        # Find all temp directories created by the tests (they persist on failure with t.TempDir())
-        find /tmp -maxdepth 1 -type d \( -name "TestEC*" -o -name "TestDisk*" -o -name "TestCross*" -o -name "TestEvacuation*" \) 2>/dev/null | while read dir; do
-          if [ -d "$dir" ]; then
-            echo "Found test directory: $dir"
-            # Copy the entire directory structure to preserve organization
-            cp -r "$dir" /tmp/ec-test-logs/ 2>/dev/null || true
-          fi
-        done
-        # List what we collected
-        echo "Collected logs:"
-        find /tmp/ec-test-logs -type f -name "*.log" 2>/dev/null || echo "No logs found"
-
-    - name: Archive logs
-      if: failure()
-      uses: actions/upload-artifact@v7
-      with:
-        name: ec-integration-test-logs
-        path: |
-          /tmp/ec-test-logs/
-          test/erasure_coding/
-        if-no-files-found: warn

.github/workflows/ec-integration.yml

@@ -1,49 +0,0 @@
-name: EC Integration Tests
-
-on:
-  push:
-    branches: [ master ]
-    paths:
-      - 'weed/admin/**'
-      - 'weed/worker/**'
-      - 'test/erasure_coding/admin_dockertest/**'
-      - '.github/workflows/ec-integration.yml'
-  pull_request:
-    branches: [ master ]
-    paths:
-      - 'weed/admin/**'
-      - 'weed/worker/**'
-      - 'test/erasure_coding/admin_dockertest/**'
-      - '.github/workflows/ec-integration.yml'
-
-jobs:
-  ec-integration-test:
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v6
-      
-    - name: Set up Go
-      uses: actions/setup-go@v6
-      with:
-        go-version-file: 'go.mod'
-        
-    - name: Build weed binary
-      run: |
-        cd weed
-        go build -o ../weed_bin
-        
-    - name: Run EC integration tests
-      run: |
-        cd test/erasure_coding/admin_dockertest
-        go test -v -timeout 15m ec_integration_test.go
-        
-    - name: Upload test logs on failure
-      if: failure()
-      uses: actions/upload-artifact@v7
-      with:
-        name: ec-test-logs
-        path: test/erasure_coding/admin_dockertest/tmp/logs/
-        retention-days: 7

.github/workflows/fuse-integration.yml

@@ -21,61 +21,214 @@ concurrency:
 permissions:
   contents: read
 
+env:
+  GO_VERSION: '1.24'
+  TEST_TIMEOUT: '45m'
+
 jobs:
   fuse-integration:
     name: FUSE Integration Testing
     runs-on: ubuntu-22.04
     timeout-minutes: 50
-
+    
     steps:
     - name: Checkout code
       uses: actions/checkout@v6
-
-    - name: Set up Go
+      
+    - name: Set up Go ${{ env.GO_VERSION }}
       uses: actions/setup-go@v6
       with:
-        go-version-file: 'go.mod'
-
+        go-version: ${{ env.GO_VERSION }}
+        
     - name: Install FUSE and dependencies
       run: |
         sudo apt-get update
-        # fuse3 is pre-installed on ubuntu-22.04 runners and conflicts
-        # with the legacy fuse package, so only install the dev headers.
-        sudo apt-get install -y libfuse3-dev
-        # Allow non-root FUSE mounts with allow_other
-        echo 'user_allow_other' | sudo tee -a /etc/fuse.conf
-        sudo chmod 644 /etc/fuse.conf
+        sudo apt-get install -y fuse libfuse-dev
         # Verify FUSE installation
-        fusermount3 --version || fusermount --version || true
-        ls -la /dev/fuse
-
+        fusermount --version || true
+        ls -la /dev/fuse || true
+        
     - name: Build SeaweedFS
       run: |
         cd weed
-        go build -tags "elastic gocdk sqlite ydb tarantool tikv rclone" -o weed .
+        go build -tags "elastic gocdk sqlite ydb tarantool tikv rclone" -v .
         chmod +x weed
+        # Verify binary
         ./weed version
-        # Make weed binary available in PATH for the test framework
-        sudo cp weed /usr/local/bin/weed
-
-    - name: Install test dependencies
+        
+    - name: Prepare FUSE Integration Tests
       run: |
-        cd test/fuse_integration
-        go mod download
-
+        # Create isolated test directory to avoid Go module conflicts
+        mkdir -p /tmp/seaweedfs-fuse-tests
+        
+        # Copy only the working test files to avoid Go module conflicts
+        # These are the files we've verified work without package name issues
+        cp test/fuse_integration/simple_test.go /tmp/seaweedfs-fuse-tests/ 2>/dev/null || echo "⚠️ simple_test.go not found"
+        cp test/fuse_integration/working_demo_test.go /tmp/seaweedfs-fuse-tests/ 2>/dev/null || echo "⚠️ working_demo_test.go not found"
+        
+        # Note: Other test files (framework.go, basic_operations_test.go, etc.) 
+        # have Go module conflicts and are skipped until resolved
+        
+        echo "📁 Working test files copied:"
+        ls -la /tmp/seaweedfs-fuse-tests/*.go 2>/dev/null || echo "ℹ️ No test files found"
+        
+        # Initialize Go module in isolated directory
+        cd /tmp/seaweedfs-fuse-tests
+        go mod init seaweedfs-fuse-tests
+        go mod tidy
+        
+        # Verify setup
+        echo "✅ FUSE integration test environment prepared"
+        ls -la /tmp/seaweedfs-fuse-tests/
+        
+        echo ""
+        echo "ℹ️  Current Status: Running working subset of FUSE tests"
+        echo "   • simple_test.go: Package structure verification"
+        echo "   • working_demo_test.go: Framework capability demonstration"
+        echo "   • Full framework: Available in test/fuse_integration/ (module conflicts pending resolution)"
+        
     - name: Run FUSE Integration Tests
       run: |
-        set -o pipefail
-        cd test/fuse_integration
-        echo "Running full FUSE integration test suite..."
-        go test -v -count=1 -timeout=45m ./... 2>&1 | tee /tmp/fuse-test-output.log
-
-    - name: Upload Test Logs
+        cd /tmp/seaweedfs-fuse-tests
+        
+        echo "🧪 Running FUSE integration tests..."
+        echo "============================================"
+        
+        # Run available working test files
+        TESTS_RUN=0
+        
+        if [ -f "simple_test.go" ]; then
+          echo "📋 Running simple_test.go..."
+          go test -v -timeout=${{ env.TEST_TIMEOUT }} simple_test.go
+          TESTS_RUN=$((TESTS_RUN + 1))
+        fi
+        
+        if [ -f "working_demo_test.go" ]; then
+          echo "📋 Running working_demo_test.go..."
+          go test -v -timeout=${{ env.TEST_TIMEOUT }} working_demo_test.go
+          TESTS_RUN=$((TESTS_RUN + 1))
+        fi
+        
+        # Run combined test if multiple files exist
+        if [ -f "simple_test.go" ] && [ -f "working_demo_test.go" ]; then
+          echo "📋 Running combined tests..."
+          go test -v -timeout=${{ env.TEST_TIMEOUT }} simple_test.go working_demo_test.go
+        fi
+        
+        if [ $TESTS_RUN -eq 0 ]; then
+          echo "⚠️ No working test files found, running module verification only"
+          go version
+          go mod verify
+        else
+          echo "✅ Successfully ran $TESTS_RUN test file(s)"
+        fi
+        
+        echo "============================================"
+        echo "✅ FUSE integration tests completed"
+        
+    - name: Run Extended Framework Validation
+      run: |
+        cd /tmp/seaweedfs-fuse-tests
+        
+        echo "🔍 Running extended framework validation..."
+        echo "============================================"
+        
+        # Test individual components (only run tests that exist)
+        if [ -f "simple_test.go" ]; then
+          echo "Testing simple verification..."
+          go test -v simple_test.go
+        fi
+        
+        if [ -f "working_demo_test.go" ]; then
+          echo "Testing framework demo..."
+          go test -v working_demo_test.go
+        fi
+        
+        # Test combined execution if both files exist
+        if [ -f "simple_test.go" ] && [ -f "working_demo_test.go" ]; then
+          echo "Testing combined execution..."
+          go test -v simple_test.go working_demo_test.go
+        elif [ -f "simple_test.go" ] || [ -f "working_demo_test.go" ]; then
+          echo "✅ Individual tests already validated above"
+        else
+          echo "⚠️ No working test files found for combined testing"
+        fi
+        
+        echo "============================================"
+        echo "✅ Extended validation completed"
+        
+    - name: Generate Test Coverage Report
+      run: |
+        cd /tmp/seaweedfs-fuse-tests
+        
+        echo "📊 Generating test coverage report..."
+        go test -v -coverprofile=coverage.out .
+        go tool cover -html=coverage.out -o coverage.html
+        
+        echo "Coverage report generated: coverage.html"
+        
+    - name: Verify SeaweedFS Binary Integration
+      run: |
+        # Test that SeaweedFS binary is accessible from test environment
+        WEED_BINARY=$(pwd)/weed/weed
+        
+        if [ -f "$WEED_BINARY" ]; then
+          echo "✅ SeaweedFS binary found at: $WEED_BINARY"
+          $WEED_BINARY version
+          echo "Binary is ready for full integration testing"
+        else
+          echo "❌ SeaweedFS binary not found"
+          exit 1
+        fi
+        
+    - name: Upload Test Artifacts
       if: always()
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@v5
       with:
         name: fuse-integration-test-results
         path: |
-          /tmp/fuse-test-output.log
-          /tmp/seaweedfs-fuse-logs/
+          /tmp/seaweedfs-fuse-tests/coverage.out
+          /tmp/seaweedfs-fuse-tests/coverage.html
+          /tmp/seaweedfs-fuse-tests/*.log
         retention-days: 7
+        
+    - name: Test Summary
+      if: always()
+      run: |
+        echo "## 🚀 FUSE Integration Test Summary" >> $GITHUB_STEP_SUMMARY
+        echo "" >> $GITHUB_STEP_SUMMARY
+        echo "### Framework Status" >> $GITHUB_STEP_SUMMARY
+        echo "- ✅ **Framework Design**: Complete and validated" >> $GITHUB_STEP_SUMMARY
+        echo "- ✅ **Working Tests**: Core framework demonstration functional" >> $GITHUB_STEP_SUMMARY
+        echo "- ⚠️ **Full Framework**: Available but requires Go module resolution" >> $GITHUB_STEP_SUMMARY
+        echo "- ✅ **CI/CD Integration**: Automated testing pipeline established" >> $GITHUB_STEP_SUMMARY
+        echo "" >> $GITHUB_STEP_SUMMARY
+        echo "### Test Capabilities" >> $GITHUB_STEP_SUMMARY
+        echo "- 📁 **File Operations**: Create, read, write, delete, permissions" >> $GITHUB_STEP_SUMMARY
+        echo "- 📂 **Directory Operations**: Create, list, delete, nested structures" >> $GITHUB_STEP_SUMMARY
+        echo "- 📊 **Large Files**: Multi-megabyte file handling" >> $GITHUB_STEP_SUMMARY
+        echo "- 🔄 **Concurrent Operations**: Multi-threaded stress testing" >> $GITHUB_STEP_SUMMARY
+        echo "- ⚠️ **Error Scenarios**: Comprehensive error handling validation" >> $GITHUB_STEP_SUMMARY
+        echo "" >> $GITHUB_STEP_SUMMARY
+        echo "### Comparison with Current Tests" >> $GITHUB_STEP_SUMMARY
+        echo "| Aspect | Current (FIO) | This Framework |" >> $GITHUB_STEP_SUMMARY
+        echo "|--------|---------------|----------------|" >> $GITHUB_STEP_SUMMARY
+        echo "| **Scope** | Performance only | Functional + Performance |" >> $GITHUB_STEP_SUMMARY
+        echo "| **Operations** | Read/Write only | All FUSE operations |" >> $GITHUB_STEP_SUMMARY
+        echo "| **Concurrency** | Single-threaded | Multi-threaded stress tests |" >> $GITHUB_STEP_SUMMARY
+        echo "| **Automation** | Manual setup | Fully automated |" >> $GITHUB_STEP_SUMMARY
+        echo "| **Validation** | Speed metrics | Correctness + Performance |" >> $GITHUB_STEP_SUMMARY
+        echo "" >> $GITHUB_STEP_SUMMARY
+        echo "### Current Working Tests" >> $GITHUB_STEP_SUMMARY
+        echo "- ✅ **Framework Structure**: Package and module verification" >> $GITHUB_STEP_SUMMARY
+        echo "- ✅ **Configuration Management**: Test config validation" >> $GITHUB_STEP_SUMMARY
+        echo "- ✅ **File Operations Demo**: Basic file create/read/write simulation" >> $GITHUB_STEP_SUMMARY
+        echo "- ✅ **Large File Handling**: 1MB+ file processing demonstration" >> $GITHUB_STEP_SUMMARY
+        echo "- ✅ **Concurrency Simulation**: Multi-file operation testing" >> $GITHUB_STEP_SUMMARY
+        echo "" >> $GITHUB_STEP_SUMMARY
+        echo "### Next Steps" >> $GITHUB_STEP_SUMMARY
+        echo "1. **Module Resolution**: Fix Go package conflicts for full framework" >> $GITHUB_STEP_SUMMARY
+        echo "2. **SeaweedFS Integration**: Connect with real cluster for end-to-end testing" >> $GITHUB_STEP_SUMMARY
+        echo "3. **Performance Benchmarks**: Add performance regression testing" >> $GITHUB_STEP_SUMMARY
+        echo "" >> $GITHUB_STEP_SUMMARY
+        echo "📈 **Total Framework Size**: ~1,500 lines of comprehensive testing infrastructure" >> $GITHUB_STEP_SUMMARY 

.github/workflows/go.yml

@@ -15,50 +15,26 @@ permissions:
 
 jobs:
 
-  vet:
-    name: Go Vet
-    runs-on: ubuntu-latest
-    steps:
-    - name: Check out code into the Go module directory
-      uses: actions/checkout@v6
-    - name: Set up Go
-      uses: actions/setup-go@v6
-      with:
-        go-version-file: 'go.mod'
-    - name: Get dependencies
-      run: |
-        cd weed; go get -v -t -d ./...
-    - name: Go Vet (excluding protobuf lock copying)
-      run: |
-        cd weed
-        # Run go vet and filter out known protobuf MessageState lock copying warnings
-        # These are expected in generated protobuf code with embedded sync.Mutex and are safe in practice
-        go vet -v ./... 2>&1 | grep -v "MessageState contains sync.Mutex" | grep -v "IdentityAccessManagement contains sync.RWMutex" | tee vet-output.txt
-        # Fail only if there are actual vet errors (not counting the filtered lock warnings)
-        if grep -q "vet:" vet-output.txt; then exit 1; fi
-
   build:
     name: Build
     runs-on: ubuntu-latest
     steps:
-    - name: Check out code into the Go module directory
-      uses: actions/checkout@v6
-    - name: Set up Go
-      uses: actions/setup-go@v6
+
+    - name: Set up Go 1.x
+      uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v2
       with:
-        go-version-file: 'go.mod'
+        go-version: ^1.13
+      id: go
+
+    - name: Check out code into the Go module directory
+      uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v2
+
+    - name: Get dependencies
+      run: |
+        cd weed; go get -v -t -d ./...
+
     - name: Build
       run: cd weed; go build -tags "elastic gocdk sqlite ydb tarantool tikv rclone" -v .
 
-  test:
-    name: Test
-    runs-on: ubuntu-latest
-    steps:
-    - name: Check out code into the Go module directory
-      uses: actions/checkout@v6
-    - name: Set up Go
-      uses: actions/setup-go@v6
-      with:
-        go-version-file: 'go.mod'
     - name: Test
       run: cd weed; go test -tags "elastic gocdk sqlite ydb tarantool tikv rclone" -v ./...

.github/workflows/helm_chart_release.yml

@@ -0,0 +1,23 @@
+name: "helm: publish charts"
+on:
+  push:
+    tags:
+      - '*'
+
+permissions:
+  contents: write
+  pages: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3
+      - name: Publish Helm charts
+        uses: stefanprodan/helm-gh-pages@v1.7.0
+        with:          
+          token: ${{ secrets.GITHUB_TOKEN }}
+          charts_dir: k8s/charts
+          target_dir: helm
+          branch: gh-pages
+          helm_version: "3.18.4"

.github/workflows/helm_ci.yml

@@ -16,18 +16,18 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3
         with:
           fetch-depth: 0
 
       - name: Set up Helm
-        uses: azure/setup-helm@v5
+        uses: azure/setup-helm@v4
         with:
           version: v3.18.4
 
       - uses: actions/setup-python@v6
         with:
-          python-version: '3.10'
+          python-version: '3.9'
           check-latest: true
 
       - name: Set up chart-testing
@@ -44,183 +44,8 @@ jobs:
       - name: Run chart-testing (lint)
         run: ct lint --target-branch ${{ github.event.repository.default_branch }} --all --validate-maintainers=false --chart-dirs k8s/charts
 
-      - name: Verify template rendering
-        run: |
-          set -e
-          CHART_DIR="k8s/charts/seaweedfs"
-          
-          echo "=== Testing default configuration ==="
-          helm template test $CHART_DIR > /tmp/default.yaml
-          echo "✓ Default configuration renders successfully"
-          
-          echo "=== Testing with S3 enabled ==="
-          helm template test $CHART_DIR --set s3.enabled=true > /tmp/s3.yaml
-          grep -q "kind: Deployment" /tmp/s3.yaml && grep -q "seaweedfs-s3" /tmp/s3.yaml
-          echo "✓ S3 deployment renders correctly"
-          
-          echo "=== Testing with all-in-one mode ==="
-          helm template test $CHART_DIR --set allInOne.enabled=true > /tmp/allinone.yaml
-          grep -q "seaweedfs-all-in-one" /tmp/allinone.yaml
-          echo "✓ All-in-one deployment renders correctly"
-          
-          echo "=== Testing with security enabled ==="
-          helm template test $CHART_DIR --set global.seaweedfs.enableSecurity=true > /tmp/security.yaml
-          grep -q "security-config" /tmp/security.yaml
-          echo "✓ Security configuration renders correctly"
-
-          echo "=== Testing with monitoring enabled ==="
-          helm template test $CHART_DIR \
-            --set global.seaweedfs.monitoring.enabled=true \
-            --set global.seaweedfs.monitoring.gatewayHost=prometheus \
-            --set global.seaweedfs.monitoring.gatewayPort=9091 > /tmp/monitoring.yaml
-          echo "✓ Monitoring configuration renders correctly"
-          
-          echo "=== Testing with PVC storage ==="
-          helm template test $CHART_DIR \
-            --set master.data.type=persistentVolumeClaim \
-            --set master.data.size=10Gi \
-            --set master.data.storageClass=standard > /tmp/pvc.yaml
-          grep -q "PersistentVolumeClaim" /tmp/pvc.yaml
-          echo "✓ PVC configuration renders correctly"
-          
-          echo "=== Testing with custom replicas ==="
-          helm template test $CHART_DIR \
-            --set master.replicas=3 \
-            --set filer.replicas=2 \
-            --set volume.replicas=3 > /tmp/replicas.yaml
-          echo "✓ Custom replicas configuration renders correctly"
-          
-          echo "=== Testing filer with S3 gateway ==="
-          helm template test $CHART_DIR \
-            --set filer.s3.enabled=true \
-            --set filer.s3.enableAuth=true > /tmp/filer-s3.yaml
-          echo "✓ Filer S3 gateway renders correctly"
-          
-          echo "=== Testing SFTP enabled ==="
-          helm template test $CHART_DIR --set sftp.enabled=true > /tmp/sftp.yaml
-          grep -q "seaweedfs-sftp" /tmp/sftp.yaml
-          echo "✓ SFTP deployment renders correctly"
-          
-          echo "=== Testing ingress configurations ==="
-          helm template test $CHART_DIR \
-            --set master.ingress.enabled=true \
-            --set filer.ingress.enabled=true \
-            --set s3.enabled=true \
-            --set s3.ingress.enabled=true > /tmp/ingress.yaml
-          grep -q "kind: Ingress" /tmp/ingress.yaml
-          echo "✓ Ingress configurations render correctly"
-          
-          echo "=== Testing COSI driver ==="
-          helm template test $CHART_DIR --set cosi.enabled=true > /tmp/cosi.yaml
-          grep -q "seaweedfs-cosi" /tmp/cosi.yaml
-          echo "✓ COSI driver renders correctly"
-          
-          echo ""
-          echo "=== Testing long release name: service names match DNS references ==="
-          # Use a release name that, combined with chart name "seaweedfs", exceeds 63 chars.
-          # fullname = "my-very-long-release-name-that-will-cause-truncation-seaweedfs" (65 chars before trunc)
-          LONG_RELEASE="my-very-long-release-name-that-will-cause-truncation"
-
-          # --- Normal mode: master + filer-client services vs helper-produced addresses ---
-          helm template "$LONG_RELEASE" $CHART_DIR \
-            --set s3.enabled=true \
-            --set global.seaweedfs.createBuckets[0].name=test > /tmp/longname.yaml
-
-          # Extract Service names from metadata
-          MASTER_SVC=$(awk '/kind: Service/{found=1} found && /^ *name:/{print $2; found=0}' /tmp/longname.yaml \
-            | grep -- '-master$')
-          FILER_CLIENT_SVC=$(awk '/kind: Service/{found=1} found && /^ *name:/{print $2; found=0}' /tmp/longname.yaml \
-            | grep -- '-filer-client$')
-
-          # Extract the hostname from WEED_CLUSTER_SW_MASTER in post-install-bucket-hook
-          MASTER_ADDR=$(grep 'WEED_CLUSTER_SW_MASTER' -A1 /tmp/longname.yaml \
-            | grep 'value:' | head -1 | sed 's/.*value: *"\{0,1\}\([^":]*\).*/\1/')
-          FILER_ADDR=$(grep 'WEED_CLUSTER_SW_FILER' -A1 /tmp/longname.yaml \
-            | grep 'value:' | head -1 | sed 's/.*value: *"\{0,1\}\([^":]*\).*/\1/')
-
-          # Extract the hostname from S3 deployment -filer= argument
-          S3_FILER_HOST=$(grep '\-filer=' /tmp/longname.yaml \
-            | head -1 | sed 's/.*-filer=\([^:]*\).*/\1/')
-
-          # The address helpers produce "<svc>.<namespace>:<port>"; extract just the svc name
-          MASTER_ADDR_SVC=$(echo "$MASTER_ADDR" | cut -d. -f1)
-          FILER_ADDR_SVC=$(echo "$FILER_ADDR" | cut -d. -f1)
-          S3_FILER_SVC=$(echo "$S3_FILER_HOST" | cut -d. -f1)
-
-          echo "  master Service.name:       $MASTER_SVC"
-          echo "  cluster.masterAddress svc:  $MASTER_ADDR_SVC"
-          echo "  filer-client Service.name:  $FILER_CLIENT_SVC"
-          echo "  cluster.filerAddress svc:   $FILER_ADDR_SVC"
-          echo "  S3 -filer= svc:             $S3_FILER_SVC"
-
-          [ "$MASTER_SVC" = "$MASTER_ADDR_SVC" ] || { echo "FAIL: master service name mismatch"; exit 1; }
-          [ "$FILER_CLIENT_SVC" = "$FILER_ADDR_SVC" ] || { echo "FAIL: filer-client service name mismatch"; exit 1; }
-          [ "$FILER_CLIENT_SVC" = "$S3_FILER_SVC" ] || { echo "FAIL: S3 -filer= does not match filer-client service"; exit 1; }
-          echo "✓ Normal mode: service names match DNS references with long release name"
-
-          # --- All-in-one mode: all-in-one service vs both helper addresses ---
-          helm template "$LONG_RELEASE" $CHART_DIR \
-            --set allInOne.enabled=true \
-            --set global.seaweedfs.createBuckets[0].name=test > /tmp/longname-aio.yaml
-
-          AIO_SVC=$(awk '/kind: Service/{found=1} found && /^ *name:/{print $2; found=0}' /tmp/longname-aio.yaml \
-            | grep -- '-all-in-one$')
-          AIO_MASTER_ADDR_SVC=$(grep 'WEED_CLUSTER_SW_MASTER' -A1 /tmp/longname-aio.yaml \
-            | grep 'value:' | head -1 | sed 's/.*value: *"\{0,1\}\([^":]*\).*/\1/' | cut -d. -f1)
-          AIO_FILER_ADDR_SVC=$(grep 'WEED_CLUSTER_SW_FILER' -A1 /tmp/longname-aio.yaml \
-            | grep 'value:' | head -1 | sed 's/.*value: *"\{0,1\}\([^":]*\).*/\1/' | cut -d. -f1)
-
-          echo "  all-in-one Service.name:    $AIO_SVC"
-          echo "  cluster.masterAddress svc:  $AIO_MASTER_ADDR_SVC"
-          echo "  cluster.filerAddress svc:   $AIO_FILER_ADDR_SVC"
-
-          [ "$AIO_SVC" = "$AIO_MASTER_ADDR_SVC" ] || { echo "FAIL: all-in-one master address mismatch"; exit 1; }
-          [ "$AIO_SVC" = "$AIO_FILER_ADDR_SVC" ] || { echo "FAIL: all-in-one filer address mismatch"; exit 1; }
-          echo "✓ All-in-one mode: service names match DNS references with long release name"
-
-          echo ""
-          echo "=== Testing security+S3: no blank lines in shell command blocks ==="
-          # Render the three manifests that include seaweedfs.s3.tlsArgs:
-          #   filer-statefulset, s3-deployment, all-in-one-deployment
-          helm template test $CHART_DIR \
-            --set global.seaweedfs.enableSecurity=true \
-            --set filer.s3.enabled=true \
-            --set s3.enabled=true > /tmp/security-s3.yaml
-          helm template test $CHART_DIR \
-            --set global.seaweedfs.enableSecurity=true \
-            --set allInOne.enabled=true \
-            --set allInOne.s3.enabled=true > /tmp/security-aio.yaml
-
-          pip install pyyaml -q
-          python3 - /tmp/security-s3.yaml /tmp/security-aio.yaml <<'PYEOF'
-          import yaml, sys
-          errors = []
-          for path in sys.argv[1:]:
-              with open(path) as f:
-                  docs = list(yaml.safe_load_all(f))
-              for doc in docs:
-                  if not doc or doc.get("kind") not in ("Deployment", "StatefulSet"):
-                      continue
-                  name = doc["metadata"]["name"]
-                  for c in doc["spec"]["template"]["spec"].get("containers", []):
-                      cmd = c.get("command", [])
-                      if len(cmd) >= 3 and cmd[0] == "/bin/sh" and cmd[1] == "-ec":
-                          script = cmd[2]
-                          for i, line in enumerate(script.splitlines(), 1):
-                              if line.strip() == "":
-                                  errors.append(f"{path}: {name}/{c['name']} has blank line at script line {i}")
-          if errors:
-              for e in errors:
-                  print(f"FAIL: {e}", file=sys.stderr)
-              print("Rendered with: global.seaweedfs.enableSecurity=true, filer.s3.enabled=true, s3.enabled=true, allInOne.enabled=true", file=sys.stderr)
-              sys.exit(1)
-          print("✓ No blank lines in security+S3 command blocks")
-          PYEOF
-
-          echo "✅ All template rendering tests passed!"
-
       - name: Create kind cluster
-        uses: helm/kind-action@v1.14.0
+        uses: helm/kind-action@v1.13.0
 
       - name: Run chart-testing (install)
         run: ct install --target-branch ${{ github.event.repository.default_branch }} --all --chart-dirs k8s/charts

.github/workflows/helm_manual_release.yml

@@ -1,38 +0,0 @@
-name: "helm: manual release"
-
-on:
-  workflow_dispatch:
-
-permissions:
-  contents: write
-  pages: write
-  packages: write
-
-jobs:
-  helm-release:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          fetch-depth: 0
-
-      - name: Publish Helm charts to github pages
-        uses: stefanprodan/helm-gh-pages@v1.7.0
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          charts_dir: k8s/charts
-          target_dir: helm
-          branch: gh-pages
-          helm_version: "3.18.4"
-
-      - name: Publish Helm charts to github container registry (ghcr.io)
-        uses: bitdeps/helm-oci-charts-releaser@v0.1.5
-        with:
-          charts_dir: k8s/charts
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          oci_registry: ghcr.io/${{ github.repository_owner }}
-          oci_username: github-actions
-          oci_password: ${{ secrets.GITHUB_TOKEN }}
-          skip_dependencies: true
-          skip_helm_install: true
-          skip_gh_release: true

.github/workflows/java_integration_tests.yml

@@ -53,7 +53,6 @@ jobs:
           mkdir -p "$WEED_DATA_DIR"
           
           # Start SeaweedFS with optimized settings for CI
-          # Include S3 API for s3copier integration tests
           weed server -dir="$WEED_DATA_DIR" \
             -master.raftHashicorp \
             -master.electionTimeout=1s \
@@ -62,9 +61,6 @@ jobs:
             -volume.preStopSeconds=1 \
             -master.peers=none \
             -filer -filer.maxMB=64 \
-            -s3 -s3.port=8333 \
-            -s3.config="$GITHUB_WORKSPACE/docker/compose/s3.json" \
-            -s3.allowDeleteBucketNotEmpty=true \
             -master.port=9333 \
             -volume.port=8080 \
             -filer.port=8888 \
@@ -109,16 +105,6 @@ jobs:
             sleep 2
           done
           
-          # Wait for S3 API
-          for i in {1..30}; do
-            if curl -s http://localhost:8333/healthz > /dev/null 2>&1; then
-              echo "✓ S3 API is ready"
-              break
-            fi
-            echo "Waiting for S3 API... ($i/30)"
-            sleep 2
-          done
-          
           echo "✓ All SeaweedFS components are ready!"
           
           # Display cluster status
@@ -147,20 +133,6 @@ jobs:
         run: |
           mvn test -Dtest=SeaweedFileSystemConfigTest -Dmaven.javadoc.skip=true -Dgpg.skip=true
       
-      - name: Run S3 ETag Validation Tests (Issue #7768)
-        working-directory: other/java/s3copier
-        env:
-          S3_ENDPOINT: http://127.0.0.1:8333
-          S3_ACCESS_KEY: some_access_key1
-          S3_SECRET_KEY: some_secret_key1
-        run: |
-          echo "Running S3 ETag validation tests against $S3_ENDPOINT"
-          mvn test -Dtest=ETagValidationTest \
-            -DS3_ENDPOINT=$S3_ENDPOINT \
-            -DS3_ACCESS_KEY=$S3_ACCESS_KEY \
-            -DS3_SECRET_KEY=$S3_SECRET_KEY \
-            -Dmaven.javadoc.skip=true -Dgpg.skip=true
-      
       - name: Display logs on failure
         if: failure()
         run: |

.github/workflows/java_unit_tests.yml

@@ -49,7 +49,7 @@ jobs:
       
       - name: Upload Test Reports
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v5
         with:
           name: test-reports-java-${{ matrix.java }}
           path: |

.github/workflows/kafka-quicktest.yml

@@ -26,14 +26,14 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v6
       with:
-        go-version: ^1.25
+        go-version: ^1.24
         cache: true
         cache-dependency-path: |
           **/go.sum
       id: go
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v4
+      uses: docker/setup-buildx-action@v3
 
     - name: Install dependencies
       run: |

.github/workflows/kafka-tests.yml

@@ -37,7 +37,7 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v6
       with:
-        go-version: ^1.25
+        go-version: ^1.24
       id: go
 
     - name: Check out code
@@ -52,7 +52,6 @@ jobs:
       run: |
         cd test/kafka
         go mod download
-        go mod tidy
 
     - name: Run Kafka Gateway Unit Tests
       run: |
@@ -82,7 +81,7 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v6
       with:
-        go-version: ^1.25
+        go-version: ^1.24
       id: go
 
     - name: Check out code
@@ -97,7 +96,6 @@ jobs:
       run: |
         cd test/kafka
         go mod download
-        go mod tidy
 
     - name: Run Integration Tests
       run: |
@@ -132,7 +130,7 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v6
       with:
-        go-version: ^1.25
+        go-version: ^1.24
         cache: true
         cache-dependency-path: |
           **/go.sum
@@ -156,7 +154,6 @@ jobs:
         cd test/kafka
         # Use go mod download with timeout to prevent hanging
         timeout 90s go mod download || echo "Warning: Dependency download timed out, continuing with cached modules"
-        go mod tidy
 
     - name: Build and start SeaweedFS MQ
       run: |
@@ -311,7 +308,7 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v6
       with:
-        go-version: ^1.25
+        go-version: ^1.24
         cache: true
         cache-dependency-path: |
           **/go.sum
@@ -335,7 +332,6 @@ jobs:
         cd test/kafka
         # Use go mod download with timeout to prevent hanging
         timeout 90s go mod download || echo "Warning: Dependency download timed out, continuing with cached modules"
-        go mod tidy
 
     - name: Build and start SeaweedFS MQ
       run: |
@@ -473,7 +469,7 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v6
       with:
-        go-version: ^1.25
+        go-version: ^1.24
         cache: true
         cache-dependency-path: |
           **/go.sum
@@ -496,7 +492,6 @@ jobs:
       run: |
         cd test/kafka
         timeout 90s go mod download || echo "Warning: Dependency download timed out, continuing with cached modules"
-        go mod tidy
 
     - name: Build and start SeaweedFS MQ
       run: |
@@ -631,7 +626,7 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v6
       with:
-        go-version: ^1.25
+        go-version: ^1.24
         cache: true
         cache-dependency-path: |
           **/go.sum
@@ -654,7 +649,6 @@ jobs:
       run: |
         cd test/kafka
         timeout 90s go mod download || echo "Warning: Dependency download timed out, continuing with cached modules"
-        go mod tidy
 
     - name: Build and start SeaweedFS MQ
       run: |
@@ -789,7 +783,7 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v6
       with:
-        go-version: ^1.25
+        go-version: ^1.24
       id: go
 
     - name: Check out code
@@ -809,7 +803,6 @@ jobs:
       run: |
         cd test/kafka
         go mod download
-        go mod tidy
 
     - name: Run Protocol Tests
       run: |

.github/workflows/kms-tests.yml

@@ -1,140 +0,0 @@
-name: "KMS Tests"
-
-on:
-  pull_request:
-    paths:
-      - 'weed/kms/**'
-      - 'weed/s3api/s3_sse_*.go'
-      - 'weed/s3api/s3api_object_handlers.go'
-      - 'weed/s3api/s3api_object_handlers_put.go'
-      - 'test/kms/**'
-      - '.github/workflows/kms-tests.yml'
-  push:
-    branches: [ master, main ]
-    paths:
-      - 'weed/kms/**'
-      - 'weed/s3api/s3_sse_*.go'
-      - 'weed/s3api/s3api_object_handlers.go'
-      - 'weed/s3api/s3api_object_handlers_put.go'
-      - 'test/kms/**'
-
-concurrency:
-  group: ${{ github.head_ref || github.ref }}-kms-tests
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-defaults:
-  run:
-    working-directory: weed
-
-jobs:
-  kms-provider-tests:
-    name: KMS Provider Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 20
-
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v6
-
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false
-
-      - name: Run KMS provider integration tests
-        timeout-minutes: 15
-        working-directory: test/kms
-        run: |
-          set -x
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          docker --version
-
-          make test-provider-ci
-
-      - name: Show OpenBao logs on failure
-        if: failure()
-        run: |
-          echo "=== OpenBao Container Logs ==="
-          docker logs openbao-ci 2>&1 | tail -50 || echo "No OpenBao container found"
-          echo "=== Setup Logs ==="
-          cat /tmp/openbao-ci-setup.log 2>/dev/null || echo "No setup log found"
-
-      - name: Cleanup
-        if: always()
-        working-directory: test/kms
-        run: |
-          make stop-openbao-ci || true
-
-  s3-kms-e2e-tests:
-    name: S3 KMS End-to-End Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 25
-
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v6
-
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false
-
-      - name: Run S3 KMS end-to-end tests
-        timeout-minutes: 20
-        working-directory: test/kms
-        run: |
-          set -x
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          docker --version
-          aws --version
-
-          make test-s3-kms-ci
-
-      - name: Show logs on failure
-        if: failure()
-        working-directory: test/kms
-        run: |
-          echo "=== OpenBao Container Logs ==="
-          cat /tmp/openbao-ci-container.log 2>/dev/null || docker logs openbao-ci 2>&1 | tail -50 || echo "No OpenBao logs found"
-          echo "=== SeaweedFS Server Logs ==="
-          tail -100 /tmp/seaweedfs-kms-mini.log 2>/dev/null || echo "No server log found"
-          echo "=== Setup Logs ==="
-          cat /tmp/weed-kms-ci-setup.log 2>/dev/null || echo "No weed setup log"
-          echo "=== Process Information ==="
-          ps aux | grep -E "(weed|test)" || true
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: s3-kms-e2e-logs
-          path: |
-            /tmp/seaweedfs-kms-mini.log
-            /tmp/openbao-ci-container.log
-            /tmp/weed-kms-ci-setup.log
-          retention-days: 3
-
-      - name: Cleanup
-        if: always()
-        working-directory: test/kms
-        run: |
-          make stop-seaweedfs-ci || true
-          make stop-openbao-ci || true
-          make clean-ci || true

.github/workflows/metadata-subscribe-tests.yml

@@ -1,91 +0,0 @@
-name: "Metadata Subscribe Integration Tests"
-
-on:
-  push:
-    branches: [ master ]
-    paths:
-      - 'weed/filer/**'
-      - 'weed/pb/filer_pb/**'
-      - 'weed/util/log_buffer/**'
-      - 'weed/server/filer_grpc_server_sub_meta.go'
-      - 'weed/command/filer_backup.go'
-      - 'test/metadata_subscribe/**'
-      - '.github/workflows/metadata-subscribe-tests.yml'
-  pull_request:
-    branches: [ master ]
-    paths:
-      - 'weed/filer/**'
-      - 'weed/pb/filer_pb/**'
-      - 'weed/util/log_buffer/**'
-      - 'weed/server/filer_grpc_server_sub_meta.go'
-      - 'weed/command/filer_backup.go'
-      - 'test/metadata_subscribe/**'
-      - '.github/workflows/metadata-subscribe-tests.yml'
-
-concurrency:
-  group: ${{ github.head_ref }}/metadata-subscribe-tests
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-env:
-  TEST_TIMEOUT: '10m'
-
-jobs:
-  metadata-subscribe-integration:
-    name: Metadata Subscribe Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 20
-    
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v6
-      
-    - name: Set up Go
-      uses: actions/setup-go@v6
-      with:
-        go-version-file: 'go.mod'
-        
-    - name: Build SeaweedFS
-      run: |
-        cd weed
-        go build -o weed .
-        chmod +x weed
-        ./weed version
-        
-    - name: Run Metadata Subscribe Integration Tests
-      run: |
-        cd test/metadata_subscribe
-        
-        echo "Running Metadata Subscribe integration tests..."
-        echo "============================================"
-        
-        # Run tests with verbose output
-        go test -v -timeout=${{ env.TEST_TIMEOUT }} ./...
-        
-        echo "============================================"
-        echo "Metadata Subscribe integration tests completed"
-        
-    - name: Archive logs on failure
-      if: failure()
-      uses: actions/upload-artifact@v7
-      with:
-        name: metadata-subscribe-test-logs
-        path: |
-          /tmp/seaweedfs_*
-        retention-days: 7
-        
-    - name: Test Summary
-      if: always()
-      run: |
-        echo "## Metadata Subscribe Integration Test Summary" >> $GITHUB_STEP_SUMMARY
-        echo "" >> $GITHUB_STEP_SUMMARY
-        echo "### Test Coverage" >> $GITHUB_STEP_SUMMARY
-        echo "- **Basic Subscription**: Subscribe to metadata changes and receive events" >> $GITHUB_STEP_SUMMARY
-        echo "- **Single-Filer No Stall**: Regression test for issue #4977" >> $GITHUB_STEP_SUMMARY
-        echo "- **Resume from Disk**: Verify subscription can resume from persisted logs" >> $GITHUB_STEP_SUMMARY
-        echo "" >> $GITHUB_STEP_SUMMARY
-        echo "### Related Issues" >> $GITHUB_STEP_SUMMARY
-        echo "- [#4977](https://github.com/seaweedfs/seaweedfs/issues/4977): filer.backup synchronisation stall" >> $GITHUB_STEP_SUMMARY
-

.github/workflows/plugin-workers.yml

@@ -1,39 +0,0 @@
-name: "Plugin Worker Integration Tests"
-
-on:
-  push:
-    branches: [ master ]
-  pull_request:
-    branches: [ master ]
-
-permissions:
-  contents: read
-
-jobs:
-  plugin-worker:
-    name: "Plugin Worker: ${{ matrix.worker }}"
-    runs-on: ubuntu-22.04
-    timeout-minutes: 10
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - worker: erasure_coding
-            path: test/plugin_workers/erasure_coding
-          - worker: vacuum
-            path: test/plugin_workers/vacuum
-          - worker: volume_balance
-            path: test/plugin_workers/volume_balance
-
-    steps:
-      - name: Set up Go 1.x
-        uses: actions/setup-go@v6
-        with:
-          go-version: ^1.26
-        id: go
-
-      - name: Check out code into the Go module directory
-        uses: actions/checkout@v6
-
-      - name: Run plugin worker tests
-        run: go test -v ./${{ matrix.path }}

.github/workflows/postgres-tests.yml

@@ -25,17 +25,17 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v6
       with:
-        go-version: ^1.25
+        go-version: ^1.24
       id: go
 
     - name: Check out code
       uses: actions/checkout@v6
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v4
+      uses: docker/setup-buildx-action@v3
 
     - name: Cache Docker layers
-      uses: actions/cache@v5
+      uses: actions/cache@v4
       with:
         path: /tmp/.buildx-cache
         key: ${{ runner.os }}-buildx-postgres-${{ github.sha }}
@@ -62,7 +62,7 @@ jobs:
 
     - name: Archive logs
       if: always()
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@v5
       with:
         name: postgres-logs
         path: test/postgres/postgres-output.log

.github/workflows/rust-volume-server-tests.yml

@@ -1,242 +0,0 @@
-name: "Rust Volume Server Tests"
-
-on:
-  pull_request:
-    branches: [ master ]
-    paths:
-      - 'seaweed-volume/**'
-      - 'test/volume_server/**'
-      - 'weed/pb/volume_server.proto'
-      - 'weed/pb/volume_server_pb/**'
-      - '.github/workflows/rust-volume-server-tests.yml'
-  push:
-    branches: [ master, main ]
-    paths:
-      - 'seaweed-volume/**'
-      - 'test/volume_server/**'
-      - 'weed/pb/volume_server.proto'
-      - 'weed/pb/volume_server_pb/**'
-      - '.github/workflows/rust-volume-server-tests.yml'
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-
-jobs:
-  rust-unit-tests:
-    name: Rust Unit Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 15
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v6
-
-      - name: Install protobuf compiler
-        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
-
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-
-      - name: Cache cargo registry and target
-        uses: actions/cache@v5
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            seaweed-volume/target
-          key: rust-${{ hashFiles('seaweed-volume/Cargo.lock') }}
-          restore-keys: |
-            rust-
-
-      - name: Build Rust volume server
-        run: cd seaweed-volume && cargo build --release
-
-      - name: Run Rust unit tests
-        run: cd seaweed-volume && cargo test
-
-  rust-integration-tests:
-    name: Rust Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 30
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v6
-
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: 'go.mod'
-
-      - name: Install protobuf compiler
-        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
-
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-
-      - name: Cache cargo registry and target
-        uses: actions/cache@v5
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            seaweed-volume/target
-          key: rust-${{ hashFiles('seaweed-volume/Cargo.lock') }}
-          restore-keys: |
-            rust-
-
-      - name: Build Go weed binary
-        run: |
-          cd weed
-          go build -o weed .
-          chmod +x weed
-          ./weed version
-
-      - name: Build Rust volume binary
-        run: cd seaweed-volume && cargo build --release
-
-      - name: Run integration tests
-        env:
-          WEED_BINARY: ${{ github.workspace }}/weed/weed
-          RUST_VOLUME_BINARY: ${{ github.workspace }}/seaweed-volume/target/release/weed-volume
-        run: |
-          echo "Running Rust volume server integration tests..."
-          go test -v -count=1 -timeout=15m ./test/volume_server/rust/...
-
-      - name: Collect logs on failure
-        if: failure()
-        run: |
-          mkdir -p /tmp/rust-volume-server-it-logs
-          find /tmp -maxdepth 1 -type d -name "seaweedfs_volume_server_it_*" -print -exec cp -r {} /tmp/rust-volume-server-it-logs/ \; || true
-
-      - name: Archive logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: rust-volume-server-integration-test-logs
-          path: /tmp/rust-volume-server-it-logs/
-          if-no-files-found: warn
-          retention-days: 7
-
-      - name: Test summary
-        if: always()
-        run: |
-          echo "## Rust Volume Server Integration Test Summary" >> "$GITHUB_STEP_SUMMARY"
-          echo "- Suite: test/volume_server/rust" >> "$GITHUB_STEP_SUMMARY"
-          echo "- Command: go test -v -count=1 -timeout=15m ./test/volume_server/rust/..." >> "$GITHUB_STEP_SUMMARY"
-
-  rust-volume-go-tests:
-    name: Go Tests with Rust Volume (${{ matrix.test-type }} - Shard ${{ matrix.shard }})
-    runs-on: ubuntu-22.04
-    timeout-minutes: 45
-    strategy:
-      fail-fast: false
-      matrix:
-        test-type: [grpc, http]
-        shard: [1, 2, 3]
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v6
-
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: 'go.mod'
-
-      - name: Install protobuf compiler
-        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
-
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-
-      - name: Cache cargo registry and target
-        uses: actions/cache@v5
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            seaweed-volume/target
-          key: rust-${{ hashFiles('seaweed-volume/Cargo.lock') }}
-          restore-keys: |
-            rust-
-
-      - name: Build Go weed binary
-        run: |
-          cd weed
-          go build -o weed .
-          chmod +x weed
-          ./weed version
-
-      - name: Build Rust volume binary
-        run: cd seaweed-volume && cargo build --release
-
-      - name: Run volume server integration tests with Rust volume
-        env:
-          WEED_BINARY: ${{ github.workspace }}/weed/weed
-          RUST_VOLUME_BINARY: ${{ github.workspace }}/seaweed-volume/target/release/weed-volume
-          VOLUME_SERVER_IMPL: rust
-        run: |
-          if [ "${{ matrix.test-type }}" == "grpc" ]; then
-            if [ "${{ matrix.shard }}" == "1" ]; then
-              TEST_PATTERN="^Test[A-H]"
-            elif [ "${{ matrix.shard }}" == "2" ]; then
-              TEST_PATTERN="^Test[I-S]"
-            else
-              TEST_PATTERN="^Test[T-Z]"
-            fi
-          else
-            if [ "${{ matrix.shard }}" == "1" ]; then
-              TEST_PATTERN="^Test[A-G]"
-            elif [ "${{ matrix.shard }}" == "2" ]; then
-              TEST_PATTERN="^Test[H-R]"
-            else
-              TEST_PATTERN="^Test[S-Z]"
-            fi
-          fi
-          echo "Running Go volume server tests with Rust volume for ${{ matrix.test-type }} (Shard ${{ matrix.shard }}, pattern: ${TEST_PATTERN})..."
-          go test -v -count=1 -tags 5BytesOffset -timeout=30m ./test/volume_server/${{ matrix.test-type }}/... -run "${TEST_PATTERN}"
-
-      - name: Collect logs on failure
-        if: failure()
-        run: |
-          mkdir -p /tmp/rust-volume-go-test-logs
-          find /tmp -maxdepth 1 -type d -name "seaweedfs_volume_server_it_*" -print -exec cp -r {} /tmp/rust-volume-go-test-logs/ \; || true
-
-      - name: Archive logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: rust-volume-go-test-logs-${{ matrix.test-type }}-shard${{ matrix.shard }}
-          path: /tmp/rust-volume-go-test-logs/
-          if-no-files-found: warn
-          retention-days: 7
-
-      - name: Test summary
-        if: always()
-        run: |
-          if [ "${{ matrix.test-type }}" == "grpc" ]; then
-            if [ "${{ matrix.shard }}" == "1" ]; then
-              TEST_PATTERN="^Test[A-H]"
-            elif [ "${{ matrix.shard }}" == "2" ]; then
-              TEST_PATTERN="^Test[I-S]"
-            else
-              TEST_PATTERN="^Test[T-Z]"
-            fi
-          else
-            if [ "${{ matrix.shard }}" == "1" ]; then
-              TEST_PATTERN="^Test[A-G]"
-            elif [ "${{ matrix.shard }}" == "2" ]; then
-              TEST_PATTERN="^Test[H-R]"
-            else
-              TEST_PATTERN="^Test[S-Z]"
-            fi
-          fi
-          echo "## Rust Volume - Go Test Summary (${{ matrix.test-type }} - Shard ${{ matrix.shard }})" >> "$GITHUB_STEP_SUMMARY"
-          echo "- Suite: test/volume_server/${{ matrix.test-type }} (Pattern: ${TEST_PATTERN})" >> "$GITHUB_STEP_SUMMARY"
-          echo "- Volume server: Rust (VOLUME_SERVER_IMPL=rust)" >> "$GITHUB_STEP_SUMMARY"

.github/workflows/rust_binaries_dev.yml

@@ -1,165 +0,0 @@
-name: "rust: build dev volume server binaries"
-
-on:
-  push:
-    branches: [ master ]
-    paths:
-      - 'seaweed-volume/**'
-      - '.github/workflows/rust_binaries_dev.yml'
-
-permissions:
-  contents: read
-
-jobs:
-
-  cleanup:
-    permissions:
-      contents: write
-    runs-on: ubuntu-latest
-    steps:
-      - name: Delete old Rust volume dev assets
-        uses: mknejp/delete-release-assets@v1
-        with:
-          token: ${{ github.token }}
-          tag: dev
-          fail-if-no-assets: false
-          assets: |
-            weed-volume-*
-
-  build-rust-volume-dev-linux:
-    permissions:
-      contents: write
-    needs: cleanup
-    runs-on: ubuntu-22.04
-    strategy:
-      matrix:
-        include:
-          - target: x86_64-unknown-linux-gnu
-            asset_suffix: linux-amd64
-
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: Install protobuf compiler
-        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
-
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-
-      - name: Cache cargo registry and target
-        uses: actions/cache@v5
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            seaweed-volume/target
-          key: rust-dev-${{ matrix.target }}-${{ hashFiles('seaweed-volume/Cargo.lock') }}
-          restore-keys: |
-            rust-dev-${{ matrix.target }}-
-
-      - name: Set BUILD_TIME
-        run: echo BUILD_TIME=$(date -u +%Y%m%d-%H%M) >> "$GITHUB_ENV"
-
-      - name: Build Rust volume server (large disk)
-        env:
-          SEAWEEDFS_COMMIT: ${{ github.sha }}
-        run: cd seaweed-volume && cargo build --release
-
-      - name: Package large disk binary
-        run: |
-          cp seaweed-volume/target/release/weed-volume weed-volume-large-disk
-          tar czf "weed-volume-large-disk-${{ env.BUILD_TIME }}-${{ matrix.asset_suffix }}.tar.gz" weed-volume-large-disk
-          rm weed-volume-large-disk
-
-      - name: Build Rust volume server (normal)
-        env:
-          SEAWEEDFS_COMMIT: ${{ github.sha }}
-        run: cd seaweed-volume && cargo build --release --no-default-features
-
-      - name: Package normal binary
-        run: |
-          cp seaweed-volume/target/release/weed-volume weed-volume-normal
-          tar czf "weed-volume-${{ env.BUILD_TIME }}-${{ matrix.asset_suffix }}.tar.gz" weed-volume-normal
-          rm weed-volume-normal
-
-      - name: Upload dev release assets
-        uses: softprops/action-gh-release@v2
-        with:
-          tag_name: dev
-          prerelease: true
-          files: |
-            weed-volume-large-disk-${{ env.BUILD_TIME }}-${{ matrix.asset_suffix }}.tar.gz
-            weed-volume-${{ env.BUILD_TIME }}-${{ matrix.asset_suffix }}.tar.gz
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-  build-rust-volume-dev-darwin:
-    permissions:
-      contents: write
-    needs: build-rust-volume-dev-linux
-    runs-on: macos-latest
-    strategy:
-      matrix:
-        include:
-          - target: aarch64-apple-darwin
-            asset_suffix: darwin-arm64
-          - target: x86_64-apple-darwin
-            asset_suffix: darwin-amd64
-
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: Install protobuf compiler
-        run: brew install protobuf
-
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: ${{ matrix.target }}
-
-      - name: Cache cargo registry and target
-        uses: actions/cache@v5
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            seaweed-volume/target
-          key: rust-dev-${{ matrix.target }}-${{ hashFiles('seaweed-volume/Cargo.lock') }}
-          restore-keys: |
-            rust-dev-${{ matrix.target }}-
-
-      - name: Set BUILD_TIME
-        run: echo BUILD_TIME=$(date -u +%Y%m%d-%H%M) >> "$GITHUB_ENV"
-
-      - name: Build Rust volume server (large disk)
-        env:
-          SEAWEEDFS_COMMIT: ${{ github.sha }}
-        run: cd seaweed-volume && cargo build --release --target ${{ matrix.target }}
-
-      - name: Package large disk binary
-        run: |
-          cp seaweed-volume/target/${{ matrix.target }}/release/weed-volume weed-volume-large-disk
-          tar czf "weed-volume-large-disk-${{ env.BUILD_TIME }}-${{ matrix.asset_suffix }}.tar.gz" weed-volume-large-disk
-          rm weed-volume-large-disk
-
-      - name: Build Rust volume server (normal)
-        env:
-          SEAWEEDFS_COMMIT: ${{ github.sha }}
-        run: cd seaweed-volume && cargo build --release --target ${{ matrix.target }} --no-default-features
-
-      - name: Package normal binary
-        run: |
-          cp seaweed-volume/target/${{ matrix.target }}/release/weed-volume weed-volume-normal
-          tar czf "weed-volume-${{ env.BUILD_TIME }}-${{ matrix.asset_suffix }}.tar.gz" weed-volume-normal
-          rm weed-volume-normal
-
-      - name: Upload dev release assets
-        uses: softprops/action-gh-release@v2
-        with:
-          tag_name: dev
-          prerelease: true
-          files: |
-            weed-volume-large-disk-${{ env.BUILD_TIME }}-${{ matrix.asset_suffix }}.tar.gz
-            weed-volume-${{ env.BUILD_TIME }}-${{ matrix.asset_suffix }}.tar.gz
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/rust_binaries_release.yml

@@ -1,253 +0,0 @@
-name: "rust: build versioned volume server binaries"
-
-on:
-  push:
-    tags:
-      - '*'
-
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-
-  build-rust-volume-linux:
-    permissions:
-      contents: write
-    runs-on: ubuntu-22.04
-    strategy:
-      matrix:
-        include:
-          - target: x86_64-unknown-linux-gnu
-            asset_suffix: linux_amd64
-          - target: aarch64-unknown-linux-gnu
-            asset_suffix: linux_arm64
-            cross: true
-
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: Install protobuf compiler
-        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
-
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: ${{ matrix.target }}
-
-      - name: Install cross-compilation tools
-        if: matrix.cross
-        run: |
-          sudo dpkg --add-architecture arm64
-          sudo sed -i 's/^deb /deb [arch=amd64] /' /etc/apt/sources.list
-          echo "deb [arch=arm64] http://ports.ubuntu.com/ jammy main restricted universe multiverse" | sudo tee /etc/apt/sources.list.d/arm64.list
-          echo "deb [arch=arm64] http://ports.ubuntu.com/ jammy-updates main restricted universe multiverse" | sudo tee -a /etc/apt/sources.list.d/arm64.list
-          sudo apt-get update
-          sudo apt-get install -y gcc-aarch64-linux-gnu libssl-dev:arm64
-          echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc" >> "$GITHUB_ENV"
-          echo "OPENSSL_DIR=/usr" >> "$GITHUB_ENV"
-          echo "OPENSSL_INCLUDE_DIR=/usr/include" >> "$GITHUB_ENV"
-          echo "OPENSSL_LIB_DIR=/usr/lib/aarch64-linux-gnu" >> "$GITHUB_ENV"
-
-      - name: Cache cargo registry and target
-        uses: actions/cache@v5
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            seaweed-volume/target
-          key: rust-release-${{ matrix.target }}-${{ hashFiles('seaweed-volume/Cargo.lock') }}
-          restore-keys: |
-            rust-release-${{ matrix.target }}-
-
-      - name: Build Rust volume server (large disk)
-        env:
-          SEAWEEDFS_COMMIT: ${{ github.sha }}
-        run: |
-          cd seaweed-volume
-          cargo build --release --target ${{ matrix.target }}
-
-      - name: Build Rust volume server (normal)
-        env:
-          SEAWEEDFS_COMMIT: ${{ github.sha }}
-        run: |
-          cd seaweed-volume
-          cargo build --release --target ${{ matrix.target }} --no-default-features
-
-      - name: Package binaries
-        run: |
-          # Large disk (default, 5bytes feature)
-          cp seaweed-volume/target/${{ matrix.target }}/release/weed-volume weed-volume-large-disk
-          tar czf weed-volume_large_disk_${{ matrix.asset_suffix }}.tar.gz weed-volume-large-disk
-          rm weed-volume-large-disk
-
-          # Normal volume size
-          cp seaweed-volume/target/${{ matrix.target }}/release/weed-volume weed-volume-normal
-          tar czf weed-volume_${{ matrix.asset_suffix }}.tar.gz weed-volume-normal
-          rm weed-volume-normal
-
-      - name: Upload release assets
-        if: startsWith(github.ref, 'refs/tags/')
-        uses: softprops/action-gh-release@v2
-        with:
-          files: |
-            weed-volume_large_disk_${{ matrix.asset_suffix }}.tar.gz
-            weed-volume_${{ matrix.asset_suffix }}.tar.gz
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Upload artifacts
-        if: ${{ !startsWith(github.ref, 'refs/tags/') }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: rust-volume-${{ matrix.asset_suffix }}
-          path: |
-            weed-volume_large_disk_${{ matrix.asset_suffix }}.tar.gz
-            weed-volume_${{ matrix.asset_suffix }}.tar.gz
-
-  build-rust-volume-darwin:
-    permissions:
-      contents: write
-    runs-on: macos-latest
-    strategy:
-      matrix:
-        include:
-          - target: x86_64-apple-darwin
-            asset_suffix: darwin_amd64
-          - target: aarch64-apple-darwin
-            asset_suffix: darwin_arm64
-
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: Install protobuf compiler
-        run: brew install protobuf
-
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: ${{ matrix.target }}
-
-      - name: Cache cargo registry and target
-        uses: actions/cache@v5
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            seaweed-volume/target
-          key: rust-release-${{ matrix.target }}-${{ hashFiles('seaweed-volume/Cargo.lock') }}
-          restore-keys: |
-            rust-release-${{ matrix.target }}-
-
-      - name: Build Rust volume server (large disk)
-        env:
-          SEAWEEDFS_COMMIT: ${{ github.sha }}
-        run: |
-          cd seaweed-volume
-          cargo build --release --target ${{ matrix.target }}
-
-      - name: Build Rust volume server (normal)
-        env:
-          SEAWEEDFS_COMMIT: ${{ github.sha }}
-        run: |
-          cd seaweed-volume
-          cargo build --release --target ${{ matrix.target }} --no-default-features
-
-      - name: Package binaries
-        run: |
-          cp seaweed-volume/target/${{ matrix.target }}/release/weed-volume weed-volume-large-disk
-          tar czf weed-volume_large_disk_${{ matrix.asset_suffix }}.tar.gz weed-volume-large-disk
-          rm weed-volume-large-disk
-
-          cp seaweed-volume/target/${{ matrix.target }}/release/weed-volume weed-volume-normal
-          tar czf weed-volume_${{ matrix.asset_suffix }}.tar.gz weed-volume-normal
-          rm weed-volume-normal
-
-      - name: Upload release assets
-        if: startsWith(github.ref, 'refs/tags/')
-        uses: softprops/action-gh-release@v2
-        with:
-          files: |
-            weed-volume_large_disk_${{ matrix.asset_suffix }}.tar.gz
-            weed-volume_${{ matrix.asset_suffix }}.tar.gz
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Upload artifacts
-        if: ${{ !startsWith(github.ref, 'refs/tags/') }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: rust-volume-${{ matrix.asset_suffix }}
-          path: |
-            weed-volume_large_disk_${{ matrix.asset_suffix }}.tar.gz
-            weed-volume_${{ matrix.asset_suffix }}.tar.gz
-
-  build-rust-volume-windows:
-    permissions:
-      contents: write
-    runs-on: windows-latest
-
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: Install protobuf compiler
-        run: choco install protoc -y
-
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-
-      - name: Cache cargo registry and target
-        uses: actions/cache@v5
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            seaweed-volume/target
-          key: rust-release-windows-${{ hashFiles('seaweed-volume/Cargo.lock') }}
-          restore-keys: |
-            rust-release-windows-
-
-      - name: Build Rust volume server (large disk)
-        env:
-          SEAWEEDFS_COMMIT: ${{ github.sha }}
-        run: |
-          cd seaweed-volume
-          cargo build --release
-
-      - name: Build Rust volume server (normal)
-        env:
-          SEAWEEDFS_COMMIT: ${{ github.sha }}
-        run: |
-          cd seaweed-volume
-          cargo build --release --no-default-features
-
-      - name: Package binaries
-        shell: bash
-        run: |
-          cp seaweed-volume/target/release/weed-volume.exe weed-volume-large-disk.exe
-          7z a weed-volume_large_disk_windows_amd64.zip weed-volume-large-disk.exe
-          rm weed-volume-large-disk.exe
-
-          cp seaweed-volume/target/release/weed-volume.exe weed-volume-normal.exe
-          7z a weed-volume_windows_amd64.zip weed-volume-normal.exe
-          rm weed-volume-normal.exe
-
-      - name: Upload release assets
-        if: startsWith(github.ref, 'refs/tags/')
-        uses: softprops/action-gh-release@v2
-        with:
-          files: |
-            weed-volume_large_disk_windows_amd64.zip
-            weed-volume_windows_amd64.zip
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Upload artifacts
-        if: ${{ !startsWith(github.ref, 'refs/tags/') }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: rust-volume-windows_amd64
-          path: |
-            weed-volume_large_disk_windows_amd64.zip
-            weed-volume_windows_amd64.zip

.github/workflows/s3-example-integration-tests.yml

@@ -1,72 +0,0 @@
-name: "S3 Authenticated Integration Tests"
-
-on:
-  pull_request:
-  
-concurrency:
-  group: ${{ github.head_ref }}/s3-integration-tests
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  tests:
-    name: S3 Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 30
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v6
-
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Build SeaweedFS
-        run: |
-          cd weed
-          go build -o weed -buildvcs=false
-
-      - name: Run S3 Integration Tests
-        timeout-minutes: 15
-        working-directory: test/s3/normal
-        run: |
-          set -x
-          echo "=== Running S3 Integration Tests ==="
-          go test -v -timeout=60s -run TestS3Integration ./...
-
-      - name: Run S3 DeleteBucketNotEmpty Tests
-        timeout-minutes: 15
-        working-directory: test/s3/normal
-        run: |
-          set -x
-          echo "=== Running S3 DeleteBucketNotEmpty Tests ==="
-          go test -v -timeout=60s -run TestS3DeleteBucketNotEmpty ./...
-
-      - name: Run S3 Empty Directory Marker Tests
-        timeout-minutes: 15
-        working-directory: test/s3/normal
-        run: |
-          set -x
-          echo "=== Running S3 Empty Directory Marker Tests ==="
-          go test -v -timeout=180s -run TestS3ListObjectsEmptyDirectoryMarkers ./...
-
-      - name: Run IAM Integration Tests
-        timeout-minutes: 15
-        working-directory: test/s3/normal
-        run: |
-          set -x
-          echo "=== Running IAM Integration Tests ==="
-          go test -v -timeout=60s -run TestIAMOperations ./...
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: integration-test-logs
-          path: test/s3/normal/*.log
-          retention-days: 3

.github/workflows/s3-filer-group-tests.yml

@@ -1,86 +0,0 @@
-name: "S3 Filer Group Tests"
-
-on:
-  pull_request:
-  
-concurrency:
-  group: ${{ github.head_ref }}/s3-filer-group-tests
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-defaults:
-  run:
-    working-directory: weed
-
-jobs:
-  s3-filer-group-tests:
-    name: S3 Filer Group Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 20
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v6
-
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false
-
-      - name: Run S3 Filer Group Tests
-        timeout-minutes: 15
-        working-directory: test/s3/filer_group
-        run: |
-          set -x
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          df -h
-          echo "=== Starting Filer Group Tests ==="
-          
-          # Run tests with automatic server management
-          # The test-with-server target handles server startup/shutdown automatically
-          # Server is started with -filer.group=testgroup
-          make test-with-server || {
-            echo "❌ Filer group tests failed, checking logs..."
-            if [ -f weed-test.log ]; then
-              echo "=== Server logs ==="
-              tail -100 weed-test.log
-            fi
-            echo "=== Process information ==="
-            ps aux | grep -E "(weed|test)" || true
-            exit 1
-          }
-
-      - name: Show server logs on failure
-        if: failure()
-        working-directory: test/s3/filer_group
-        run: |
-          echo "=== Server Logs ==="
-          if [ -f weed-test.log ]; then
-            echo "Last 100 lines of server logs:"
-            tail -100 weed-test.log
-          else
-            echo "No server log file found"
-          fi
-          
-          echo "=== Test Environment ==="
-          ps aux | grep -E "(weed|test)" || true
-          netstat -tlnp | grep -E "(8333|9333|8080)" || true
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: s3-filer-group-test-logs
-          path: test/s3/filer_group/weed-test*.log
-          retention-days: 3
-
-

.github/workflows/s3-go-tests.yml

@@ -76,7 +76,7 @@ jobs:
 
       - name: Upload test logs on failure
         if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v5
         with:
           name: s3-versioning-test-logs-${{ matrix.test-type }}
           path: test/s3/versioning/weed-test*.log
@@ -124,7 +124,7 @@ jobs:
 
       - name: Upload server logs on failure
         if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v5
         with:
           name: s3-versioning-compatibility-logs
           path: test/s3/versioning/weed-test*.log
@@ -172,7 +172,7 @@ jobs:
 
       - name: Upload server logs on failure
         if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v5
         with:
           name: s3-cors-compatibility-logs
           path: test/s3/cors/weed-test*.log
@@ -239,7 +239,7 @@ jobs:
 
       - name: Upload test logs on failure
         if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v5
         with:
           name: s3-retention-test-logs-${{ matrix.test-type }}
           path: test/s3/retention/weed-test*.log
@@ -306,7 +306,7 @@ jobs:
 
       - name: Upload test logs on failure
         if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v5
         with:
           name: s3-cors-test-logs-${{ matrix.test-type }}
           path: test/s3/cors/weed-test*.log
@@ -355,7 +355,7 @@ jobs:
 
       - name: Upload server logs on failure
         if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v5
         with:
           name: s3-retention-worm-logs
           path: test/s3/retention/weed-test*.log
@@ -365,6 +365,8 @@ jobs:
     name: S3 Versioning Stress Test
     runs-on: ubuntu-22.04
     timeout-minutes: 35
+    # Only run stress tests on master branch pushes to avoid overloading PR testing
+    if: github.event_name == 'push' && github.ref == 'refs/heads/master'
     
     steps:
       - name: Check out code
@@ -389,9 +391,6 @@ jobs:
           uname -a
           free -h
           
-          # Start server for stress tests
-          make start-server
-          
           # Run stress tests (concurrent operations)
           make test-versioning-stress || {
             echo "❌ Stress test failed, checking logs..."
@@ -399,144 +398,17 @@ jobs:
               echo "=== Server logs ==="
               tail -200 weed-test.log
             fi
-            make stop-server
             make clean
             exit 1
           }
-          
-          # Run pagination stress tests (>1000 versions)
-          echo "=== Running pagination stress tests ==="
-          make test-versioning-pagination-stress || {
-            echo "❌ Pagination stress test failed, checking logs..."
-            if [ -f weed-test.log ]; then
-              echo "=== Server logs ==="
-              tail -200 weed-test.log
-            fi
-            make stop-server
-            make clean
-            exit 1
-          }
-          
-          make stop-server
           make clean
 
       - name: Upload stress test logs
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v5
         with:
           name: s3-versioning-stress-logs
           path: test/s3/versioning/weed-test*.log
           retention-days: 7
 
-  s3-tagging-tests:
-    # CI job for S3 object tagging tests
-    name: S3 Tagging Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 20
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v6
-
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false
-
-      - name: Run S3 Tagging Tests
-        timeout-minutes: 15
-        working-directory: test/s3/tagging
-        run: |
-          set -x
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          
-          # Set environment variables for the test
-          export S3_ENDPOINT="http://localhost:8006"
-          export S3_ACCESS_KEY="0555b35654ad1656d804"
-          export S3_SECRET_KEY="h7GhxuBLTrlhVUyxSPUKUV8r/2EI4ngqJxD7iBdBYLhwluN30JaT3Q=="
-          export AWS_ACCESS_KEY_ID="$S3_ACCESS_KEY"
-          export AWS_SECRET_ACCESS_KEY="$S3_SECRET_KEY"
-          
-          # Run the specific test that is equivalent to AWS S3 tagging behavior
-          make test-with-server || {
-            echo "❌ Test failed, checking logs..."
-            if [ -f weed-test.log ]; then
-              echo "=== Server logs ==="
-              tail -100 weed-test.log
-            fi
-            echo "=== Process information ==="
-            ps aux | grep -E "(weed|test)" || true
-            exit 1
-          }
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: s3-tagging-test-logs
-          path: test/s3/tagging/weed-test*.log
-          retention-days: 3
-
-  s3-remote-cache-tests:
-    name: S3 Remote Cache Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 20
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v6
-
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false
-
-      - name: Run S3 Remote Cache Tests
-        timeout-minutes: 15
-        working-directory: test/s3/remote_cache
-        run: |
-          set -x
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          
-          # Run the remote cache integration tests
-          # Tests singleflight deduplication for caching remote objects
-          make test-with-server || {
-            echo "❌ Test failed, checking logs..."
-            if [ -f primary-weed.log ]; then
-              echo "=== Primary server logs ==="
-              tail -100 primary-weed.log
-            fi
-            if [ -f remote-weed.log ]; then
-              echo "=== Remote server logs ==="
-              tail -100 remote-weed.log
-            fi
-            echo "=== Process information ==="
-            ps aux | grep -E "(weed|test)" || true
-            exit 1
-          }
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: s3-remote-cache-test-logs
-          path: |
-            test/s3/remote_cache/primary-weed.log
-            test/s3/remote_cache/remote-weed.log
-          retention-days: 3
-
   # Removed SSE-C integration tests and compatibility job

.github/workflows/s3-iam-tests.yml

@@ -5,8 +5,6 @@ on:
     paths:
       - 'weed/iam/**'
       - 'weed/s3api/**'
-      - 'weed/credential/**'
-      - 'weed/pb/**'
       - 'test/s3/iam/**'
       - '.github/workflows/s3-iam-tests.yml'
   push:
@@ -14,8 +12,6 @@ on:
     paths:
       - 'weed/iam/**'
       - 'weed/s3api/**'
-      - 'weed/credential/**'
-      - 'weed/pb/**'
       - 'test/s3/iam/**'
       - '.github/workflows/s3-iam-tests.yml'
   
@@ -69,7 +65,7 @@ jobs:
 
       - name: Upload test results on failure
         if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v5
         with:
           name: iam-unit-test-results
           path: |
@@ -84,7 +80,7 @@ jobs:
     timeout-minutes: 25
     strategy:
       matrix:
-        test-type: ["basic", "advanced", "policy-enforcement", "group"]
+        test-type: ["basic", "advanced", "policy-enforcement"]
         
     steps:
       - name: Check out code
@@ -121,7 +117,7 @@ jobs:
             "basic")
               echo "Running basic IAM functionality tests..."
               make clean setup start-services wait-for-services
-              go test -v -timeout 15m -run "TestS3IAMAuthentication|TestS3IAMBasicWorkflow|TestS3IAMTokenValidation|TestIAMUserManagement|TestIAMAccessKeyManagement|TestIAMPolicyManagement" ./...
+              go test -v -timeout 15m -run "TestS3IAMAuthentication|TestS3IAMBasicWorkflow|TestS3IAMTokenValidation" ./...
               ;;
             "advanced")
               echo "Running advanced IAM feature tests..."
@@ -133,11 +129,6 @@ jobs:
               make clean setup start-services wait-for-services
               go test -v -timeout 15m -run "TestS3IAMPolicyEnforcement|TestS3IAMBucketPolicy|TestS3IAMContextual" ./...
               ;;
-            "group")
-              echo "Running IAM group management tests..."
-              make clean setup start-services wait-for-services
-              go test -v -timeout 15m -run "TestIAMGroup" ./...
-              ;;
             *)
               echo "Unknown test type: ${{ matrix.test-type }}"
               exit 1
@@ -171,7 +162,7 @@ jobs:
 
       - name: Upload test logs on failure
         if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v5
         with:
           name: s3-iam-integration-logs-${{ matrix.test-type }}
           path: test/s3/iam/weed-*.log
@@ -231,7 +222,7 @@ jobs:
 
       - name: Upload distributed test logs
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v5
         with:
           name: s3-iam-distributed-logs
           path: test/s3/iam/weed-*.log
@@ -283,7 +274,7 @@ jobs:
 
       - name: Upload performance test results
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v5
         with:
           name: s3-iam-performance-results
           path: |

.github/workflows/s3-keycloak-tests.yml

@@ -97,7 +97,7 @@ jobs:
           # Verify service accessibility
           echo "=== Verifying Service Accessibility ==="
           curl -f http://localhost:8080/realms/master
-          curl -s http://localhost:8333/healthz
+          curl -s http://localhost:8333
           echo "✅ SeaweedFS S3 API is responding (IAM-protected endpoint)"
           
           # Run Keycloak-specific tests
@@ -152,7 +152,7 @@ jobs:
 
       - name: Upload test logs on failure
         if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v5
         with:
           name: s3-keycloak-test-logs
           path: |

.github/workflows/s3-mutation-regression-tests.yml

@@ -1,133 +0,0 @@
-name: "S3 Mutation Regression Tests"
-
-on:
-  pull_request:
-    paths:
-      - 'weed/s3api/**'
-      - 'test/s3/delete/**'
-      - 'test/s3/distributed_lock/**'
-      - 'test/s3/versioning/**'
-      - 'test/volume_server/framework/**'
-      - 'docker/compose/s3.json'
-      - '.github/workflows/s3-mutation-regression-tests.yml'
-
-concurrency:
-  group: ${{ github.head_ref }}/s3-mutation-regression-tests
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  s3-versioning-regressions:
-    name: S3 Versioning Regression Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 25
-
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v6
-
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: 'go.mod'
-
-      - name: Run S3 versioning regression tests
-        timeout-minutes: 20
-        working-directory: test/s3/versioning
-        run: |
-          set -x
-          make test-with-server TEST_PATTERN="TestVersioningCompleteMultipartUploadIsIdempotent|TestVersioningSelfCopyMetadataReplaceCreatesNewVersion|TestVersioningSelfCopyMetadataReplaceSuspendedKeepsNullVersion|TestSuspendedDeleteCreatesDeleteMarker"
-
-      - name: Show server logs on failure
-        if: failure()
-        working-directory: test/s3/versioning
-        run: |
-          echo "=== Server Logs ==="
-          if [ -f weed-test.log ]; then
-            tail -100 weed-test.log
-          fi
-
-      - name: Upload versioning logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: s3-versioning-regression-logs
-          path: test/s3/versioning/weed-test*.log
-          retention-days: 3
-
-  s3-delete-regressions:
-    name: S3 Delete Regression Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 20
-
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v6
-
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: 'go.mod'
-
-      - name: Run S3 delete regression tests
-        timeout-minutes: 15
-        working-directory: test/s3/delete
-        run: |
-          set -x
-          make test-with-server
-
-      - name: Show server logs on failure
-        if: failure()
-        working-directory: test/s3/delete
-        run: |
-          echo "=== Server Logs ==="
-          if [ -f weed-test.log ]; then
-            tail -100 weed-test.log
-          fi
-
-      - name: Upload delete logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: s3-delete-regression-logs
-          path: test/s3/delete/weed-test*.log
-          retention-days: 3
-
-  s3-distributed-lock-regressions:
-    name: S3 Distributed Lock Regression Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 30
-
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v6
-
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: 'go.mod'
-
-      - name: Build SeaweedFS
-        run: |
-          go build -o weed/weed -buildvcs=false ./weed
-
-      - name: Run distributed lock regressions
-        timeout-minutes: 25
-        env:
-          TMPDIR: ${{ github.workspace }}/test/s3/distributed_lock/tmp
-          S3_DISTRIBUTED_LOCK_KEEP_LOGS: "1"
-          WEED_BINARY: ${{ github.workspace }}/weed/weed
-        run: |
-          set -x
-          mkdir -p "$TMPDIR"
-          go test -v -count=1 -timeout=20m ./test/s3/distributed_lock
-
-      - name: Upload distributed lock logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: s3-distributed-lock-regression-logs
-          path: test/s3/distributed_lock/tmp/seaweedfs_s3_distributed_lock_*
-          retention-days: 3

.github/workflows/s3-parquet-tests.yml

@@ -41,7 +41,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: ^1.25
+          go-version: ^1.24
           cache: true
       
       - name: Set up Python ${{ matrix.python-version }}
@@ -121,7 +121,7 @@ jobs:
       
       - name: Upload test logs on failure
         if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v5
         with:
           name: test-logs-python-${{ matrix.python-version }}
           path: |
@@ -148,7 +148,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: ^1.25
+          go-version: ^1.24
           cache: true
       
       - name: Run Go unit tests

.github/workflows/s3-policy-tests.yml

@@ -1,426 +0,0 @@
-name: "S3 Policy Integration Tests"
-
-on:
-  pull_request:
-    paths:
-      - 'weed/s3api/s3_iam_middleware.go'
-      - 'weed/s3api/s3api_bucket_policy*.go'
-      - 'weed/s3api/s3_action_resolver.go'
-      - 'weed/s3api/policy/**'
-      - 'weed/iam/**'
-      - 'test/s3/iam/**'
-      - 'test/s3/policy/**'
-      - '.github/workflows/s3-policy-tests.yml'
-  push:
-    branches: [ master, main ]
-    paths:
-      - 'weed/s3api/s3_iam_middleware.go'
-      - 'weed/s3api/s3api_bucket_policy*.go'
-      - 'weed/s3api/s3_action_resolver.go'
-      - 'weed/s3api/policy/**'
-      - 'weed/iam/**'
-      - 'test/s3/iam/**'
-      - 'test/s3/policy/**'
-      - '.github/workflows/s3-policy-tests.yml'
-
-concurrency:
-  group: ${{ github.head_ref }}/s3-policy-tests
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-defaults:
-  run:
-    working-directory: weed
-
-jobs:
-  # Unit tests for policy components
-  policy-unit-tests:
-    name: S3 Policy Unit Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 15
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v6
-
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Get dependencies
-        run: |
-          go mod download
-
-      - name: Run S3 Policy Unit Tests
-        timeout-minutes: 10
-        run: |
-          set -x
-          echo "=== Running S3 Action Resolver Tests ==="
-          go test -v -timeout 5m ./s3api/... -run ".*ActionResolver.*"
-          
-          echo "=== Running S3 Bucket Policy Engine Tests ==="
-          go test -v -timeout 5m ./s3api/... -run ".*BucketPolicy.*|.*PolicyEngine.*"
-          
-          echo "=== Running IAM Policy Tests ==="
-          go test -v -timeout 5m ./iam/policy/...
-
-      - name: Upload test results on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: policy-unit-test-results
-          path: |
-            weed/testdata/
-            weed/**/testdata/
-          retention-days: 3
-
-  # S3 Policy Variables Integration Tests
-  s3-policy-variables-tests:
-    name: S3 Policy Variables Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 25
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v6
-
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false
-
-      - name: Run S3 Policy Variables Integration Tests
-        timeout-minutes: 20
-        working-directory: test/s3/iam
-        run: |
-          set -x
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          df -h
-          
-          echo "=== Starting S3 Policy Variables Integration Tests ==="
-          
-          # Set WEED_BINARY to use the installed version
-          export WEED_BINARY=$(which weed)
-          export TEST_TIMEOUT=15m
-          
-          # Run policy variables tests
-          echo "Running policy variables tests..."
-          
-          # Kill any existing weed server on port 8333
-          if lsof -Pi :8333 -sTCP:LISTEN -t >/dev/null 2>&1 ; then
-            kill $(lsof -t -i:8333) 2>/dev/null || true
-            sleep 2
-          fi
-          
-          # Start weed server with IAM configuration
-          echo "Starting weed server with IAM configuration..."
-          $WEED_BINARY server \
-            -s3 \
-            -s3.port=8333 \
-            -s3.iam.config="$(pwd)/test_iam_config.json" \
-            -filer \
-            -volume.max=0 \
-            -master.volumeSizeLimitMB=100 \
-            -s3.allowDeleteBucketNotEmpty=true \
-            > /tmp/weed_policy_test_server.log 2>&1 &
-          
-          SERVER_PID=$!
-          echo "Server started with PID: $SERVER_PID"
-          
-          # Wait for server to be ready
-          echo "Waiting for server to be ready..."
-          MAX_WAIT=30
-          COUNTER=0
-          while ! curl -s http://localhost:8333/status > /dev/null 2>&1; do
-            sleep 1
-            COUNTER=$((COUNTER + 1))
-            if [ $COUNTER -ge $MAX_WAIT ]; then
-              echo "Server failed to start within ${MAX_WAIT} seconds"
-              echo "Server log:"
-              cat /tmp/weed_policy_test_server.log
-              kill $SERVER_PID 2>/dev/null || true
-              exit 1
-            fi
-          done
-          
-          echo "Server is ready!"
-          
-          # Trap to ensure server is killed on exit
-          trap "kill $SERVER_PID 2>/dev/null || true" EXIT
-          
-          # Run the tests
-          go test -v -timeout 15m -run TestS3PolicyVariables ./...
-
-      - name: Show service logs on failure
-        if: failure()
-        working-directory: test/s3/iam
-        run: |
-          echo "=== Service Logs ==="
-          if [ -f /tmp/weed_policy_test_server.log ]; then
-            echo "--- Last 100 lines of Server Log ---"
-            tail -100 /tmp/weed_policy_test_server.log
-          fi
-          echo ""
-          echo "=== Process Information ==="
-          ps aux | grep -E "(weed|test)" || true
-          netstat -tlnp | grep -E "(8333|8888|9333|8080)" || true
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: s3-policy-variables-test-logs
-          path: /tmp/weed_policy_test_server.log
-          retention-days: 5
-
-  # S3 Policy Enforcement Integration Tests
-  s3-policy-enforcement-tests:
-    name: S3 Policy Enforcement Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 30
-    strategy:
-      matrix:
-        test-case: ["basic-policy", "contextual-policy", "advanced-policy"]
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v6
-
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false
-
-      - name: Run S3 Policy Enforcement Tests - ${{ matrix.test-case }}
-        timeout-minutes: 25
-        working-directory: test/s3/iam
-        run: |
-          set -x
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          df -h
-          
-          echo "=== Starting S3 Policy Enforcement Tests (${{ matrix.test-case }}) ==="
-          
-          export WEED_BINARY=$(which weed)
-          export TEST_TIMEOUT=20m
-          
-          # Kill any existing weed server on port 8333
-          if lsof -Pi :8333 -sTCP:LISTEN -t >/dev/null 2>&1 ; then
-            kill $(lsof -t -i:8333) 2>/dev/null || true
-            sleep 2
-          fi
-          
-          # Start weed server with IAM configuration
-          echo "Starting weed server with IAM configuration..."
-          $WEED_BINARY server \
-            -s3 \
-            -s3.port=8333 \
-            -s3.iam.config="$(pwd)/test_iam_config.json" \
-            -filer \
-            -volume.max=0 \
-            -master.volumeSizeLimitMB=100 \
-            -s3.allowDeleteBucketNotEmpty=true \
-            > /tmp/weed_policy_enforcement_${{ matrix.test-case }}.log 2>&1 &
-          
-          SERVER_PID=$!
-          echo "Server started with PID: $SERVER_PID"
-          
-          # Wait for server to be ready
-          echo "Waiting for server to be ready..."
-          MAX_WAIT=30
-          COUNTER=0
-          while ! curl -s http://localhost:8333/status > /dev/null 2>&1; do
-            sleep 1
-            COUNTER=$((COUNTER + 1))
-            if [ $COUNTER -ge $MAX_WAIT ]; then
-              echo "Server failed to start within ${MAX_WAIT} seconds"
-              cat /tmp/weed_policy_enforcement_${{ matrix.test-case }}.log
-              kill $SERVER_PID 2>/dev/null || true
-              exit 1
-            fi
-          done
-          
-          echo "Server is ready!"
-          
-          # Trap to ensure server is killed on exit
-          trap "kill $SERVER_PID 2>/dev/null || true" EXIT
-          
-          # Run tests based on test case
-          case "${{ matrix.test-case }}" in
-            "basic-policy")
-              echo "Running basic policy enforcement tests..."
-              go test -v -timeout 20m -run "TestS3IAMBucketPolicy|TestS3IAMPolicyEnforcement" ./...
-              ;;
-            "contextual-policy")
-              echo "Running contextual policy tests..."
-              go test -v -timeout 20m -run "TestS3PolicyVariables|TestS3IAMContextual" ./...
-              ;;
-            "advanced-policy")
-              echo "Running advanced policy tests..."
-              go test -v -timeout 20m -run "TestS3IAMMultipart|TestS3IAMPresigned" ./...
-              ;;
-            *)
-              echo "Unknown test case: ${{ matrix.test-case }}"
-              exit 1
-              ;;
-          esac
-
-      - name: Show service logs on failure
-        if: failure()
-        working-directory: test/s3/iam
-        run: |
-          echo "=== Service Logs ==="
-          if [ -f /tmp/weed_policy_enforcement_${{ matrix.test-case }}.log ]; then
-            echo "--- Last 100 lines of Server Log ---"
-            tail -100 /tmp/weed_policy_enforcement_${{ matrix.test-case }}.log
-          fi
-          echo ""
-          echo "=== Process Information ==="
-          ps aux | grep -E "(weed|test)" || true
-          netstat -tlnp | grep -E "(8333|8888|9333|8080)" || true
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: s3-policy-enforcement-logs-${{ matrix.test-case }}
-          path: /tmp/weed_policy_enforcement_${{ matrix.test-case }}.log
-          retention-days: 5
-
-  # Trusted Proxy Detection Tests
-  trusted-proxy-tests:
-    name: Trusted Proxy Detection Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 20
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v6
-
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false
-
-      - name: Run Trusted Proxy Tests
-        timeout-minutes: 15
-        working-directory: test/s3/iam
-        run: |
-          set -x
-          echo "=== Running Trusted Proxy Detection Tests ==="
-          
-          export WEED_BINARY=$(which weed)
-          
-          # Kill any existing weed server on port 8333
-          if lsof -Pi :8333 -sTCP:LISTEN -t >/dev/null 2>&1 ; then
-            kill $(lsof -t -i:8333) 2>/dev/null || true
-            sleep 2
-          fi
-          
-          # Start weed server
-          echo "Starting weed server..."
-          $WEED_BINARY server \
-            -s3 \
-            -s3.port=8333 \
-            -s3.iam.config="$(pwd)/test_iam_config.json" \
-            -filer \
-            -volume.max=0 \
-            -master.volumeSizeLimitMB=100 \
-            -s3.allowDeleteBucketNotEmpty=true \
-            > /tmp/weed_proxy_test.log 2>&1 &
-          
-          SERVER_PID=$!
-          echo "Server started with PID: $SERVER_PID"
-          
-          # Wait for server to be ready
-          echo "Waiting for server to be ready..."
-          MAX_WAIT=30
-          COUNTER=0
-          while ! curl -s http://localhost:8333/status > /dev/null 2>&1; do
-            sleep 1
-            COUNTER=$((COUNTER + 1))
-            if [ $COUNTER -ge $MAX_WAIT ]; then
-              echo "Server failed to start within ${MAX_WAIT} seconds"
-              kill $SERVER_PID 2>/dev/null || true
-              exit 1
-            fi
-          done
-          
-          # Trap to ensure server is killed on exit
-          trap "kill $SERVER_PID 2>/dev/null || true" EXIT
-          
-          # Run proxy tests
-          go test -v -timeout 10m -run "TestTrustedProxy|TestPrivateIP" ./...
-
-      - name: Show service logs on failure
-        if: failure()
-        run: |
-          echo "=== Service Logs ==="
-          if [ -f /tmp/weed_proxy_test.log ]; then
-            echo "--- Last 100 lines of Server Log ---"
-            tail -100 /tmp/weed_proxy_test.log
-          fi
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: trusted-proxy-test-logs
-          path: /tmp/weed_proxy_test.log
-          retention-days: 3
-
-  # S3 Policy Shell Integration Tests
-  s3-policy-shell-tests:
-    name: S3 Policy Shell Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 15
-
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v6
-
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false
-
-      - name: Run S3 Policy Shell Tests
-        timeout-minutes: 10
-        working-directory: test/s3/policy
-        run: |
-          set -x
-          echo "=== Running S3 Policy Shell Tests ==="
-
-          # Set WEED_BINARY to use the installed version (though test uses 'weed' command)
-          export WEED_BINARY=$(which weed)
-          export PATH=$PATH:$(dirname $WEED_BINARY)
-
-          go test -v -timeout 10m ./...

.github/workflows/s3-proxy-signature-tests.yml

@@ -1,122 +0,0 @@
-name: "S3 Proxy Signature Tests"
-
-on:
-  push:
-    branches: [ master ]
-  pull_request:
-    branches: [ master ]
-
-concurrency:
-  group: ${{ github.head_ref || github.ref }}/s3-proxy-signature-tests
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  proxy-signature-tests:
-    name: S3 Proxy Signature Verification Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 15
-    steps:
-      - name: Check out code into the Go module directory
-        uses: actions/checkout@v6
-
-      - name: Set up Go 1.x
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
-
-      - name: Build SeaweedFS binary for Linux
-        run: |
-          set -x
-          CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -buildvcs=false -v -o test/s3/proxy_signature/weed ./weed
-
-      - name: Run S3 Proxy Signature Tests
-        timeout-minutes: 10
-        working-directory: test/s3/proxy_signature
-        run: |
-          set -x
-          echo "Starting Docker Compose services..."
-          docker compose up -d --build
-          
-          # Check if containers are running
-          echo "Checking container status..."
-          docker compose ps
-          
-          # Wait for services to be ready
-          echo "Waiting for nginx proxy to be ready..."
-          PROXY_READY=0
-          for i in $(seq 1 30); do
-            if curl -s http://localhost:9000/ > /dev/null 2>&1; then
-              echo "Proxy is ready"
-              PROXY_READY=1
-              break
-            fi
-            echo "Waiting for proxy... ($i/30)"
-            sleep 1
-          done
-          if [ $PROXY_READY -eq 0 ]; then
-            echo "ERROR: Proxy failed to become ready after 30 seconds"
-            echo "Docker compose logs:"
-            docker compose logs --no-color || true
-            exit 1
-          fi
-          
-          # Wait for SeaweedFS to be ready
-          echo "Waiting for SeaweedFS S3 gateway to be ready via proxy..."
-          S3_READY=0
-          for i in $(seq 1 30); do
-            # Check logs first for startup message (weed mini says "S3 service is ready")
-            if docker compose logs seaweedfs 2>&1 | grep -qE "S3 (gateway|service).*(started|ready)"; then
-              echo "SeaweedFS S3 gateway is ready"
-              S3_READY=1
-              break
-            fi
-            # Fallback: check headers via proxy (which is already ready)
-            if curl -s -I http://localhost:9000/ | grep -qi "SeaweedFS"; then
-              echo "SeaweedFS S3 gateway is responding via proxy"
-              S3_READY=1
-              break
-            fi
-            echo "Waiting for S3 gateway... ($i/30)"
-            sleep 1
-          done
-          if [ $S3_READY -eq 0 ]; then
-            echo "ERROR: SeaweedFS S3 gateway failed to become ready after 30 seconds"
-            echo "Latest seaweedfs logs:"
-            docker compose logs --no-color --tail 20 seaweedfs || true
-            exit 1
-          fi
-          
-          # Run the test script inside AWS CLI container
-          echo "Running test script..."
-          docker run --rm --network host \
-            --entrypoint bash \
-            amazon/aws-cli:latest \
-            -c "$(cat test.sh)"
-          
-          TEST_RESULT=$?
-          
-          # Cleanup
-          docker compose down
-          
-          exit $TEST_RESULT
-
-      - name: Cleanup on failure
-        if: failure()
-        working-directory: test/s3/proxy_signature
-        run: |
-          echo "Cleaning up Docker containers..."
-          ls -al weed || true
-          ldd weed || true
-          echo "Docker compose logs:"
-          docker compose logs --no-color || true
-          echo "Container status before cleanup:"
-          docker ps -a
-          echo "Stopping services..."
-          docker compose down || true

.github/workflows/s3-spark-tests.yml

@@ -1,81 +0,0 @@
-name: "S3 Spark Integration Tests"
-
-on:
-  pull_request:
-    paths:
-      - 'weed/s3api/**'
-      - 'weed/filer/**'
-      - 'test/s3/spark/**'
-      - 'test/s3tables/testutil/**'
-      - '.github/workflows/s3-spark-tests.yml'
-  workflow_dispatch:
-
-concurrency:
-  group: ${{ github.head_ref }}/s3-spark-tests
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  s3-spark-issue-repro-tests:
-    name: S3 Spark Issue Reproduction Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 45
-
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v6
-
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Set up Docker
-        uses: docker/setup-buildx-action@v4
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false ./weed
-
-      - name: Pre-pull Spark image
-        run: docker pull apache/spark:3.5.8
-
-      - name: Run S3 Spark integration tests
-        working-directory: test/s3/spark
-        timeout-minutes: 35
-        run: |
-          set -x
-          set -o pipefail
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          df -h
-          echo "=== Starting S3 Spark Integration Tests ==="
-
-          go test -v -timeout 30m . 2>&1 | tee test-output.log || {
-            echo "S3 Spark integration tests failed"
-            exit 1
-          }
-
-      - name: Show test output on failure
-        if: failure()
-        working-directory: test/s3/spark
-        run: |
-          echo "=== Test Output ==="
-          if [ -f test-output.log ]; then
-            tail -200 test-output.log
-          fi
-
-          echo "=== Process information ==="
-          ps aux | grep -E "(weed|test|docker|spark)" || true
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: s3-spark-test-logs
-          path: test/s3/spark/test-output.log
-          retention-days: 3

.github/workflows/s3-sse-tests.yml

@@ -95,7 +95,7 @@ jobs:
 
       - name: Upload test logs on failure
         if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v5
         with:
           name: s3-sse-test-logs-${{ matrix.test-type }}
           path: test/s3/sse/weed-test*.log
@@ -143,7 +143,7 @@ jobs:
 
       - name: Upload server logs on failure
         if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v5
         with:
           name: s3-sse-compatibility-logs
           path: test/s3/sse/weed-test*.log
@@ -192,7 +192,7 @@ jobs:
 
       - name: Upload server logs on failure
         if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v5
         with:
           name: s3-sse-metadata-persistence-logs
           path: test/s3/sse/weed-test*.log
@@ -241,7 +241,7 @@ jobs:
 
       - name: Upload server logs on failure
         if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v5
         with:
           name: s3-sse-copy-operations-logs
           path: test/s3/sse/weed-test*.log
@@ -290,7 +290,7 @@ jobs:
 
       - name: Upload server logs on failure
         if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v5
         with:
           name: s3-sse-multipart-logs
           path: test/s3/sse/weed-test*.log
@@ -340,58 +340,8 @@ jobs:
 
       - name: Upload performance test logs
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v5
         with:
           name: s3-sse-performance-logs
           path: test/s3/sse/weed-test*.log
           retention-days: 7
-
-  s3-volume-encryption:
-    name: S3 Volume Encryption Test
-    runs-on: ubuntu-22.04
-    timeout-minutes: 20
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v6
-
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false
-
-      - name: Run S3 Volume Encryption Integration Tests
-        timeout-minutes: 15
-        working-directory: test/s3/sse
-        run: |
-          set -x
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          
-          # Run volume encryption tests with -s3.encryptVolumeData flag
-          echo "🚀 Running S3 volume encryption integration tests..."
-          make test-volume-encryption || {
-            echo "❌ Volume encryption tests failed, checking logs..."
-            if [ -f /tmp/seaweedfs-sse-mini.log ]; then
-              echo "=== Server logs ==="
-              tail -100 /tmp/seaweedfs-sse-mini.log
-            fi
-            echo "=== Process information ==="
-            ps aux | grep -E "(weed|test)" || true
-            exit 1
-          }
-
-      - name: Upload server logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: s3-volume-encryption-logs
-          path: /tmp/seaweedfs-sse-*.log
-          retention-days: 3
-

.github/workflows/s3-tables-tests.yml

@@ -1,686 +0,0 @@
-name: "S3 Tables Integration Tests"
-
-on:
-  pull_request:
-  
-concurrency:
-  group: ${{ github.head_ref }}/s3-tables-tests
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-
-jobs:
-  s3-tables-tests:
-    name: S3 Tables Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 30
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v6
-
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Run go mod tidy
-        run: go mod tidy
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false ./weed
-
-      - name: Run S3 Tables Integration Tests
-        timeout-minutes: 25
-        working-directory: test/s3tables/table-buckets
-        run: |
-          set -x
-          set -o pipefail
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          df -h
-          echo "=== Starting S3 Tables Tests ==="
-          
-          # Run S3 Tables integration tests
-          go test -v -timeout 20m . 2>&1 | tee test-output.log || {
-            echo "S3 Tables integration tests failed"
-            exit 1
-          }
-
-      - name: Show test output on failure
-        if: failure()
-        working-directory: test/s3tables/table-buckets
-        run: |
-          echo "=== Test Output ==="
-          if [ -f test-output.log ]; then
-            tail -200 test-output.log
-          fi
-          
-          echo "=== Process information ==="
-          ps aux | grep -E "(weed|test)" || true
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: s3-tables-test-logs
-          path: test/s3tables/table-buckets/test-output.log
-          retention-days: 3
-
-  iceberg-catalog-tests:
-    name: Iceberg Catalog Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 30
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v6
-
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Run go mod tidy
-        run: go mod tidy
-
-      - name: Run Iceberg Catalog Integration Tests
-        timeout-minutes: 25
-        working-directory: test/s3tables/catalog
-        run: |
-          set -x
-          set -o pipefail
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          df -h
-          echo "=== Starting Iceberg Catalog Tests ==="
-          
-          # Run Iceberg catalog integration tests using Makefile (handles build)
-          make test 2>&1 | tee test-output.log || {
-            echo "Iceberg catalog integration tests failed"
-            exit 1
-          }
-
-      - name: Show test output on failure
-        if: failure()
-        working-directory: test/s3tables/catalog
-        run: |
-          echo "=== Test Output ==="
-          if [ -f test-output.log ]; then
-            tail -200 test-output.log
-          fi
-          
-          echo "=== Process information ==="
-          ps aux | grep -E "(weed|test|docker)" || true
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: iceberg-catalog-test-logs
-          path: test/s3tables/catalog/test-output.log
-          retention-days: 3
-
-  trino-iceberg-catalog-tests:
-    name: Trino Iceberg Catalog Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 30
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v6
-
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Set up Docker
-        uses: docker/setup-buildx-action@v4
-
-      - name: Pre-pull Trino image
-        run: docker pull trinodb/trino:479
-
-      - name: Run go mod tidy
-        run: go mod tidy
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false ./weed
-
-      - name: Run Trino Iceberg Catalog Integration Tests
-        timeout-minutes: 25
-        working-directory: test/s3tables/catalog_trino
-        run: |
-          set -x
-          set -o pipefail
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          df -h
-          echo "=== Starting Trino Iceberg Catalog Tests ==="
-          
-          # Run Trino + Iceberg catalog integration tests
-          go test -v -timeout 20m . 2>&1 | tee test-output.log || {
-            echo "Trino Iceberg catalog integration tests failed"
-            exit 1
-          }
-
-      - name: Show test output on failure
-        if: failure()
-        working-directory: test/s3tables/catalog_trino
-        run: |
-          echo "=== Test Output ==="
-          if [ -f test-output.log ]; then
-            tail -200 test-output.log
-          fi
-          
-          echo "=== Process information ==="
-          ps aux | grep -E "(weed|test|docker)" || true
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: trino-iceberg-catalog-test-logs
-          path: test/s3tables/catalog_trino/test-output.log
-          retention-days: 3
-
-  polaris-integration-tests:
-    name: Polaris Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 30
-
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v6
-
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Run go mod tidy
-        run: go mod tidy
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false ./weed
-
-      - name: Pre-pull Polaris image
-        run: docker pull apache/polaris:latest
-
-      - name: Run Polaris Integration Tests
-        timeout-minutes: 25
-        run: |
-          set -x
-          set -o pipefail
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          df -h
-          echo "=== Starting Polaris Tests ==="
-
-          go test -v -timeout 20m ./test/s3tables/polaris 2>&1 | tee test/s3tables/polaris/test-output.log || {
-            echo "Polaris integration tests failed"
-            exit 1
-          }
-
-      - name: Show test output on failure
-        if: failure()
-        working-directory: test/s3tables/polaris
-        run: |
-          echo "=== Test Output ==="
-          if [ -f test-output.log ]; then
-            tail -200 test-output.log
-          fi
-
-          echo "=== Process information ==="
-          ps aux | grep -E "(weed|test|docker)" || true
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: polaris-test-logs
-          path: test/s3tables/polaris/test-output.log
-          retention-days: 3
-
-  spark-iceberg-catalog-tests:
-    name: Spark Iceberg Catalog Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 30
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v6
-
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Set up Docker
-        uses: docker/setup-buildx-action@v4
-
-      - name: Pre-pull Spark image
-        run: docker pull apache/spark:3.5.1
-
-      - name: Run go mod tidy
-        run: go mod tidy
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false ./weed
-
-      - name: Run Spark Iceberg Catalog Integration Tests
-        timeout-minutes: 25
-        working-directory: test/s3tables/catalog_spark
-        run: |
-          set -x
-          set -o pipefail
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          df -h
-          echo "=== Starting Spark Iceberg Catalog Tests ==="
-          
-          # Run Spark + Iceberg catalog integration tests
-          go test -v -timeout 20m . 2>&1 | tee test-output.log || {
-            echo "Spark Iceberg catalog integration tests failed"
-            exit 1
-          }
-
-      - name: Show test output on failure
-        if: failure()
-        working-directory: test/s3tables/catalog_spark
-        run: |
-          echo "=== Test Output ==="
-          if [ -f test-output.log ]; then
-            tail -200 test-output.log
-          fi
-          
-          echo "=== Process information ==="
-          ps aux | grep -E "(weed|test|docker)" || true
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: spark-iceberg-catalog-test-logs
-          path: test/s3tables/catalog_spark/test-output.log
-          retention-days: 3
-
-  risingwave-catalog-tests:
-    name: RisingWave Catalog Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 30
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v6
-
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Set up Docker
-        uses: docker/setup-buildx-action@v4
-
-      - name: Pre-pull RisingWave image
-        run: |
-          docker pull risingwavelabs/risingwave:v2.5.0
-          docker pull postgres:16-alpine
-
-      - name: Run go mod tidy
-        run: go mod tidy
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false ./weed
-
-      - name: Run RisingWave Catalog Integration Tests
-        timeout-minutes: 25
-        working-directory: test/s3tables/catalog_risingwave
-        run: |
-          set -x
-          set -o pipefail
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          df -h
-          echo "=== Starting RisingWave Catalog Tests ==="
-          
-          # Run RisingWave catalog integration tests
-          go test -v -timeout 20m . 2>&1 | tee test-output.log || {
-            echo "RisingWave catalog integration tests failed"
-            exit 1
-          }
-
-      - name: Show test output on failure
-        if: failure()
-        working-directory: test/s3tables/catalog_risingwave
-        run: |
-          echo "=== Test Output ==="
-          if [ -f test-output.log ]; then
-            tail -200 test-output.log
-          fi
-          
-          echo "=== Process information ==="
-          ps aux | grep -E "(weed|test|docker)" || true
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: risingwave-catalog-test-logs
-          path: test/s3tables/catalog_risingwave/test-output.log
-          retention-days: 3
-
-  sts-integration-tests:
-    name: STS Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 30
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v6
-
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Set up Docker
-        uses: docker/setup-buildx-action@v4
-
-      - name: Pre-pull Python image
-        run: docker pull python:3
-
-      - name: Run go mod tidy
-        run: go mod tidy
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false ./weed
-
-      - name: Run STS Integration Tests
-        timeout-minutes: 25
-        working-directory: test/s3tables/sts_integration
-        run: |
-          set -x
-          set -o pipefail
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          df -h
-          echo "=== Starting STS Integration Tests ==="
-          
-          # Run STS integration tests
-          go test -v -timeout 20m . 2>&1 | tee test-output.log || {
-            echo "STS integration tests failed"
-            exit 1
-          }
-
-      - name: Show test output on failure
-        if: failure()
-        working-directory: test/s3tables/sts_integration
-        run: |
-          echo "=== Test Output ==="
-          if [ -f test-output.log ]; then
-            tail -200 test-output.log
-          fi
-          
-          echo "=== Process information ==="
-          ps aux | grep -E "(weed|test|docker)" || true
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: sts-integration-test-logs
-          path: test/s3tables/sts_integration/test-output.log
-          retention-days: 3
-
-  lakekeeper-integration-tests:
-    name: Lakekeeper Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 30
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v6
-
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Set up Docker
-        uses: docker/setup-buildx-action@v4
-
-      - name: Pre-pull Python image
-        run: docker pull python:3
-        
-      - name: Pre-pull LocalStack image (if needed)
-        run: docker pull localstack/localstack:latest || true
-
-      - name: Run go mod tidy
-        run: go mod tidy
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false ./weed
-
-      - name: Run Lakekeeper Integration Tests
-        timeout-minutes: 25
-        working-directory: test/s3tables/lakekeeper
-        run: |
-          set -x
-          set -o pipefail
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          df -h
-          echo "=== Starting Lakekeeper Integration Tests ==="
-          
-          # Run Lakekeeper integration tests
-          go test -v -timeout 20m . 2>&1 | tee test-output.log || {
-            echo "Lakekeeper integration tests failed"
-            exit 1
-          }
-
-      - name: Show test output on failure
-        if: failure()
-        working-directory: test/s3tables/lakekeeper
-        run: |
-          echo "=== Test Output ==="
-          if [ -f test-output.log ]; then
-            tail -200 test-output.log
-          fi
-          
-          echo "=== Process information ==="
-          ps aux | grep -E "(weed|test|docker)" || true
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: lakekeeper-integration-test-logs
-          path: test/s3tables/lakekeeper/test-output.log
-          retention-days: 3
-
-  s3-tables-build-verification:
-    name: S3 Tables Build Verification
-    runs-on: ubuntu-22.04
-    timeout-minutes: 15
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v6
-
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Verify S3 Tables Package Builds
-        run: |
-          set -x
-          echo "=== Building S3 Tables package ==="
-          go build ./weed/s3api/s3tables || {
-            echo "S3 Tables package build failed"
-            exit 1
-          }
-          echo "S3 Tables package built successfully"
-
-      - name: Verify S3 API Integration Builds
-        run: |
-          set -x
-          echo "=== Building S3 API with S3 Tables integration ==="
-          go build ./weed/s3api || {
-            echo "S3 API build with S3 Tables failed"
-            exit 1
-          }
-          echo "S3 API with S3 Tables integration built successfully"
-
-      - name: Run Go Tests for S3 Tables Package
-        run: |
-          set -x
-          echo "=== Running Go unit tests for S3 Tables ==="
-          go test -v -race -timeout 5m ./weed/s3api/s3tables/... || {
-            echo "S3 Tables unit tests failed"
-            exit 1
-          }
-          echo "S3 Tables unit tests passed"
-
-      - name: Verify Iceberg Package Builds
-        run: |
-          set -x
-          echo "=== Building Iceberg package ==="
-          go build ./weed/s3api/iceberg || {
-            echo "Iceberg package build failed"
-            exit 1
-          }
-          echo "Iceberg package built successfully"
-
-      - name: Run Go Tests for Iceberg Package
-        run: |
-          set -x
-          echo "=== Running Go unit tests for Iceberg ==="
-          go test -v -race -timeout 5m ./weed/s3api/iceberg/... || {
-            echo "Iceberg unit tests failed"
-            exit 1
-          }
-          echo "Iceberg unit tests passed"
-
-  s3-tables-fmt-check:
-    name: S3 Tables Format Check
-    runs-on: ubuntu-22.04
-    timeout-minutes: 10
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v6
-
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Check Go Format
-        run: |
-          set -x
-          echo "=== Checking S3 Tables Go format ==="
-          unformatted=$(gofmt -l ./weed/s3api/s3tables)
-          if [ -n "$unformatted" ]; then
-            echo "Go format check failed - files need formatting"
-            echo "$unformatted"
-            exit 1
-          fi
-          echo "All S3 Tables files are properly formatted"
-
-      - name: Check S3 Tables Test Format
-        run: |
-          set -x
-          echo "=== Checking S3 Tables test format ==="
-          unformatted=$(gofmt -l ./test/s3tables)
-          if [ -n "$unformatted" ]; then
-            echo "Go format check failed for tests"
-            echo "$unformatted"
-            exit 1
-          fi
-          echo "All S3 Tables test files are properly formatted"
-
-      - name: Check Iceberg Format
-        run: |
-          set -x
-          echo "=== Checking Iceberg Go format ==="
-          unformatted=$(gofmt -l ./weed/s3api/iceberg)
-          if [ -n "$unformatted" ]; then
-            echo "Go format check failed for Iceberg - files need formatting"
-            echo "$unformatted"
-            exit 1
-          fi
-          echo "All Iceberg files are properly formatted"
-
-  s3-tables-vet:
-    name: S3 Tables Go Vet Check
-    runs-on: ubuntu-22.04
-    timeout-minutes: 10
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v6
-
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Run Go Vet
-        run: |
-          set -x
-          echo "=== Running go vet on S3 Tables package ==="
-          go vet ./weed/s3api/s3tables/... || {
-            echo "go vet check failed"
-            exit 1
-          }
-          echo "go vet checks passed"
-
-      - name: Run Go Vet on Tests
-        run: |
-          set -x
-          echo "=== Running go vet on S3 Tables tests ==="
-          go vet ./test/s3tables/... || {
-            echo "go vet check failed for tests"
-            exit 1
-          }
-          echo "go vet checks passed for tests"
-
-      - name: Run Go Vet on Iceberg
-        run: |
-          set -x
-          echo "=== Running go vet on Iceberg package ==="
-          go vet ./weed/s3api/iceberg/... || {
-            echo "go vet check failed for Iceberg"
-            exit 1
-          }
-          echo "go vet checks passed for Iceberg"

.github/workflows/s3tests.yml

@@ -64,7 +64,7 @@ jobs:
             -master.raftHashicorp -master.electionTimeout 1s -master.volumeSizeLimitMB=100 \
             -volume.max=100 -volume.preStopSeconds=1 \
             -master.port=9333 -volume.port=8080 -filer.port=8888 -s3.port=8000 -metricsPort=9324 \
-            -s3.allowDeleteBucketNotEmpty=true -s3.config="$GITHUB_WORKSPACE/docker/compose/s3.json" -master.peers=none &
+            -s3.allowEmptyFolder=false -s3.allowDeleteBucketNotEmpty=true -s3.config="$GITHUB_WORKSPACE/docker/compose/s3.json" -master.peers=none &
           pid=$!
           
           # Wait for all SeaweedFS components to be ready
@@ -368,7 +368,7 @@ jobs:
             -master.raftHashicorp -master.electionTimeout 1s -master.volumeSizeLimitMB=100 \
             -volume.max=100 -volume.preStopSeconds=1 \
             -master.port=9334 -volume.port=8081 -filer.port=8889 -s3.port=8001 -metricsPort=9325 \
-            -s3.allowDeleteBucketNotEmpty=true -s3.config="$GITHUB_WORKSPACE/docker/compose/s3.json" -master.peers=none &
+            -s3.allowEmptyFolder=false -s3.allowDeleteBucketNotEmpty=true -s3.config="$GITHUB_WORKSPACE/docker/compose/s3.json" -master.peers=none &
           pid=$!
           
           # Wait for all SeaweedFS components to be ready
@@ -526,7 +526,7 @@ jobs:
             -master.raftHashicorp -master.electionTimeout 1s -master.volumeSizeLimitMB=100 \
             -volume.max=100 -volume.preStopSeconds=1 \
             -master.port=9335 -volume.port=8082 -filer.port=8890 -s3.port=8002 -metricsPort=9326 \
-            -s3.allowDeleteBucketNotEmpty=true -s3.config="$GITHUB_WORKSPACE/docker/compose/s3.json" -master.peers=none &
+            -s3.allowEmptyFolder=false -s3.allowDeleteBucketNotEmpty=true -s3.config="$GITHUB_WORKSPACE/docker/compose/s3.json" -master.peers=none &
           pid=$!
           
           # Wait for all SeaweedFS components to be ready
@@ -636,7 +636,7 @@ jobs:
             -master.raftHashicorp -master.electionTimeout 1s -master.volumeSizeLimitMB=100 \
             -volume.max=100 -volume.preStopSeconds=1 \
             -master.port=9336 -volume.port=8083 -filer.port=8891 -s3.port=8003 -metricsPort=9327 \
-            -s3.allowDeleteBucketNotEmpty=true -s3.config="$GITHUB_WORKSPACE/docker/compose/s3.json" -master.peers=none &
+            -s3.allowEmptyFolder=false -s3.allowDeleteBucketNotEmpty=true -s3.config="$GITHUB_WORKSPACE/docker/compose/s3.json" -master.peers=none &
           pid=$!
           
           # Wait for all SeaweedFS components to be ready
@@ -817,7 +817,7 @@ jobs:
             -master.raftHashicorp -master.electionTimeout 1s -master.volumeSizeLimitMB=100 \
             -volume.max=100 -volume.preStopSeconds=1 \
             -master.port=9337 -volume.port=8085 -filer.port=8892 -s3.port=8004 -metricsPort=9328 \
-            -s3.allowDeleteBucketNotEmpty=true -s3.config="$GITHUB_WORKSPACE/docker/compose/s3.json" \
+            -s3.allowEmptyFolder=false -s3.allowDeleteBucketNotEmpty=true -s3.config="$GITHUB_WORKSPACE/docker/compose/s3.json" \
             -master.peers=none \
             > /tmp/seaweedfs-sql-server.log 2>&1 &
           pid=$!

.github/workflows/sftp-tests.yml

@@ -1,93 +0,0 @@
-name: "SFTP Integration Tests"
-
-on:
-  push:
-    branches: [ master, main ]
-    paths:
-      - 'weed/sftpd/**'
-      - 'weed/command/sftp.go'
-      - 'test/sftp/**'
-      - '.github/workflows/sftp-tests.yml'
-  pull_request:
-    branches: [ master, main ]
-    paths:
-      - 'weed/sftpd/**'
-      - 'weed/command/sftp.go'
-      - 'test/sftp/**'
-      - '.github/workflows/sftp-tests.yml'
-
-concurrency:
-  group: ${{ github.head_ref }}/sftp-tests
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-env:
-  TEST_TIMEOUT: '15m'
-
-jobs:
-  sftp-integration:
-    name: SFTP Integration Testing
-    runs-on: ubuntu-22.04
-    timeout-minutes: 20
-    
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v6
-      
-    - name: Set up Go
-      uses: actions/setup-go@v6
-      with:
-        go-version-file: 'go.mod'
-        
-    - name: Install dependencies
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y openssh-client
-        
-    - name: Build SeaweedFS
-      run: |
-        cd weed
-        go build -o weed .
-        chmod +x weed
-        ./weed version
-        
-    - name: Run SFTP Integration Tests
-      run: |
-        cd test/sftp
-        
-        echo "🧪 Running SFTP integration tests..."
-        echo "============================================"
-        
-        # Install test dependencies
-        go mod download
-        
-        # Run all SFTP tests
-        go test -v -timeout=${{ env.TEST_TIMEOUT }} ./...
-        
-        echo "============================================"
-        echo "✅ SFTP integration tests completed"
-        
-    - name: Test Summary
-      if: always()
-      run: |
-        echo "## 🔐 SFTP Integration Test Summary" >> $GITHUB_STEP_SUMMARY
-        echo "" >> $GITHUB_STEP_SUMMARY
-        echo "### Test Coverage" >> $GITHUB_STEP_SUMMARY
-        echo "- ✅ **HomeDir Path Translation**: User home directory mapping (fixes #7470)" >> $GITHUB_STEP_SUMMARY
-        echo "- ✅ **File Operations**: Upload, download, delete" >> $GITHUB_STEP_SUMMARY
-        echo "- ✅ **Directory Operations**: Create, list, remove" >> $GITHUB_STEP_SUMMARY
-        echo "- ✅ **Large File Handling**: 1MB+ file support" >> $GITHUB_STEP_SUMMARY
-        echo "- ✅ **Path Edge Cases**: Unicode, trailing slashes, .. paths" >> $GITHUB_STEP_SUMMARY
-        echo "- ✅ **Admin Access**: Root user verification" >> $GITHUB_STEP_SUMMARY
-        echo "" >> $GITHUB_STEP_SUMMARY
-        echo "### Test Configuration" >> $GITHUB_STEP_SUMMARY
-        echo "| User | HomeDir | Permissions |" >> $GITHUB_STEP_SUMMARY
-        echo "|------|---------|-------------|" >> $GITHUB_STEP_SUMMARY
-        echo "| admin | / | Full access |" >> $GITHUB_STEP_SUMMARY
-        echo "| testuser | /sftp/testuser | Home directory only |" >> $GITHUB_STEP_SUMMARY
-        echo "| readonly | /public | Read-only |" >> $GITHUB_STEP_SUMMARY
-
-
-

.github/workflows/spark-integration-tests.yml

@@ -34,7 +34,7 @@ jobs:
       uses: actions/checkout@v6
 
     - name: Set up JDK 11
-      uses: actions/setup-java@v5
+      uses: actions/setup-java@v4
       with:
         java-version: '11'
         distribution: 'temurin'
@@ -43,7 +43,7 @@ jobs:
     - name: Set up Go
       uses: actions/setup-go@v6
       with:
-        go-version-file: 'go.mod'
+        go-version: '1.24'
 
     - name: Build SeaweedFS binary
       run: |
@@ -125,7 +125,7 @@ jobs:
 
     - name: Upload test results
       if: always()
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@v4
       with:
         name: spark-test-results
         path: test/java/spark/target/surefire-reports/
@@ -133,7 +133,7 @@ jobs:
 
     - name: Publish test report
       if: always()
-      uses: dorny/test-reporter@v3
+      uses: dorny/test-reporter@v1
       with:
         name: Spark Test Results
         path: test/java/spark/target/surefire-reports/*.xml
@@ -150,7 +150,7 @@ jobs:
     - name: Cache Apache Spark
       if: false && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
       id: cache-spark
-      uses: actions/cache@v5
+      uses: actions/cache@v4
       with:
         path: spark-3.5.0-bin-hadoop3
         key: spark-3.5.0-hadoop3

.github/workflows/telemetry-integration.yml

@@ -1,46 +0,0 @@
-name: Telemetry Integration Tests
-
-on:
-  push:
-    branches: [ master ]
-    paths:
-      - 'telemetry/**'
-      - 'weed/telemetry/**'
-      - '.github/workflows/telemetry-integration.yml'
-  pull_request:
-    branches: [ master ]
-    paths:
-      - 'telemetry/**'
-      - 'weed/telemetry/**'
-      - '.github/workflows/telemetry-integration.yml'
-
-permissions:
-  contents: read
-
-jobs:
-  telemetry-integration-test:
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v6
-
-    - name: Set up Go
-      uses: actions/setup-go@v6
-      with:
-        go-version-file: 'go.mod'
-
-    - name: Build telemetry server
-      run: cd telemetry/server && go build -o telemetry-server .
-
-    - name: Run telemetry integration test
-      run: go run telemetry/test/integration.go
-
-    - name: Upload test logs on failure
-      if: failure()
-      uses: actions/upload-artifact@v7
-      with:
-        name: telemetry-test-logs
-        path: telemetry-server-test.log
-        retention-days: 7

.github/workflows/test-s3-over-https-using-awscli.yml

@@ -18,13 +18,13 @@ defaults:
 jobs:
   awscli-tests:
     runs-on: ubuntu-latest
-    timeout-minutes: 10
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@v6
 
       - uses: actions/setup-go@v6
         with:
-          go-version: ^1.25
+          go-version: ^1.24
 
       - name: Build SeaweedFS
         run: |
@@ -35,7 +35,7 @@ jobs:
           set -e
           mkdir -p /tmp/data
           ./weed -v=3 server -s3 -dir=/tmp/data -s3.config=../docker/compose/s3.json -master.peers=none > weed.log 2>&1 &
-          until curl -s http://localhost:8333/healthz > /dev/null; do sleep 1; done
+          until curl -s http://localhost:8333/ > /dev/null; do sleep 1; done
 
       - name: Setup Caddy
         run: |
@@ -54,7 +54,7 @@ jobs:
       - name: Start Caddy
         run: |
           ./caddy start
-          until curl -fsS --insecure https://localhost:8443/healthz > /dev/null; do sleep 1; done
+          until curl -fsS --insecure https://localhost:8443 > /dev/null; do sleep 1; done
 
       - name: Create Bucket
         run: |
@@ -103,7 +103,7 @@ jobs:
 
       - name: Upload server logs on failure
         if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v5
         with:
           name: seaweedfs-logs
           # Note: actions don't use defaults.run.working-directory, so path is relative to workspace root

.github/workflows/tus-tests.yml

@@ -1,103 +0,0 @@
-name: "TUS Protocol Tests"
-
-on:
-  pull_request:
-
-concurrency:
-  group: ${{ github.head_ref || github.ref }}/tus-tests
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-defaults:
-  run:
-    working-directory: weed
-
-jobs:
-  tus-integration-tests:
-    name: TUS Protocol Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 20
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v6
-
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false
-
-      - name: Run TUS Integration Tests
-        timeout-minutes: 15
-        working-directory: test/tus
-        run: |
-          set -x
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          df -h
-          echo "=== Starting TUS Tests ==="
-          
-          # Run tests with automatic server management
-          make test-with-server || {
-            echo "TUS integration tests failed, checking logs..."
-            if [ -f /tmp/seaweedfs-tus-filer.log ]; then
-              echo "=== Filer logs ==="
-              tail -100 /tmp/seaweedfs-tus-filer.log
-            fi
-            if [ -f /tmp/seaweedfs-tus-master.log ]; then
-              echo "=== Master logs ==="
-              tail -50 /tmp/seaweedfs-tus-master.log
-            fi
-            if [ -f /tmp/seaweedfs-tus-volume.log ]; then
-              echo "=== Volume logs ==="
-              tail -50 /tmp/seaweedfs-tus-volume.log
-            fi
-            exit 1
-          }
-
-      - name: Show server logs on failure
-        if: failure()
-        working-directory: test/tus
-        run: |
-          echo "=== Filer Server Logs ==="
-          if [ -f /tmp/seaweedfs-tus-filer.log ]; then
-            echo "Last 100 lines of filer logs:"
-            tail -100 /tmp/seaweedfs-tus-filer.log
-          else
-            echo "No filer log file found"
-          fi
-          
-          echo "=== Master Server Logs ==="
-          if [ -f /tmp/seaweedfs-tus-master.log ]; then
-            tail -50 /tmp/seaweedfs-tus-master.log
-          else
-            echo "No master log file found"
-          fi
-          
-          echo "=== Volume Server Logs ==="
-          if [ -f /tmp/seaweedfs-tus-volume.log ]; then
-            tail -50 /tmp/seaweedfs-tus-volume.log
-          else
-            echo "No volume log file found"
-          fi
-          
-          echo "=== Test Environment ==="
-          ps aux | grep -E "(weed|test)" || true
-          netstat -tlnp 2>/dev/null | grep -E "(18888|19333|18080)" || true
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: tus-test-logs
-          path: |
-            /tmp/seaweedfs-tus-*.log
-          retention-days: 3

.github/workflows/volume-server-integration-tests.yml

@@ -1,121 +0,0 @@
-name: "Volume Server Integration Tests"
-
-on:
-  pull_request:
-    branches: [ master ]
-    paths:
-      - 'test/volume_server/**'
-      - 'weed/server/**'
-      - 'weed/storage/**'
-      - 'weed/pb/volume_server.proto'
-      - 'weed/pb/volume_server_pb/**'
-      - '.github/workflows/volume-server-integration-tests.yml'
-  push:
-    branches: [ master, main ]
-    paths:
-      - 'test/volume_server/**'
-      - 'weed/server/**'
-      - 'weed/storage/**'
-      - 'weed/pb/volume_server.proto'
-      - 'weed/pb/volume_server_pb/**'
-      - '.github/workflows/volume-server-integration-tests.yml'
-
-concurrency:
-  group: ${{ github.head_ref || github.ref }}/volume-server-integration-tests
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-env:
-  TEST_TIMEOUT: '30m'
-
-jobs:
-  volume-server-integration-tests:
-    name: Volume Server Integration Tests (${{ matrix.test-type }} - Shard ${{ matrix.shard }})
-    runs-on: ubuntu-22.04
-    timeout-minutes: 45
-    strategy:
-      fail-fast: false
-      matrix:
-        test-type: [grpc, http]
-        shard: [1, 2, 3]
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v6
-
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: 'go.mod'
-
-      - name: Build SeaweedFS binary
-        run: |
-          cd weed
-          go build -o weed .
-          chmod +x weed
-          ./weed version
-
-      - name: Run volume server integration tests
-        env:
-          WEED_BINARY: ${{ github.workspace }}/weed/weed
-        run: |
-          if [ "${{ matrix.test-type }}" == "grpc" ]; then
-            if [ "${{ matrix.shard }}" == "1" ]; then
-              TEST_PATTERN="^Test[A-H]"
-            elif [ "${{ matrix.shard }}" == "2" ]; then
-              TEST_PATTERN="^Test[I-S]"
-            else
-              TEST_PATTERN="^Test[T-Z]"
-            fi
-          else
-            if [ "${{ matrix.shard }}" == "1" ]; then
-              TEST_PATTERN="^Test[A-G]"
-            elif [ "${{ matrix.shard }}" == "2" ]; then
-              TEST_PATTERN="^Test[H-R]"
-            else
-              TEST_PATTERN="^Test[S-Z]"
-            fi
-          fi
-          echo "Running volume server integration tests for ${{ matrix.test-type }} (Shard ${{ matrix.shard }}, pattern: ${TEST_PATTERN})..."
-          go test -v -count=1 -timeout=${{ env.TEST_TIMEOUT }} ./test/volume_server/${{ matrix.test-type }}/... -run "${TEST_PATTERN}"
-
-      - name: Collect logs on failure
-        if: failure()
-        run: |
-          mkdir -p /tmp/volume-server-it-logs
-          find /tmp -maxdepth 1 -type d -name "seaweedfs_volume_server_it_*" -print -exec cp -r {} /tmp/volume-server-it-logs/ \; || true
-
-      - name: Archive logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: volume-server-integration-test-logs
-          path: /tmp/volume-server-it-logs/
-          if-no-files-found: warn
-          retention-days: 7
-
-      - name: Test summary
-        if: always()
-        run: |
-          if [ "${{ matrix.test-type }}" == "grpc" ]; then
-            if [ "${{ matrix.shard }}" == "1" ]; then
-              TEST_PATTERN="^Test[A-H]"
-            elif [ "${{ matrix.shard }}" == "2" ]; then
-              TEST_PATTERN="^Test[I-S]"
-            else
-              TEST_PATTERN="^Test[T-Z]"
-            fi
-          else
-            if [ "${{ matrix.shard }}" == "1" ]; then
-              TEST_PATTERN="^Test[A-G]"
-            elif [ "${{ matrix.shard }}" == "2" ]; then
-              TEST_PATTERN="^Test[H-R]"
-            else
-              TEST_PATTERN="^Test[S-Z]"
-            fi
-          fi
-          echo "## Volume Server Integration Test Summary (${{ matrix.test-type }} - Shard ${{ matrix.shard }})" >> "$GITHUB_STEP_SUMMARY"
-          echo "- Suite: test/volume_server/${{ matrix.test-type }} (Pattern: ${TEST_PATTERN})" >> "$GITHUB_STEP_SUMMARY"
-          echo "- Command: go test -v -count=1 -timeout=${{ env.TEST_TIMEOUT }} ./test/volume_server/${{ matrix.test-type }}/... -run \"${TEST_PATTERN}\"" >> "$GITHUB_STEP_SUMMARY"

.gitignore

@@ -124,23 +124,3 @@ ADVANCED_IAM_DEVELOPMENT_PLAN.md
 *.log
 weed-iam
 test/kafka/kafka-client-loadtest/weed-linux-arm64
-/test/tus/filerldb2
-coverage.out
-/test/s3/remote_cache/test-primary-data
-/test/s3/remote_cache/test-remote-data
-test/s3/remote_cache/remote-server.pid
-test/s3/remote_cache/primary-server.pid
-/test/erasure_coding/filerldb2
-/test/s3/cors/test-mini-data
-/test/s3/filer_group/test-volume-data
-
-# ID and PID files
-*.id
-*.pid
-test/s3/iam/.test_env
-/test/erasure_coding/admin_dockertest/tmp
-/test/erasure_coding/admin_dockertest/task_logs
-weed_bin
-telemetry/server/telemetry-server
-.aider*
-/seaweed-volume/docs

BUCKET_POLICY_ENGINE_INTEGRATION.md

@@ -0,0 +1,242 @@
+# Bucket Policy Engine Integration - Complete
+
+## Summary
+
+Successfully integrated the `policy_engine` package to evaluate bucket policies for **all requests** (both anonymous and authenticated). This provides comprehensive AWS S3-compatible bucket policy support.
+
+## What Changed
+
+### 1. **New File: `s3api_bucket_policy_engine.go`**
+Created a wrapper around `policy_engine.PolicyEngine` to:
+- Load bucket policies from filer entries
+- Sync policies from the bucket config cache
+- Evaluate policies for any request (bucket, object, action, principal)
+- Return structured results (allowed, evaluated, error)
+
+### 2. **Modified: `s3api_server.go`**
+- Added `policyEngine *BucketPolicyEngine` field to `S3ApiServer` struct
+- Initialized the policy engine in `NewS3ApiServerWithStore()`
+- Linked `IdentityAccessManagement` back to `S3ApiServer` for policy evaluation
+
+### 3. **Modified: `auth_credentials.go`**
+- Added `s3ApiServer *S3ApiServer` field to `IdentityAccessManagement` struct
+- Added `buildPrincipalARN()` helper to convert identities to AWS ARN format
+- **Integrated bucket policy evaluation into the authentication flow:**
+  - Policies are now checked **before** IAM/identity-based permissions
+  - Explicit `Deny` in bucket policy blocks access immediately
+  - Explicit `Allow` in bucket policy grants access and **bypasses IAM checks** (enables cross-account access)
+  - If no policy exists, falls through to normal IAM checks
+  - Policy evaluation errors result in access denial (fail-close security)
+
+### 4. **Modified: `s3api_bucket_config.go`**
+- Added policy engine sync when bucket configs are loaded
+- Ensures policies are loaded into the engine for evaluation
+
+### 5. **Modified: `auth_credentials_subscribe.go`**
+- Added policy engine sync when bucket metadata changes
+- Keeps the policy engine up-to-date via event-driven updates
+
+## How It Works
+
+### Anonymous Requests
+```
+1. Request comes in (no credentials)
+2. Check ACL-based public access → if public, allow
+3. Check bucket policy for anonymous ("*") access → if allowed, allow
+4. Otherwise, deny
+```
+
+### Authenticated Requests (NEW!)
+```
+1. Request comes in (with credentials)
+2. Authenticate user → get Identity
+3. Build principal ARN (e.g., "arn:aws:iam::123456:user/bob")
+4. Check bucket policy:
+   - If DENY → reject immediately
+   - If ALLOW → grant access immediately (bypasses IAM checks)
+   - If no policy or no matching statements → continue to step 5
+5. Check IAM/identity-based permissions (only if not already allowed by bucket policy)
+6. Allow or deny based on identity permissions
+```
+
+## Policy Evaluation Flow
+
+```
+┌─────────────────────────────────────────────────────────┐
+│                   Request (GET /bucket/file)            │
+└───────────────────────────┬─────────────────────────────┘
+                            │
+                ┌───────────▼──────────┐
+                │  Authenticate User   │
+                │  (or Anonymous)      │
+                └───────────┬──────────┘
+                            │
+                ┌───────────▼──────────────────────────────┐
+                │  Build Principal ARN                     │
+                │  - Anonymous: "*"                        │
+                │  - User: "arn:aws:iam::123456:user/bob"  │
+                └───────────┬──────────────────────────────┘
+                            │
+                ┌───────────▼──────────────────────────────┐
+                │  Evaluate Bucket Policy (PolicyEngine)   │
+                │  - Action: "s3:GetObject"                │
+                │  - Resource: "arn:aws:s3:::bucket/file"  │
+                │  - Principal: (from above)               │
+                └───────────┬──────────────────────────────┘
+                            │
+              ┌─────────────┼─────────────┐
+              │             │             │
+         DENY │        ALLOW │        NO POLICY
+              │             │             │
+              ▼             ▼             ▼
+        Reject Request  Grant Access  Continue
+                                          │
+                      ┌───────────────────┘
+                      │
+         ┌────────────▼─────────────┐
+         │  IAM/Identity Check      │
+         │  (identity.canDo)        │
+         └────────────┬─────────────┘
+                      │
+            ┌─────────┴─────────┐
+            │                   │
+       ALLOW │              DENY │
+            ▼                   ▼
+     Grant Access        Reject Request
+```
+
+## Example Policies That Now Work
+
+### 1. **Public Read Access** (Anonymous)
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [{
+    "Effect": "Allow",
+    "Principal": "*",
+    "Action": "s3:GetObject",
+    "Resource": "arn:aws:s3:::mybucket/*"
+  }]
+}
+```
+- Anonymous users can read all objects
+- Authenticated users are also evaluated against this policy. If they don't match an explicit `Allow` for this action, they will fall back to their own IAM permissions
+
+### 2. **Grant Access to Specific User** (Authenticated)
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [{
+    "Effect": "Allow",
+    "Principal": {"AWS": "arn:aws:iam::123456789012:user/bob"},
+    "Action": ["s3:GetObject", "s3:PutObject"],
+    "Resource": "arn:aws:s3:::mybucket/shared/*"
+  }]
+}
+```
+- User "bob" can read/write objects in `/shared/` prefix
+- Other users cannot (unless granted by their IAM policies)
+
+### 3. **Deny Access to Specific Path** (Both)
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [{
+    "Effect": "Deny",
+    "Principal": "*",
+    "Action": "s3:*",
+    "Resource": "arn:aws:s3:::mybucket/confidential/*"
+  }]
+}
+```
+- **No one** can access `/confidential/` objects
+- Denies override all other allows (AWS policy evaluation rules)
+
+## Performance Characteristics
+
+### Policy Loading
+- **Cold start**: Policy loaded from filer → parsed → compiled → cached
+- **Warm path**: Policy retrieved from `BucketConfigCache` (already parsed)
+- **Updates**: Event-driven sync via metadata subscription (real-time)
+
+### Policy Evaluation
+- **Compiled policies**: Pre-compiled regex patterns and matchers
+- **Pattern cache**: Regex patterns cached with LRU eviction (max 1000)
+- **Fast path**: Common patterns (`*`, exact matches) optimized
+- **Case sensitivity**: Actions case-insensitive, resources case-sensitive (AWS-compatible)
+
+### Overhead
+- **Anonymous requests**: Minimal (policy already checked, now using compiled engine)
+- **Authenticated requests**: ~1-2ms added for policy evaluation (compiled patterns)
+- **No policy**: Near-zero overhead (quick indeterminate check)
+
+## Testing
+
+All tests pass:
+```bash
+✅ TestBucketPolicyValidationBasics
+✅ TestPrincipalMatchesAnonymous
+✅ TestActionToS3Action
+✅ TestResourceMatching
+✅ TestMatchesPatternRegexEscaping (security tests)
+✅ TestActionMatchingCaseInsensitive
+✅ TestResourceMatchingCaseSensitive
+✅ All policy_engine package tests (30+ tests)
+```
+
+## Security Improvements
+
+1. **Regex Metacharacter Escaping**: Patterns like `*.json` properly match only files ending in `.json` (not `filexjson`)
+2. **Case-Insensitive Actions**: S3 actions matched case-insensitively per AWS spec
+3. **Case-Sensitive Resources**: Resource paths matched case-sensitively for security
+4. **Pattern Cache Size Limit**: Prevents DoS attacks via unbounded cache growth
+5. **Principal Validation**: Supports `[]string` for manually constructed policies
+
+## AWS Compatibility
+
+The implementation follows AWS S3 bucket policy evaluation rules:
+1. **Explicit Deny** always wins (checked first)
+2. **Explicit Allow** grants access (checked second)
+3. **Default Deny** if no matching statements (implicit)
+4. Bucket policies work alongside IAM policies (both are evaluated)
+
+## Files Changed
+
+```
+Modified:
+  weed/s3api/auth_credentials.go           (+47 lines)
+  weed/s3api/auth_credentials_subscribe.go (+8 lines)
+  weed/s3api/s3api_bucket_config.go        (+8 lines)
+  weed/s3api/s3api_server.go               (+5 lines)
+
+New:
+  weed/s3api/s3api_bucket_policy_engine.go (115 lines)
+```
+
+## Migration Notes
+
+- **Backward Compatible**: Existing setups without bucket policies work unchanged
+- **No Breaking Changes**: All existing ACL and IAM-based authorization still works
+- **Additive Feature**: Bucket policies are an additional layer of authorization
+- **Performance**: Minimal impact on existing workloads
+
+## Future Enhancements
+
+Potential improvements (not implemented yet):
+- [ ] Condition support (IP address, time-based, etc.) - already in policy_engine
+- [ ] Cross-account policies (different AWS accounts)
+- [ ] Policy validation API endpoint
+- [ ] Policy simulation/testing tool
+- [ ] Metrics for policy evaluations (allow/deny counts)
+
+## Conclusion
+
+Bucket policies now work for **all requests** in SeaweedFS S3 API:
+- ✅ Anonymous requests (public access)
+- ✅ Authenticated requests (user-specific policies)
+- ✅ High performance (compiled policies, caching)
+- ✅ AWS-compatible (follows AWS evaluation rules)
+- ✅ Secure (proper escaping, case sensitivity)
+
+The integration is complete, tested, and ready for use!
+

DESIGN.md

@@ -0,0 +1,413 @@
+# SeaweedFS Task Distribution System Design
+
+## Overview
+
+This document describes the design of a distributed task management system for SeaweedFS that handles Erasure Coding (EC) and vacuum operations through a scalable admin server and worker process architecture.
+
+## System Architecture
+
+### High-Level Components
+
+```
+┌─────────────────┐    ┌──────────────────┐    ┌─────────────────┐
+│   Master        │◄──►│  Admin Server    │◄──►│   Workers       │
+│                 │    │                  │    │                 │
+│ - Volume Info   │    │ - Task Discovery │    │ - Task Exec     │
+│ - Shard Status  │    │ - Task Assign    │    │ - Progress      │
+│ - Heartbeats    │    │ - Progress Track │    │ - Error Report  │
+└─────────────────┘    └──────────────────┘    └─────────────────┘
+         │                        │                        │
+         │                        │                        │
+         ▼                        ▼                        ▼
+┌─────────────────┐    ┌──────────────────┐    ┌─────────────────┐
+│ Volume Servers  │    │ Volume Monitor   │    │ Task Execution  │
+│                 │    │                  │    │                 │
+│ - Store Volumes │    │ - Health Check   │    │ - EC Convert    │
+│ - EC Shards     │    │ - Usage Stats    │    │ - Vacuum Clean  │
+│ - Report Status │    │ - State Sync     │    │ - Status Report │
+└─────────────────┘    └──────────────────┘    └─────────────────┘
+```
+
+## 1. Admin Server Design
+
+### 1.1 Core Responsibilities
+
+- **Task Discovery**: Scan volumes to identify EC and vacuum candidates
+- **Worker Management**: Track available workers and their capabilities  
+- **Task Assignment**: Match tasks to optimal workers
+- **Progress Tracking**: Monitor in-progress tasks for capacity planning
+- **State Reconciliation**: Sync with master server for volume state updates
+
+### 1.2 Task Discovery Engine
+
+```go
+type TaskDiscoveryEngine struct {
+    masterClient   MasterClient
+    volumeScanner  VolumeScanner
+    taskDetectors  map[TaskType]TaskDetector
+    scanInterval   time.Duration
+}
+
+type VolumeCandidate struct {
+    VolumeID       uint32
+    Server         string
+    Collection     string
+    TaskType       TaskType
+    Priority       TaskPriority
+    Reason         string
+    DetectedAt     time.Time
+    Parameters     map[string]interface{}
+}
+```
+
+**EC Detection Logic**:
+- Find volumes >= 95% full and idle for > 1 hour
+- Exclude volumes already in EC format
+- Exclude volumes with ongoing operations
+- Prioritize by collection and age
+
+**Vacuum Detection Logic**:
+- Find volumes with garbage ratio > 30%
+- Exclude read-only volumes
+- Exclude volumes with recent vacuum operations
+- Prioritize by garbage percentage
+
+### 1.3 Worker Registry & Management
+
+```go
+type WorkerRegistry struct {
+    workers        map[string]*Worker
+    capabilities   map[TaskType][]*Worker
+    lastHeartbeat  map[string]time.Time
+    taskAssignment map[string]*Task
+    mutex          sync.RWMutex
+}
+
+type Worker struct {
+    ID            string
+    Address       string
+    Capabilities  []TaskType
+    MaxConcurrent int
+    CurrentLoad   int
+    Status        WorkerStatus
+    LastSeen      time.Time
+    Performance   WorkerMetrics
+}
+```
+
+### 1.4 Task Assignment Algorithm
+
+```go
+type TaskScheduler struct {
+    registry       *WorkerRegistry
+    taskQueue      *PriorityQueue
+    inProgressTasks map[string]*InProgressTask
+    volumeReservations map[uint32]*VolumeReservation
+}
+
+// Worker Selection Criteria:
+// 1. Has required capability (EC or Vacuum)
+// 2. Available capacity (CurrentLoad < MaxConcurrent)
+// 3. Best performance history for task type
+// 4. Lowest current load
+// 5. Geographically close to volume server (optional)
+```
+
+## 2. Worker Process Design
+
+### 2.1 Worker Architecture
+
+```go
+type MaintenanceWorker struct {
+    id              string
+    config          *WorkerConfig
+    adminClient     AdminClient
+    taskExecutors   map[TaskType]TaskExecutor
+    currentTasks    map[string]*RunningTask
+    registry        *TaskRegistry
+    heartbeatTicker *time.Ticker
+    requestTicker   *time.Ticker
+}
+```
+
+### 2.2 Task Execution Framework
+
+```go
+type TaskExecutor interface {
+    Execute(ctx context.Context, task *Task) error
+    EstimateTime(task *Task) time.Duration
+    ValidateResources(task *Task) error
+    GetProgress() float64
+    Cancel() error
+}
+
+type ErasureCodingExecutor struct {
+    volumeClient VolumeServerClient
+    progress     float64
+    cancelled    bool
+}
+
+type VacuumExecutor struct {
+    volumeClient VolumeServerClient
+    progress     float64
+    cancelled    bool
+}
+```
+
+### 2.3 Worker Capabilities & Registration
+
+```go
+type WorkerCapabilities struct {
+    SupportedTasks   []TaskType
+    MaxConcurrent    int
+    ResourceLimits   ResourceLimits
+    PreferredServers []string  // Affinity for specific volume servers
+}
+
+type ResourceLimits struct {
+    MaxMemoryMB      int64
+    MaxDiskSpaceMB   int64
+    MaxNetworkMbps   int64
+    MaxCPUPercent    float64
+}
+```
+
+## 3. Task Lifecycle Management
+
+### 3.1 Task States
+
+```go
+type TaskState string
+
+const (
+    TaskStatePending     TaskState = "pending"
+    TaskStateAssigned    TaskState = "assigned"
+    TaskStateInProgress  TaskState = "in_progress"
+    TaskStateCompleted   TaskState = "completed"
+    TaskStateFailed      TaskState = "failed"
+    TaskStateCancelled   TaskState = "cancelled"
+    TaskStateStuck       TaskState = "stuck"       // Taking too long
+    TaskStateDuplicate   TaskState = "duplicate"   // Detected duplicate
+)
+```
+
+### 3.2 Progress Tracking & Monitoring
+
+```go
+type InProgressTask struct {
+    Task           *Task
+    WorkerID       string
+    StartedAt      time.Time
+    LastUpdate     time.Time
+    Progress       float64
+    EstimatedEnd   time.Time
+    VolumeReserved bool  // Reserved for capacity planning
+}
+
+type TaskMonitor struct {
+    inProgressTasks map[string]*InProgressTask
+    timeoutChecker  *time.Ticker
+    stuckDetector   *time.Ticker
+    duplicateChecker *time.Ticker
+}
+```
+
+## 4. Volume Capacity Reconciliation
+
+### 4.1 Volume State Tracking
+
+```go
+type VolumeStateManager struct {
+    masterClient      MasterClient
+    inProgressTasks   map[uint32]*InProgressTask  // VolumeID -> Task
+    committedChanges  map[uint32]*VolumeChange    // Changes not yet in master
+    reconcileInterval time.Duration
+}
+
+type VolumeChange struct {
+    VolumeID     uint32
+    ChangeType   ChangeType  // "ec_encoding", "vacuum_completed"
+    OldCapacity  int64
+    NewCapacity  int64
+    TaskID       string
+    CompletedAt  time.Time
+    ReportedToMaster bool
+}
+```
+
+### 4.2 Shard Assignment Integration
+
+When the master needs to assign shards, it must consider:
+1. **Current volume state** from its own records
+2. **In-progress capacity changes** from admin server
+3. **Committed but unreported changes** from admin server
+
+```go
+type CapacityOracle struct {
+    adminServer   AdminServerClient
+    masterState   *MasterVolumeState
+    updateFreq    time.Duration
+}
+
+func (o *CapacityOracle) GetAdjustedCapacity(volumeID uint32) int64 {
+    baseCapacity := o.masterState.GetCapacity(volumeID)
+    
+    // Adjust for in-progress tasks
+    if task := o.adminServer.GetInProgressTask(volumeID); task != nil {
+        switch task.Type {
+        case TaskTypeErasureCoding:
+            // EC reduces effective capacity
+            return baseCapacity / 2  // Simplified
+        case TaskTypeVacuum:
+            // Vacuum may increase available space
+            return baseCapacity + int64(float64(baseCapacity) * 0.3)
+        }
+    }
+    
+    // Adjust for completed but unreported changes
+    if change := o.adminServer.GetPendingChange(volumeID); change != nil {
+        return change.NewCapacity
+    }
+    
+    return baseCapacity
+}
+```
+
+## 5. Error Handling & Recovery
+
+### 5.1 Worker Failure Scenarios
+
+```go
+type FailureHandler struct {
+    taskRescheduler *TaskRescheduler
+    workerMonitor   *WorkerMonitor
+    alertManager    *AlertManager
+}
+
+// Failure Scenarios:
+// 1. Worker becomes unresponsive (heartbeat timeout)
+// 2. Task execution fails (reported by worker)
+// 3. Task gets stuck (progress timeout)
+// 4. Duplicate task detection
+// 5. Resource exhaustion
+```
+
+### 5.2 Recovery Strategies
+
+**Worker Timeout Recovery**:
+- Mark worker as inactive after 3 missed heartbeats
+- Reschedule all assigned tasks to other workers
+- Cleanup any partial state
+
+**Task Stuck Recovery**:
+- Detect tasks with no progress for > 2x estimated time
+- Cancel stuck task and mark volume for cleanup
+- Reschedule if retry count < max_retries
+
+**Duplicate Task Prevention**:
+```go
+type DuplicateDetector struct {
+    activeFingerprints map[string]bool  // VolumeID+TaskType
+    recentCompleted    *LRUCache        // Recently completed tasks
+}
+
+func (d *DuplicateDetector) IsTaskDuplicate(task *Task) bool {
+    fingerprint := fmt.Sprintf("%d-%s", task.VolumeID, task.Type)
+    return d.activeFingerprints[fingerprint] || 
+           d.recentCompleted.Contains(fingerprint)
+}
+```
+
+## 6. Simulation & Testing Framework
+
+### 6.1 Failure Simulation
+
+```go
+type TaskSimulator struct {
+    scenarios map[string]SimulationScenario
+}
+
+type SimulationScenario struct {
+    Name            string
+    WorkerCount     int
+    VolumeCount     int
+    FailurePatterns []FailurePattern
+    Duration        time.Duration
+}
+
+type FailurePattern struct {
+    Type        FailureType  // "worker_timeout", "task_stuck", "duplicate"
+    Probability float64      // 0.0 to 1.0
+    Timing      TimingSpec   // When during task execution
+    Duration    time.Duration
+}
+```
+
+### 6.2 Test Scenarios
+
+**Scenario 1: Worker Timeout During EC**
+- Start EC task on 30GB volume
+- Kill worker at 50% progress
+- Verify task reassignment
+- Verify no duplicate EC operations
+
+**Scenario 2: Stuck Vacuum Task**
+- Start vacuum on high-garbage volume
+- Simulate worker hanging at 75% progress
+- Verify timeout detection and cleanup
+- Verify volume state consistency
+
+**Scenario 3: Duplicate Task Prevention**
+- Submit same EC task from multiple sources
+- Verify only one task executes
+- Verify proper conflict resolution
+
+**Scenario 4: Master-Admin State Divergence**
+- Create in-progress EC task
+- Simulate master restart
+- Verify state reconciliation
+- Verify shard assignment accounts for in-progress work
+
+## 7. Performance & Scalability
+
+### 7.1 Metrics & Monitoring
+
+```go
+type SystemMetrics struct {
+    TasksPerSecond     float64
+    WorkerUtilization  float64
+    AverageTaskTime    time.Duration
+    FailureRate        float64
+    QueueDepth         int
+    VolumeStatesSync   bool
+}
+```
+
+### 7.2 Scalability Considerations
+
+- **Horizontal Worker Scaling**: Add workers without admin server changes
+- **Admin Server HA**: Master-slave admin servers for fault tolerance
+- **Task Partitioning**: Partition tasks by collection or datacenter
+- **Batch Operations**: Group similar tasks for efficiency
+
+## 8. Implementation Plan
+
+### Phase 1: Core Infrastructure
+1. Admin server basic framework
+2. Worker registration and heartbeat
+3. Simple task assignment
+4. Basic progress tracking
+
+### Phase 2: Advanced Features
+1. Volume state reconciliation
+2. Sophisticated worker selection
+3. Failure detection and recovery
+4. Duplicate prevention
+
+### Phase 3: Optimization & Monitoring
+1. Performance metrics
+2. Load balancing algorithms
+3. Capacity planning integration
+4. Comprehensive monitoring
+
+This design provides a robust, scalable foundation for distributed task management in SeaweedFS while maintaining consistency with the existing architecture patterns. 

Makefile

@@ -1,4 +1,4 @@
-.PHONY: test admin-generate admin-build admin-clean admin-dev admin-run admin-test admin-fmt admin-help weed-commands
+.PHONY: test admin-generate admin-build admin-clean admin-dev admin-run admin-test admin-fmt admin-help
 
 BINARY = weed
 ADMIN_DIR = weed/admin
@@ -11,9 +11,6 @@ all: install
 install: admin-generate
 	cd weed; go install
 
-weed-commands:
-	cd weed && $(MAKE) weed-db weed-sql
-
 warp_install:
 	go install github.com/minio/warp@v0.7.6
 
@@ -21,12 +18,12 @@ full_install: admin-generate
 	cd weed; go install -tags "elastic gocdk sqlite ydb tarantool tikv rclone"
 
 server: install
-	weed -v 0 server -s3 -filer -filer.maxMB=64 -volume.max=0 -master.volumeSizeLimitMB=100 -volume.preStopSeconds=1 -s3.port=8000 -s3.allowDeleteBucketNotEmpty=true -s3.config=./docker/compose/s3.json -metricsPort=9324
+	weed -v 0 server -s3 -filer -filer.maxMB=64 -volume.max=0 -master.volumeSizeLimitMB=100 -volume.preStopSeconds=1 -s3.port=8000 -s3.allowEmptyFolder=false -s3.allowDeleteBucketNotEmpty=true -s3.config=./docker/compose/s3.json -metricsPort=9324
 
 benchmark: install warp_install
 	pkill weed || true
 	pkill warp || true
-	weed server -debug=$(debug) -s3 -filer -volume.max=0 -master.volumeSizeLimitMB=100 -volume.preStopSeconds=1 -s3.port=8000 -s3.allowDeleteBucketNotEmpty=false -s3.config=./docker/compose/s3.json &
+	weed server -debug=$(debug) -s3 -filer -volume.max=0 -master.volumeSizeLimitMB=100 -volume.preStopSeconds=1 -s3.port=8000 -s3.allowEmptyFolder=false -s3.allowDeleteBucketNotEmpty=false -s3.config=./docker/compose/s3.json &
 	warp client &
 	while ! nc -z localhost 8000 ; do sleep 1 ; done
 	warp mixed --host=127.0.0.1:8000 --access-key=some_access_key1 --secret-key=some_secret_key1 --autoterm
@@ -43,7 +40,7 @@ test: admin-generate
 # Admin component targets
 admin-generate:
 	@echo "Generating admin component templates..."
-	@cd $(ADMIN_DIR) && templ generate ./view
+	@cd $(ADMIN_DIR) && $(MAKE) generate
 
 admin-build: admin-generate
 	@echo "Building admin component..."

README.md

@@ -54,9 +54,9 @@ Table of Contents
 =================
 
 * [Quick Start](#quick-start)
-    * [Quick Start with weed mini](#quick-start-with-weed-mini)
     * [Quick Start for S3 API on Docker](#quick-start-for-s3-api-on-docker)
     * [Quick Start with Single Binary](#quick-start-with-single-binary)
+    * [Quick Start SeaweedFS S3 on AWS](#quick-start-seaweedfs-s3-on-aws)
 * [Introduction](#introduction)
 * [Features](#features)
     * [Additional Features](#additional-features)
@@ -78,31 +78,6 @@ Table of Contents
 
 # Quick Start #
 
-
-## Quick Start with weed mini ##
-The easiest way to get started with SeaweedFS for development and testing:
-
-* Download the latest binary from https://github.com/seaweedfs/seaweedfs/releases and unzip a single binary file `weed` or `weed.exe`.
-
-Example:
-
-```bash
-# remove quarantine on macOS
-# xattr -d com.apple.quarantine  ./weed
-
-./weed mini -dir=/data
-```
-
-This single command starts a complete SeaweedFS setup with:
-- **Master UI**: http://localhost:9333
-- **Volume Server**: http://localhost:9340
-- **Filer UI**: http://localhost:8888
-- **S3 Endpoint**: http://localhost:8333
-- **WebDAV**: http://localhost:7333
-- **Admin UI**: http://localhost:23646
-
-Perfect for development, testing, learning SeaweedFS, and single node deployments!
-
 ## Quick Start for S3 API on Docker ##
 
 `docker run -p 8333:8333 chrislusf/seaweedfs server -s3`
@@ -110,9 +85,12 @@ Perfect for development, testing, learning SeaweedFS, and single node deployment
 ## Quick Start with Single Binary ##
 * Download the latest binary from https://github.com/seaweedfs/seaweedfs/releases and unzip a single binary file `weed` or `weed.exe`. Or run `go install github.com/seaweedfs/seaweedfs/weed@latest`.
 * `export AWS_ACCESS_KEY_ID=admin ; export AWS_SECRET_ACCESS_KEY=key` as the admin credentials to access the object store.
-* Run `weed server -dir=/some/data/dir -s3` to start one master, one volume server, one filer, and one S3 gateway. The difference with `weed mini` is that `weed mini` can auto configure based on the single host environment, while `weed server` requires manual configuration and are designed for production use.
+* Run `weed server -dir=/some/data/dir -s3` to start one master, one volume server, one filer, and one S3 gateway.
 
-Also, to increase capacity, just add more volume servers by running `weed volume -dir="/some/data/dir2" -master="<master_host>:9333" -port=8081` locally, or on a different machine, or on thousands of machines. That is it!
+Also, to increase capacity, just add more volume servers by running `weed volume -dir="/some/data/dir2" -mserver="<master_host>:9333" -port=8081` locally, or on a different machine, or on thousands of machines. That is it!
+
+## Quick Start SeaweedFS S3 on AWS ##
+* Setup fast production-ready [SeaweedFS S3 on AWS with cloudformation](https://aws.amazon.com/marketplace/pp/prodview-nzelz5gprlrjc)
 
 # Introduction #
 
@@ -121,7 +99,7 @@ SeaweedFS is a simple and highly scalable distributed file system. There are two
 1. to store billions of files!
 2. to serve the files fast!
 
-SeaweedFS started as a blob store to handle small files efficiently. 
+SeaweedFS started as an Object Store to handle small files efficiently. 
 Instead of managing all file metadata in a central master, 
 the central master only manages volumes on volume servers, 
 and these volume servers manage files and their metadata. 
@@ -133,12 +111,16 @@ It is so simple with O(1) disk reads that you are welcome to challenge the perfo
 
 SeaweedFS started by implementing [Facebook's Haystack design paper](http://www.usenix.org/event/osdi10/tech/full_papers/Beaver.pdf). 
 Also, SeaweedFS implements erasure coding with ideas from 
-[f4: Facebook’s Warm BLOB Storage System](https://www.usenix.org/system/files/conference/osdi14/osdi14-paper-muralidhar.pdf), and has a lot of similarities with [Facebook’s Tectonic Filesystem](https://www.usenix.org/system/files/fast21-pan.pdf) and [Google's Colossus File System](https://cloud.google.com/blog/products/storage-data-transfer/a-peek-behind-colossus-googles-file-system)
+[f4: Facebook’s Warm BLOB Storage System](https://www.usenix.org/system/files/conference/osdi14/osdi14-paper-muralidhar.pdf), and has a lot of similarities with [Facebook’s Tectonic Filesystem](https://www.usenix.org/system/files/fast21-pan.pdf)
 
-On top of the blob store, optional [Filer] can support directories and POSIX attributes. 
+On top of the object store, optional [Filer] can support directories and POSIX attributes. 
 Filer is a separate linearly-scalable stateless server with customizable metadata stores, 
 e.g., MySql, Postgres, Redis, Cassandra, HBase, Mongodb, Elastic Search, LevelDB, RocksDB, Sqlite, MemSql, TiDB, Etcd, CockroachDB, YDB, etc.
 
+For any distributed key value stores, the large values can be offloaded to SeaweedFS. 
+With the fast access speed and linearly scalable capacity, 
+SeaweedFS can work as a distributed [Key-Large-Value store][KeyLargeValueStore].
+
 SeaweedFS can transparently integrate with the cloud. 
 With hot data on local cluster, and warm data on the cloud with O(1) access time, 
 SeaweedFS can achieve both fast local access time and elastic cloud storage capacity.
@@ -148,13 +130,13 @@ Faster and cheaper than direct cloud storage!
 [Back to TOC](#table-of-contents)
 
 # Features #
-## Additional Blob Store Features ##
-* Support different replication levels, with rack and data center aware.
+## Additional Features ##
+* Can choose no replication or different replication levels, rack and data center aware.
 * Automatic master servers failover - no single point of failure (SPOF).
-* Automatic compression depending on file MIME type.
+* Automatic Gzip compression depending on file MIME type.
 * Automatic compaction to reclaim disk space after deletion or update.
 * [Automatic entry TTL expiration][VolumeServerTTL].
-* Flexible Capacity Expansion: Any server with some disk space can add to the total storage space.
+* Any server with some disk space can add to the total storage space.
 * Adding/Removing servers does **not** cause any data re-balancing unless triggered by admin commands.
 * Optional picture resizing.
 * Support ETag, Accept-Range, Last-Modified, etc.
@@ -162,7 +144,7 @@ Faster and cheaper than direct cloud storage!
 * Support rebalancing the writable and readonly volumes.
 * [Customizable Multiple Storage Tiers][TieredStorage]: Customizable storage disk types to balance performance and cost.
 * [Transparent cloud integration][CloudTier]: unlimited capacity via tiered cloud storage for warm data.
-* [Erasure Coding for warm storage][ErasureCoding]  Rack-Aware 10.4 erasure coding reduces storage cost and increases availability. Enterprise version can customize EC ratio.
+* [Erasure Coding for warm storage][ErasureCoding]  Rack-Aware 10.4 erasure coding reduces storage cost and increases availability.
 
 [Back to TOC](#table-of-contents)
 
@@ -208,7 +190,7 @@ Faster and cheaper than direct cloud storage!
 
 [Back to TOC](#table-of-contents)
 
-## Example: Using Seaweed Blob Store ##
+## Example: Using Seaweed Object Store ##
 
 By default, the master node runs on port 9333, and the volume nodes run on port 8080.
 Let's start one master node, and two volume nodes on port 8080 and 8081. Ideally, they should be started from different machines. We'll use localhost as an example.
@@ -224,29 +206,27 @@ SeaweedFS uses HTTP REST operations to read, write, and delete. The responses ar
 ### Start Volume Servers ###
 
 ```
-> weed volume -dir="/tmp/data1" -max=5  -master="localhost:9333" -port=8080 &
-> weed volume -dir="/tmp/data2" -max=10 -master="localhost:9333" -port=8081 &
+> weed volume -dir="/tmp/data1" -max=5  -mserver="localhost:9333" -port=8080 &
+> weed volume -dir="/tmp/data2" -max=10 -mserver="localhost:9333" -port=8081 &
 ```
 
-### Write A Blob ###
+### Write File ###
 
-A blob, also referred as a needle, a chunk, or mistakenly as a file, is just a byte array. It can have attributes, such as name, mime type, create or update time, etc. But basically it is just a byte array of a relatively small size, such as 2 MB ~ 64 MB. The size is not fixed.
-
-To upload a blob: first, send a HTTP POST, PUT, or GET request to `/dir/assign` to get an `fid` and a volume server URL:
+To upload a file: first, send a HTTP POST, PUT, or GET request to `/dir/assign` to get an `fid` and a volume server URL:
 
 ```
 > curl http://localhost:9333/dir/assign
 {"count":1,"fid":"3,01637037d6","url":"127.0.0.1:8080","publicUrl":"localhost:8080"}
 ```
 
-Second, to store the blob content, send a HTTP multi-part POST request to `url + '/' + fid` from the response:
+Second, to store the file content, send a HTTP multi-part POST request to `url + '/' + fid` from the response:
 
 ```
 > curl -F file=@/home/chris/myphoto.jpg http://127.0.0.1:8080/3,01637037d6
 {"name":"myphoto.jpg","size":43234,"eTag":"1cc0118e"}
 ```
 
-To update, send another POST request with updated blob content.
+To update, send another POST request with updated file content.
 
 For deletion, send an HTTP DELETE request to the same `url + '/' + fid` URL:
 
@@ -254,7 +234,7 @@ For deletion, send an HTTP DELETE request to the same `url + '/' + fid` URL:
 > curl -X DELETE http://127.0.0.1:8080/3,01637037d6
 ```
 
-### Save Blob Id ###
+### Save File Id ###
 
 Now, you can save the `fid`, 3,01637037d6 in this case, to a database field.
 
@@ -266,9 +246,9 @@ The file key and file cookie are both coded in hex. You can store the <volume id
 
 If stored as a string, in theory, you would need 8+1+16+8=33 bytes. A char(33) would be enough, if not more than enough, since most uses will not need 2^32 volumes.
 
-If space is really a concern, you can store the file id in the binary format. You would need one 4-byte integer for volume id, 8-byte long number for file key, and a 4-byte integer for the file cookie. So 16 bytes are more than enough.
+If space is really a concern, you can store the file id in your own format. You would need one 4-byte integer for volume id, 8-byte long number for file key, and a 4-byte integer for the file cookie. So 16 bytes are more than enough.
 
-### Read a Blob ###
+### Read File ###
 
 Here is an example of how to render the URL.
 
@@ -309,7 +289,7 @@ http://localhost:8080/3/01637037d6.jpg?height=200&width=200&mode=fill
 
 ### Rack-Aware and Data Center-Aware Replication ###
 
-SeaweedFS applies the replication strategy at a volume level. So, when you are getting a blob id, you can specify the replication strategy. For example:
+SeaweedFS applies the replication strategy at a volume level. So, when you are getting a file id, you can specify the replication strategy. For example:
 
 ```
 curl http://localhost:9333/dir/assign?replication=001
@@ -332,7 +312,7 @@ More details about replication can be found [on the wiki][Replication].
 
 You can also set the default replication strategy when starting the master server.
 
-### Allocate Blob Key on Specific Data Center ###
+### Allocate File Key on Specific Data Center ###
 
 Volume servers can be started with a specific data center name:
 
@@ -341,7 +321,7 @@ Volume servers can be started with a specific data center name:
  weed volume -dir=/tmp/2 -port=8081 -dataCenter=dc2
 ```
 
-When requesting a blob key, an optional "dataCenter" parameter can limit the assigned volume to the specific data center. For example, this specifies that the assigned volume should be limited to 'dc1':
+When requesting a file key, an optional "dataCenter" parameter can limit the assigned volume to the specific data center. For example, this specifies that the assigned volume should be limited to 'dc1':
 
 ```
  http://localhost:9333/dir/assign?dataCenter=dc1
@@ -360,15 +340,15 @@ When requesting a blob key, an optional "dataCenter" parameter can limit the ass
 
 [Back to TOC](#table-of-contents)
 
-## Blob Store Architecture ##
+## Object Store Architecture ##
 
-Usually distributed file systems split each file into chunks. A central server keeps a mapping of filenames to chunks, and also which chunks each chunk server has.
+Usually distributed file systems split each file into chunks, a central master keeps a mapping of filenames, chunk indices to chunk handles, and also which chunks each chunk server has.
 
-The main drawback is that the central server can't handle many small files efficiently, and since all read requests need to go through the central master, so it might not scale well for many concurrent users.
+The main drawback is that the central master can't handle many small files efficiently, and since all read requests need to go through the chunk master, so it might not scale well for many concurrent users.
 
-Instead of managing chunks, SeaweedFS manages data volumes in the master server. Each data volume is 32GB in size, and can hold a lot of blobs. And each storage node can have many data volumes. So the master node only needs to store the metadata about the volumes, which is a fairly small amount of data and is generally stable.
+Instead of managing chunks, SeaweedFS manages data volumes in the master server. Each data volume is 32GB in size, and can hold a lot of files. And each storage node can have many data volumes. So the master node only needs to store the metadata about the volumes, which is a fairly small amount of data and is generally stable.
 
-The actual blob metadata, which are the blob volume, offset, and size, is stored in each volume on volume servers. Since each volume server only manages metadata of blobs on its own disk, with only 16 bytes for each blob, all access can read the metadata just from memory and only needs one disk operation to actually read file data.
+The actual file metadata is stored in each volume on volume servers. Since each volume server only manages metadata of files on its own disk, with only 16 bytes for each file, all file access can read file metadata just from memory and only needs one disk operation to actually read file data.
 
 For comparison, consider that an xfs inode structure in Linux is 536 bytes.
 
@@ -382,13 +362,23 @@ On each write request, the master server also generates a file key, which is a g
 
 ### Write and Read files ###
 
-When a client sends a write request, the master server returns (volume id, file key, file cookie, volume node URL) for the blob. The client then contacts the volume node and POSTs the blob content.
+When a client sends a write request, the master server returns (volume id, file key, file cookie, volume node URL) for the file. The client then contacts the volume node and POSTs the file content.
 
-When a client needs to read a blob based on (volume id, file key, file cookie), it asks the master server by the volume id for the (volume node URL, volume node public URL), or retrieves this from a cache. Then the client can GET the content, or just render the URL on web pages and let browsers fetch the content.
+When a client needs to read a file based on (volume id, file key, file cookie), it asks the master server by the volume id for the (volume node URL, volume node public URL), or retrieves this from a cache. Then the client can GET the content, or just render the URL on web pages and let browsers fetch the content.
+
+Please see the example for details on the write-read process.
+
+### Storage Size ###
+
+In the current implementation, each volume can hold 32 gibibytes (32GiB or 8x2^32 bytes). This is because we align content to 8 bytes. We can easily increase this to 64GiB, or 128GiB, or more, by changing 2 lines of code, at the cost of some wasted padding space due to alignment.
+
+There can be 4 gibibytes (4GiB or 2^32 bytes) of volumes. So the total system size is 8 x 4GiB x 4GiB which is 128 exbibytes (128EiB or 2^67 bytes).
+
+Each individual file size is limited to the volume size.
 
 ### Saving memory ###
 
-All blob metadata stored on a volume server is readable from memory without disk access. Each file takes just a 16-byte map entry of <64bit key, 32bit offset, 32bit size>. Of course, each map entry has its own space cost for the map. But usually the disk space runs out before the memory does.
+All file meta information stored on a volume server is readable from memory without disk access. Each file takes just a 16-byte map entry of <64bit key, 32bit offset, 32bit size>. Of course, each map entry has its own space cost for the map. But usually the disk space runs out before the memory does.
 
 ### Tiered Storage to the cloud ###
 
@@ -402,12 +392,6 @@ If the hot/warm data is split as 20/80, with 20 servers, you can achieve storage
 
 [Back to TOC](#table-of-contents)
 
-## SeaweedFS Filer ##
-
-Built on top of the blob store, SeaweedFS Filer adds directory structure to create a file system. The directory sturcture is an interface that is implemented in many key-value stores or databases.
-
-The content of a file is mapped to one or many blobs, distributed to multiple volumes on multiple volume servers.
-
 ## Compared to Other File Systems ##
 
 Most other distributed file systems seem more complicated than necessary.
@@ -608,22 +592,65 @@ Percentage of the requests served within a certain time (ms)
 
 ```
 make benchmark
-warp: Benchmark data written to "warp-mixed-2025-12-05[194844]-kBpU.csv.zst"
-
+warp: Benchmark data written to "warp-mixed-2023-10-16[102354]-l70a.csv.zst"                                                                                                                                                                                               
 Mixed operations.
-Operation: DELETE, 10%, Concurrency: 20, Ran 42s.
- * Throughput: 55.13 obj/s
+Operation: DELETE, 10%, Concurrency: 20, Ran 4m59s.
+ * Throughput: 6.19 obj/s
 
-Operation: GET, 45%, Concurrency: 20, Ran 42s.
- * Throughput: 2477.45 MiB/s, 247.75 obj/s
+Operation: GET, 45%, Concurrency: 20, Ran 5m0s.
+ * Throughput: 279.85 MiB/s, 27.99 obj/s
 
-Operation: PUT, 15%, Concurrency: 20, Ran 42s.
- * Throughput: 825.85 MiB/s, 82.59 obj/s
+Operation: PUT, 15%, Concurrency: 20, Ran 5m0s.
+ * Throughput: 89.86 MiB/s, 8.99 obj/s
 
-Operation: STAT, 30%, Concurrency: 20, Ran 42s.
- * Throughput: 165.27 obj/s
+Operation: STAT, 30%, Concurrency: 20, Ran 5m0s.
+ * Throughput: 18.63 obj/s
 
-Cluster Total: 3302.88 MiB/s, 550.51 obj/s over 43s.
+Cluster Total: 369.74 MiB/s, 61.79 obj/s, 0 errors over 5m0s.
+```
+
+To see segmented request statistics, use the --analyze.v parameter.
+```
+warp analyze --analyze.v warp-mixed-2023-10-16[102354]-l70a.csv.zst
+18642 operations loaded... Done!
+Mixed operations.
+----------------------------------------
+Operation: DELETE - total: 1854, 10.0%, Concurrency: 20, Ran 5m0s, starting 2023-10-16 10:23:57.115 +0500 +05
+ * Throughput: 6.19 obj/s
+
+Requests considered: 1855:
+ * Avg: 104ms, 50%: 30ms, 90%: 207ms, 99%: 1.355s, Fastest: 1ms, Slowest: 4.613s, StdDev: 320ms
+
+----------------------------------------
+Operation: GET - total: 8388, 45.3%, Size: 10485760 bytes. Concurrency: 20, Ran 5m0s, starting 2023-10-16 10:23:57.12 +0500 +05
+ * Throughput: 279.77 MiB/s, 27.98 obj/s
+
+Requests considered: 8389:
+ * Avg: 221ms, 50%: 106ms, 90%: 492ms, 99%: 1.739s, Fastest: 8ms, Slowest: 8.633s, StdDev: 383ms
+ * TTFB: Avg: 81ms, Best: 2ms, 25th: 24ms, Median: 39ms, 75th: 65ms, 90th: 171ms, 99th: 669ms, Worst: 4.783s StdDev: 163ms
+ * First Access: Avg: 240ms, 50%: 105ms, 90%: 511ms, 99%: 2.08s, Fastest: 12ms, Slowest: 8.633s, StdDev: 480ms
+ * First Access TTFB: Avg: 88ms, Best: 2ms, 25th: 24ms, Median: 38ms, 75th: 64ms, 90th: 179ms, 99th: 919ms, Worst: 4.783s StdDev: 199ms
+ * Last Access: Avg: 219ms, 50%: 106ms, 90%: 463ms, 99%: 1.782s, Fastest: 9ms, Slowest: 8.633s, StdDev: 416ms
+ * Last Access TTFB: Avg: 81ms, Best: 2ms, 25th: 24ms, Median: 39ms, 75th: 65ms, 90th: 161ms, 99th: 657ms, Worst: 4.783s StdDev: 176ms
+
+----------------------------------------
+Operation: PUT - total: 2688, 14.5%, Size: 10485760 bytes. Concurrency: 20, Ran 5m0s, starting 2023-10-16 10:23:57.115 +0500 +05
+ * Throughput: 89.83 MiB/s, 8.98 obj/s
+
+Requests considered: 2689:
+ * Avg: 1.165s, 50%: 878ms, 90%: 2.015s, 99%: 5.74s, Fastest: 99ms, Slowest: 8.264s, StdDev: 968ms
+
+----------------------------------------
+Operation: STAT - total: 5586, 30.2%, Concurrency: 20, Ran 5m0s, starting 2023-10-16 10:23:57.113 +0500 +05
+ * Throughput: 18.63 obj/s
+
+Requests considered: 5587:
+ * Avg: 15ms, 50%: 11ms, 90%: 34ms, 99%: 80ms, Fastest: 0s, Slowest: 245ms, StdDev: 17ms
+ * First Access: Avg: 14ms, 50%: 10ms, 90%: 33ms, 99%: 69ms, Fastest: 0s, Slowest: 203ms, StdDev: 16ms
+ * Last Access: Avg: 15ms, 50%: 11ms, 90%: 34ms, 99%: 74ms, Fastest: 0s, Slowest: 203ms, StdDev: 17ms
+
+Cluster Total: 369.64 MiB/s, 61.77 obj/s, 0 errors over 5m0s.
+Total Errors:0.
 ```
 
 [Back to TOC](#table-of-contents)
@@ -654,4 +681,5 @@ The text of this page is available for modification and reuse under the terms of
 [Back to TOC](#table-of-contents)
 
 ## Stargazers over time
-[![Stargazers over time](https://starchart.cc/seaweedfs/seaweedfs.svg?variant=adaptive)](https://starchart.cc/seaweedfs/seaweedfs)
+
+[![Stargazers over time](https://starchart.cc/chrislusf/seaweedfs.svg)](https://starchart.cc/chrislusf/seaweedfs)

SQL_FEATURE_PLAN.md

@@ -0,0 +1,145 @@
+# SQL Query Engine Feature, Dev, and Test Plan
+
+This document outlines the plan for adding SQL querying support to SeaweedFS, focusing on reading and analyzing data from Message Queue (MQ) topics.
+
+## Feature Plan
+
+**1. Goal**
+
+To provide a SQL querying interface for SeaweedFS, enabling analytics on existing MQ topics. This enables:
+- Basic querying with SELECT, WHERE, aggregations on MQ topics
+- Schema discovery and metadata operations (SHOW DATABASES, SHOW TABLES, DESCRIBE)
+- In-place analytics on Parquet-stored messages without data movement
+
+**2. Key Features**
+
+*   **Schema Discovery and Metadata:**
+    *   `SHOW DATABASES` - List all MQ namespaces
+    *   `SHOW TABLES` - List all topics in a namespace  
+    *   `DESCRIBE table_name` - Show topic schema details
+    *   Automatic schema detection from existing Parquet data
+*   **Basic Query Engine:**
+    *   `SELECT` support with `WHERE`, `LIMIT`, `OFFSET`
+    *   Aggregation functions: `COUNT()`, `SUM()`, `AVG()`, `MIN()`, `MAX()`
+    *   Temporal queries with timestamp-based filtering
+*   **User Interfaces:**
+    *   New CLI command `weed sql` with interactive shell mode
+    *   Optional: Web UI for query execution and result visualization
+*   **Output Formats:**
+    *   JSON (default), CSV, Parquet for result sets
+    *   Streaming results for large queries
+    *   Pagination support for result navigation
+
+## Development Plan
+
+
+
+**3. Data Source Integration**
+
+*   **MQ Topic Connector (Primary):**
+    *   Build on existing `weed/mq/logstore/read_parquet_to_log.go`
+    *   Implement efficient Parquet scanning with predicate pushdown
+    *   Support schema evolution and backward compatibility
+    *   Handle partition-based parallelism for scalable queries
+*   **Schema Registry Integration:**
+    *   Extend `weed/mq/schema/schema.go` for SQL metadata operations
+    *   Read existing topic schemas for query planning
+    *   Handle schema evolution during query execution
+
+**4. API & CLI Integration**
+
+*   **CLI Command:**
+    *   New `weed sql` command with interactive shell mode (similar to `weed shell`)
+    *   Support for script execution and result formatting
+    *   Connection management for remote SeaweedFS clusters
+*   **gRPC API:**
+    *   Add SQL service to existing MQ broker gRPC interface
+    *   Enable efficient query execution with streaming results
+
+## Example Usage Scenarios
+
+**Scenario 1: Schema Discovery and Metadata**
+```sql
+-- List all namespaces (databases)
+SHOW DATABASES;
+
+-- List topics in a namespace
+USE my_namespace;
+SHOW TABLES;
+
+-- View topic structure and discovered schema
+DESCRIBE user_events;
+```
+
+**Scenario 2: Data Querying**
+```sql
+-- Basic filtering and projection
+SELECT user_id, event_type, timestamp 
+FROM user_events 
+WHERE timestamp > 1640995200000 
+LIMIT 100;
+
+-- Aggregation queries  
+SELECT COUNT(*) as event_count
+FROM user_events 
+WHERE timestamp >= 1640995200000;
+
+-- More aggregation examples
+SELECT MAX(timestamp), MIN(timestamp) 
+FROM user_events;
+```
+
+**Scenario 3: Analytics & Monitoring**
+```sql
+-- Basic analytics
+SELECT COUNT(*) as total_events
+FROM user_events 
+WHERE timestamp >= 1640995200000;
+
+-- Simple monitoring
+SELECT AVG(response_time) as avg_response
+FROM api_logs
+WHERE timestamp >= 1640995200000;
+
+## Architecture Overview
+
+```
+SQL Query Flow:
+                                  1. Parse SQL        2. Plan & Optimize      3. Execute Query
+┌─────────────┐    ┌──────────────┐    ┌─────────────────┐    ┌──────────────┐
+│   Client    │    │  SQL Parser  │    │  Query Planner  │    │   Execution  │
+│    (CLI)    │──→ │ PostgreSQL   │──→ │   & Optimizer   │──→ │    Engine    │
+│             │    │ (Custom)     │    │                 │    │              │
+└─────────────┘    └──────────────┘    └─────────────────┘    └──────────────┘
+                                               │                       │
+                                               │ Schema Lookup         │ Data Access
+                                               ▼                       ▼
+                    ┌─────────────────────────────────────────────────────────────┐
+                    │                    Schema Catalog                            │
+                    │  • Namespace → Database mapping                            │
+                    │  • Topic → Table mapping                                  │
+                    │  • Schema version management                              │
+                    └─────────────────────────────────────────────────────────────┘
+                                                                        ▲
+                                                                        │ Metadata
+                                                                        │
+┌─────────────────────────────────────────────────────────────────────────────┐
+│                          MQ Storage Layer                                      │
+│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐    ▲    │
+│  │   Topic A   │  │   Topic B   │  │   Topic C   │  │     ...     │    │    │
+│  │ (Parquet)   │  │ (Parquet)   │  │ (Parquet)   │  │ (Parquet)   │    │    │
+│  └─────────────┘  └─────────────┘  └─────────────┘  └─────────────┘    │    │
+└──────────────────────────────────────────────────────────────────────────│──┘
+                                                                          │
+                                                                     Data Access
+```
+
+
+## Success Metrics
+
+*   **Feature Completeness:** Support for all specified SELECT operations and metadata commands
+*   **Performance:** 
+    *   **Simple SELECT queries**: < 100ms latency for single-table queries with up to 3 WHERE predicates on ≤ 100K records
+    *   **Complex queries**: < 1s latency for queries involving aggregations (COUNT, SUM, MAX, MIN) on ≤ 1M records
+    *   **Time-range queries**: < 500ms for timestamp-based filtering on ≤ 500K records within 24-hour windows
+*   **Scalability:** Handle topics with millions of messages efficiently

SSE-C_IMPLEMENTATION.md

@@ -0,0 +1,169 @@
+# Server-Side Encryption with Customer-Provided Keys (SSE-C) Implementation
+
+This document describes the implementation of SSE-C support in SeaweedFS, addressing the feature request from [GitHub Discussion #5361](https://github.com/seaweedfs/seaweedfs/discussions/5361).
+
+## Overview
+
+SSE-C allows clients to provide their own encryption keys for server-side encryption of objects stored in SeaweedFS. The server encrypts the data using the customer-provided AES-256 key but does not store the key itself - only an MD5 hash of the key for validation purposes.
+
+## Implementation Details
+
+### Architecture
+
+The SSE-C implementation follows a transparent encryption/decryption pattern:
+
+1. **Upload (PUT/POST)**: Data is encrypted with the customer key before being stored
+2. **Download (GET/HEAD)**: Encrypted data is decrypted on-the-fly using the customer key
+3. **Metadata Storage**: Only the encryption algorithm and key MD5 are stored as metadata
+
+### Key Components
+
+#### 1. Constants and Headers (`weed/s3api/s3_constants/header.go`)
+- Added AWS-compatible SSE-C header constants
+- Support for both regular and copy-source SSE-C headers
+
+#### 2. Core SSE-C Logic (`weed/s3api/s3_sse_c.go`)
+- **SSECustomerKey**: Structure to hold customer encryption key and metadata
+- **SSECEncryptedReader**: Streaming encryption with AES-256-CTR mode
+- **SSECDecryptedReader**: Streaming decryption with IV extraction
+- **validateAndParseSSECHeaders**: Shared validation logic (DRY principle)
+- **ParseSSECHeaders**: Parse regular SSE-C headers
+- **ParseSSECCopySourceHeaders**: Parse copy-source SSE-C headers
+- Header validation and parsing functions
+- Metadata extraction and response handling
+
+#### 3. Error Handling (`weed/s3api/s3err/s3api_errors.go`)
+- New error codes for SSE-C validation failures
+- AWS-compatible error messages and HTTP status codes
+
+#### 4. S3 API Integration
+- **PUT Object Handler**: Encrypts data streams transparently
+- **GET Object Handler**: Decrypts data streams transparently
+- **HEAD Object Handler**: Validates keys and returns appropriate headers
+- **Metadata Storage**: Integrates with existing `SaveAmzMetaData` function
+
+### Encryption Scheme
+
+- **Algorithm**: AES-256-CTR (Counter mode)
+- **Key Size**: 256 bits (32 bytes)
+- **IV Generation**: Random 16-byte IV per object
+- **Storage Format**: `[IV][EncryptedData]` where IV is prepended to encrypted content
+
+### Metadata Storage
+
+SSE-C metadata is stored in the filer's extended attributes:
+```
+x-amz-server-side-encryption-customer-algorithm: "AES256"
+x-amz-server-side-encryption-customer-key-md5: "<md5-hash-of-key>"
+```
+
+## API Compatibility
+
+### Required Headers for Encryption (PUT/POST)
+```
+x-amz-server-side-encryption-customer-algorithm: AES256
+x-amz-server-side-encryption-customer-key: <base64-encoded-256-bit-key>
+x-amz-server-side-encryption-customer-key-md5: <md5-hash-of-key>
+```
+
+### Required Headers for Decryption (GET/HEAD)
+Same headers as encryption - the server validates the key MD5 matches.
+
+### Copy Operations
+Support for copy-source SSE-C headers:
+```
+x-amz-copy-source-server-side-encryption-customer-algorithm
+x-amz-copy-source-server-side-encryption-customer-key  
+x-amz-copy-source-server-side-encryption-customer-key-md5
+```
+
+## Error Handling
+
+The implementation provides AWS-compatible error responses:
+
+- **InvalidEncryptionAlgorithmError**: Non-AES256 algorithm specified
+- **InvalidArgument**: Invalid key format, size, or MD5 mismatch
+- **Missing customer key**: Object encrypted but no key provided
+- **Unnecessary customer key**: Object not encrypted but key provided
+
+## Security Considerations
+
+1. **Key Management**: Customer keys are never stored - only MD5 hashes for validation
+2. **IV Randomness**: Fresh random IV generated for each object
+3. **Transparent Security**: Volume servers never see unencrypted data
+4. **Key Validation**: Strict validation of key format, size, and MD5
+
+## Testing
+
+Comprehensive test suite covers:
+- Header validation and parsing (regular and copy-source)
+- Encryption/decryption round-trip
+- Error condition handling  
+- Metadata extraction
+- Code reuse validation (DRY principle)
+- AWS S3 compatibility
+
+Run tests with:
+```bash
+go test -v ./weed/s3api
+
+## Usage Example
+
+### Upload with SSE-C
+```bash
+# Generate a 256-bit key
+KEY=$(openssl rand -base64 32)
+KEY_MD5=$(echo -n "$KEY" | base64 -d | openssl dgst -md5 -binary | base64)
+
+# Upload object with SSE-C
+curl -X PUT "http://localhost:8333/bucket/object" \
+  -H "x-amz-server-side-encryption-customer-algorithm: AES256" \
+  -H "x-amz-server-side-encryption-customer-key: $KEY" \
+  -H "x-amz-server-side-encryption-customer-key-md5: $KEY_MD5" \
+  --data-binary @file.txt
+```
+
+### Download with SSE-C
+```bash
+# Download object with SSE-C (same key required)
+curl "http://localhost:8333/bucket/object" \
+  -H "x-amz-server-side-encryption-customer-algorithm: AES256" \
+  -H "x-amz-server-side-encryption-customer-key: $KEY" \
+  -H "x-amz-server-side-encryption-customer-key-md5: $KEY_MD5"
+```
+
+## Integration Points
+
+### Existing SeaweedFS Features
+- **Filer Metadata**: Extends existing metadata storage
+- **Volume Servers**: No changes required - store encrypted data transparently
+- **S3 API**: Integrates seamlessly with existing handlers
+- **Versioning**: Compatible with object versioning
+- **Multipart Upload**: Ready for multipart upload integration
+
+### Future Enhancements
+- **SSE-S3**: Server-managed encryption keys
+- **SSE-KMS**: External key management service integration
+- **Performance Optimization**: Hardware acceleration for encryption
+- **Compliance**: Enhanced audit logging for encrypted objects
+
+## File Changes Summary
+
+1. **`weed/s3api/s3_constants/header.go`** - Added SSE-C header constants
+2. **`weed/s3api/s3_sse_c.go`** - Core SSE-C implementation (NEW)
+3. **`weed/s3api/s3_sse_c_test.go`** - Comprehensive test suite (NEW)
+4. **`weed/s3api/s3err/s3api_errors.go`** - Added SSE-C error codes
+5. **`weed/s3api/s3api_object_handlers.go`** - GET/HEAD with SSE-C support
+6. **`weed/s3api/s3api_object_handlers_put.go`** - PUT with SSE-C support
+7. **`weed/server/filer_server_handlers_write_autochunk.go`** - Metadata storage
+
+## Compliance
+
+This implementation follows the [AWS S3 SSE-C specification](https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerSideEncryptionCustomerKeys.html) for maximum compatibility with existing S3 clients and tools.
+
+## Performance Impact
+
+- **Encryption Overhead**: Minimal CPU impact with efficient AES-CTR streaming
+- **Memory Usage**: Constant memory usage via streaming encryption/decryption
+- **Storage Overhead**: 16 bytes per object for IV storage
+- **Network**: No additional network overhead

VOLUME_SERVER_RUST_PLAN.md

@@ -1,790 +0,0 @@
-# Execution Plan: SeaweedFS Volume Server — Go to Rust Port
-
-## Scope Summary
-
-| Component | Go Source | Lines (non-test) | Description |
-|---|---|---|---|
-| CLI & startup | `weed/command/volume.go` | 476 | ~40 CLI flags, server bootstrap |
-| HTTP server + handlers | `weed/server/volume_server*.go` | 1,517 | Struct, routes, read/write/delete handlers |
-| gRPC handlers | `weed/server/volume_grpc_*.go` | 3,073 | 40 RPC method implementations |
-| Storage engine | `weed/storage/` | 15,271 | Volumes, needles, index, compaction, EC, backend |
-| Protobuf definitions | `weed/pb/volume_server.proto` | 759 | Service + message definitions |
-| Shared utilities | `weed/security/`, `weed/stats/`, `weed/util/` | ~2,000+ | JWT, TLS, metrics, helpers |
-| **Total** | | **~23,000+** | |
-
-## Rust Crate & Dependency Strategy
-
-```
-seaweed-volume/
-├── Cargo.toml
-├── build.rs                    # protobuf codegen
-├── proto/
-│   ├── volume_server.proto     # copied from Go, adapted
-│   └── remote.proto
-├── src/
-│   ├── main.rs                 # CLI entry point
-│   ├── config.rs               # CLI flags + config
-│   ├── server/
-│   │   ├── mod.rs
-│   │   ├── volume_server.rs    # VolumeServer struct + lifecycle
-│   │   ├── http_handlers.rs    # HTTP route dispatch
-│   │   ├── http_read.rs        # GET/HEAD handlers
-│   │   ├── http_write.rs       # POST/PUT handlers
-│   │   ├── http_delete.rs      # DELETE handler
-│   │   ├── http_admin.rs       # /status, /healthz, /ui
-│   │   ├── grpc_service.rs     # gRPC trait impl dispatch
-│   │   ├── grpc_vacuum.rs
-│   │   ├── grpc_copy.rs
-│   │   ├── grpc_erasure_coding.rs
-│   │   ├── grpc_tail.rs
-│   │   ├── grpc_admin.rs
-│   │   ├── grpc_read_write.rs
-│   │   ├── grpc_batch_delete.rs
-│   │   ├── grpc_scrub.rs
-│   │   ├── grpc_tier.rs
-│   │   ├── grpc_remote.rs
-│   │   ├── grpc_query.rs
-│   │   ├── grpc_state.rs
-│   │   └── grpc_client_to_master.rs  # heartbeat
-│   ├── storage/
-│   │   ├── mod.rs
-│   │   ├── store.rs            # Store (multi-disk manager)
-│   │   ├── volume.rs           # Volume struct + lifecycle
-│   │   ├── volume_read.rs
-│   │   ├── volume_write.rs
-│   │   ├── volume_compact.rs
-│   │   ├── volume_info.rs
-│   │   ├── needle/
-│   │   │   ├── mod.rs
-│   │   │   ├── needle.rs       # Needle struct + serialization
-│   │   │   ├── needle_read.rs
-│   │   │   ├── needle_write.rs
-│   │   │   ├── needle_map.rs   # in-memory NeedleMap
-│   │   │   ├── needle_value.rs
-│   │   │   └── crc.rs
-│   │   ├── super_block.rs
-│   │   ├── idx/
-│   │   │   ├── mod.rs
-│   │   │   └── idx.rs          # .idx file format read/write
-│   │   ├── needle_map_leveldb.rs
-│   │   ├── types.rs            # NeedleId, Offset, Size, DiskType
-│   │   ├── disk_location.rs    # DiskLocation per-directory
-│   │   ├── erasure_coding/
-│   │   │   ├── mod.rs
-│   │   │   ├── ec_volume.rs
-│   │   │   ├── ec_shard.rs
-│   │   │   ├── ec_encoder.rs   # Reed-Solomon encoding
-│   │   │   └── ec_decoder.rs
-│   │   └── backend/
-│   │       ├── mod.rs
-│   │       ├── disk.rs
-│   │       └── s3_backend.rs   # tiered storage to S3
-│   ├── topology/
-│   │   └── volume_layout.rs    # replication placement
-│   ├── security/
-│   │   ├── mod.rs
-│   │   ├── guard.rs            # whitelist + JWT gate
-│   │   ├── jwt.rs
-│   │   └── tls.rs
-│   ├── stats/
-│   │   ├── mod.rs
-│   │   └── metrics.rs          # Prometheus counters/gauges
-│   └── util/
-│       ├── mod.rs
-│       ├── grpc.rs
-│       ├── http.rs
-│       └── file.rs
-└── tests/
-    ├── integration/
-    │   ├── http_read_test.rs
-    │   ├── http_write_test.rs
-    │   ├── grpc_test.rs
-    │   └── storage_test.rs
-    └── unit/
-        ├── needle_test.rs
-        ├── idx_test.rs
-        ├── super_block_test.rs
-        └── ec_test.rs
-```
-
-### Key Rust dependencies
-
-| Purpose | Crate |
-|---|---|
-| Async runtime | `tokio` |
-| gRPC | `tonic` + `prost` |
-| HTTP server | `hyper` + `axum` |
-| CLI parsing | `clap` (derive) |
-| Prometheus metrics | `prometheus` |
-| JWT | `jsonwebtoken` |
-| TLS | `rustls` + `tokio-rustls` |
-| LevelDB | `rusty-leveldb` or `rocksdb` |
-| Reed-Solomon EC | `reed-solomon-erasure` |
-| Logging | `tracing` + `tracing-subscriber` |
-| Config (security.toml) | `toml` + `serde` |
-| CRC32 | `crc32fast` |
-| Memory-mapped files | `memmap2` |
-
----
-
-## Phased Execution Plan
-
-### Phase 1: Project Skeleton & Protobuf Codegen
-**Goal:** Cargo project compiles, proto codegen works, CLI parses all flags.
-
-**Steps:**
-
-1.1. Create `seaweed-volume/Cargo.toml` with all dependencies listed above.
-
-1.2. Copy `volume_server.proto` and `remote.proto` into `proto/`. Adjust package paths for Rust codegen.
-
-1.3. Create `build.rs` using `tonic-build` to compile `.proto` files into Rust types.
-
-1.4. Create `src/main.rs` with `clap` derive structs mirroring all 40 CLI flags from `weed/command/volume.go`:
-   - `--port` (default 8080)
-   - `--port.grpc` (default 0 → 10000+port)
-   - `--port.public` (default 0 → same as port)
-   - `--ip` (auto-detect)
-   - `--id` (default empty → ip:port)
-   - `--publicUrl`
-   - `--ip.bind`
-   - `--master` (default "localhost:9333")
-   - `--mserver` (deprecated compat)
-   - `--preStopSeconds` (default 10)
-   - `--idleTimeout` (default 30)
-   - `--dataCenter`
-   - `--rack`
-   - `--index` [memory|leveldb|leveldbMedium|leveldbLarge]
-   - `--disk` [hdd|ssd|<tag>]
-   - `--tags`
-   - `--dir` (default temp dir)
-   - `--dir.idx`
-   - `--max` (default "8")
-   - `--whiteList`
-   - `--minFreeSpacePercent` (default "1")
-   - `--minFreeSpace`
-   - `--images.fix.orientation` (default false)
-   - `--readMode` [local|proxy|redirect] (default "proxy")
-   - `--cpuprofile`
-   - `--memprofile`
-   - `--compactionMBps` (default 0)
-   - `--maintenanceMBps` (default 0)
-   - `--fileSizeLimitMB` (default 256)
-   - `--concurrentUploadLimitMB` (default 0)
-   - `--concurrentDownloadLimitMB` (default 0)
-   - `--pprof` (default false)
-   - `--metricsPort` (default 0)
-   - `--metricsIp`
-   - `--inflightUploadDataTimeout` (default 60s)
-   - `--inflightDownloadDataTimeout` (default 60s)
-   - `--hasSlowRead` (default true)
-   - `--readBufferSizeMB` (default 4)
-   - `--index.leveldbTimeout` (default 0)
-   - `--debug` (default false)
-   - `--debug.port` (default 6060)
-
-1.5. Implement the same flag validation logic from `startVolumeServer()`:
-   - Parse comma-separated `--dir`, `--max`, `--minFreeSpace`, `--disk`, `--tags`
-   - Replicate single-value-to-all-dirs expansion
-   - Validate count matches between dirs and limits
-   - `--mserver` backward compat
-
-1.6. **Test:** `cargo build` succeeds. `cargo run -- --help` shows all flags. Proto types generated.
-
-**Verification:** Run with `--port 8080 --dir /tmp --master localhost:9333` — should parse without error and print config.
-
----
-
-### Phase 2: Core Storage Types & On-Disk Format
-**Goal:** Read and write the SeaweedFS needle/volume binary format bit-for-bit compatible with Go.
-
-**Source files to port:**
-- `weed/storage/types/needle_types.go` → `src/storage/types.rs`
-- `weed/storage/needle/needle.go` → `src/storage/needle/needle.rs`
-- `weed/storage/needle/needle_read.go` → `src/storage/needle/needle_read.rs`
-- `weed/storage/needle/needle_write.go` (partial) → `src/storage/needle/needle_write.rs`
-- `weed/storage/needle/crc.go` → `src/storage/needle/crc.rs`
-- `weed/storage/needle/needle_value_map.go` → `src/storage/needle/needle_value.rs`
-- `weed/storage/super_block/super_block.go` → `src/storage/super_block.rs`
-- `weed/storage/idx/` → `src/storage/idx/`
-
-**Steps:**
-
-2.1. **Fundamental types** (`types.rs`):
-   - `NeedleId` (u64), `Offset` (u32 or u64 depending on version), `Size` (i32, negative = deleted)
-   - `Cookie` (u32)
-   - `DiskType` enum (HDD, SSD, Custom)
-   - Version constants (Version1=1, Version2=2, Version3=3, CurrentVersion=3)
-   - Byte serialization matching Go's `binary.BigEndian` encoding
-
-2.2. **SuperBlock** (`super_block.rs`):
-   - 8-byte header: Version(1) + ReplicaPlacement(1) + TTL(2) + CompactRevision(2) + Reserved(2)
-   - `ReplicaPlacement` struct with same/diff rack/dc counts
-   - `TTL` struct with count + unit
-   - Read/write from first 8 bytes of `.dat` file
-   - Match exact byte layout from `super_block.go`
-
-2.3. **Needle binary format** (`needle.rs`, `needle_read.rs`):
-   - Version 2/3 header: Cookie(4) + NeedleId(8) + Size(4)
-   - Body: Data, Flags, Name, Mime, PairsSize, Pairs, LastModified, TTL, Checksum, AppendAtNs, Padding
-   - CRC32 checksum (matching Go's `crc32.ChecksumIEEE`)
-   - Padding to 8-byte alignment
-   - Read path: read header → compute body length → read body → verify CRC
-
-2.4. **Idx file format** (`idx/`):
-   - Fixed 16-byte records: NeedleId(8) + Offset(4) + Size(4)
-   - Sequential append-only file
-   - Walk/iterate all entries
-   - Binary search not used (loaded into memory map)
-
-2.5. **NeedleMap (in-memory)** (`needle_map.rs`):
-   - HashMap<NeedleId, NeedleValue> where NeedleValue = {Offset, Size}
-   - Load from `.idx` file on volume mount
-   - Support Get, Set, Delete operations
-   - Track file count, deleted count, deleted byte count
-
-2.6. **Tests:**
-   - Unit test: write a needle to bytes → read it back → verify fields match
-   - Unit test: write/read SuperBlock round-trip
-   - Unit test: write/read idx entries round-trip
-   - **Cross-compat test:** Use Go volume server to create a small volume with known data. Read it from Rust and verify all needles decoded correctly. (Keep test fixture `.dat`/`.idx` files in `tests/fixtures/`)
-
----
-
-### Phase 3: Volume Struct & Lifecycle
-**Goal:** Mount, read from, write to, and unmount a volume.
-
-**Source files to port:**
-- `weed/storage/volume.go` → `src/storage/volume.rs`
-- `weed/storage/volume_read.go` → `src/storage/volume_read.rs`
-- `weed/storage/volume_write.go` → `src/storage/volume_write.rs`
-- `weed/storage/volume_loading.go`
-- `weed/storage/volume_vacuum.go` → `src/storage/volume_compact.rs`
-- `weed/storage/volume_info/volume_info.go` → `src/storage/volume_info.rs`
-- `weed/storage/volume_super_block.go`
-
-**Steps:**
-
-3.1. **Volume struct** (`volume.rs`):
-   - Fields: Id, dir, dataFile, nm (NeedleMap), SuperBlock, readOnly, lastModifiedTs, lastCompactIndexOffset, lastCompactRevision
-   - `noWriteOrDelete` / `noWriteCanDelete` / `readOnly` state flags
-   - File handles for `.dat` file (read + append)
-   - Lock strategy: `RwLock` for concurrent reads, exclusive writes
-
-3.2. **Volume loading** — exact logic from `volume_loading.go`:
-   - Open `.dat` file, read SuperBlock from first 8 bytes
-   - Load `.idx` file into NeedleMap
-   - Handle `.vif` (VolumeInfo) JSON sidecar file
-   - Set volume state based on SuperBlock + VolumeInfo
-
-3.3. **Volume read** (`volume_read.rs`) — from `volume_read.go`:
-   - `ReadNeedle(needleId, cookie)`: lookup in NeedleMap → seek in .dat → read needle bytes → verify cookie + CRC → return data
-   - Handle deleted needles (Size < 0)
-   - `ReadNeedleBlob(offset, size)`: raw blob read
-   - `ReadNeedleMeta(needleId, offset, size)`: read metadata only
-
-3.4. **Volume write** (`volume_write.rs`) — from `volume_write.go`:
-   - `WriteNeedle(needle)`: serialize needle → append to .dat → update .idx → update NeedleMap
-   - `DeleteNeedle(needleId)`: mark as deleted in NeedleMap + append tombstone to .idx
-   - File size limit check
-   - Concurrent write serialization (mutex on write path)
-
-3.5. **Volume compaction** (`volume_compact.rs`) — from `volume_vacuum.go`:
-   - `CheckCompact()`: compute garbage ratio
-   - `Compact()`: create new .dat/.idx, copy only live needles, update compact revision
-   - `CommitCompact()`: rename compacted files over originals
-   - `CleanupCompact()`: remove temp files
-   - Throttle by `compactionBytePerSecond`
-
-3.6. **Volume info** (`volume_info.rs`):
-   - Read/write `.vif` JSON sidecar
-   - VolumeInfo protobuf struct mapping
-   - Remote file references for tiered storage
-
-3.7. **Tests:**
-   - Mount a volume, write 100 needles, read them all back, verify content
-   - Delete 50 needles, verify they return "deleted"
-   - Compact, verify only 50 remain, verify content
-   - Read Go-created volume fixtures
-
----
-
-### Phase 4: Store (Multi-Volume, Multi-Disk Manager)
-**Goal:** Manage multiple volumes across multiple disk directories.
-
-**Source files to port:**
-- `weed/storage/store.go` → `src/storage/store.rs`
-- `weed/storage/disk_location.go` → `src/storage/disk_location.rs`
-- `weed/storage/store_ec.go`
-- `weed/storage/store_state.go`
-
-**Steps:**
-
-4.1. **DiskLocation** (`disk_location.rs`):
-   - Directory path, max volume count, min free space, disk type, tags
-   - Load all volumes from directory on startup
-   - Track free space, check writable
-
-4.2. **Store** (`store.rs`):
-   - Vector of `DiskLocation`s
-   - `GetVolume(volumeId)` → lookup across all locations
-   - `HasVolume(volumeId)` check
-   - `AllocateVolume(...)` — create new volume in appropriate location
-   - `DeleteVolume(...)`, `MountVolume(...)`, `UnmountVolume(...)`
-   - `DeleteCollection(collection)` — delete all volumes of a collection
-   - Collect volume status for heartbeat
-   - `SetStopping()`, `Close()`
-   - Persistent state (maintenance mode) via `store_state.go`
-
-4.3. **Store state** — `VolumeServerState` protobuf with maintenance flag, persisted to disk.
-
-4.4. **Tests:**
-   - Create store with 2 dirs, allocate volumes in each, verify load balancing
-   - Mount/unmount/delete lifecycle
-   - State persistence across restart
-
----
-
-### Phase 5: Erasure Coding
-**Goal:** Full EC shard encode/decode/read/write/rebuild.
-
-**Source files to port:**
-- `weed/storage/erasure_coding/` (3,599 lines)
-
-**Steps:**
-
-5.1. **EC volume + shard structs** — `EcVolume`, `EcShard` with file handles for `.ec00`–`.ec13` shard files + `.ecx` index + `.ecj` journal.
-
-5.2. **EC encoder** — Reed-Solomon 10+4 (configurable) encoding using `reed-solomon-erasure` crate:
-   - `VolumeEcShardsGenerate`: read .dat → split into data shards → compute parity → write .ec00-.ec13 + .ecx
-
-5.3. **EC decoder/reader** — reconstruct data from any 10 of 14 shards:
-   - `EcShardRead`: read range from a specific shard
-   - Locate needle in EC volume via .ecx index
-   - Handle cross-shard needle reads
-
-5.4. **EC shard operations:**
-   - Copy, delete, mount, unmount shards
-   - `VolumeEcShardsRebuild`: rebuild missing shards from remaining
-   - `VolumeEcShardsToVolume`: reconstruct .dat from EC shards
-   - `VolumeEcBlobDelete`: mark deleted in EC journal
-   - `VolumeEcShardsInfo`: report shard metadata
-
-5.5. **Tests:**
-   - Encode a volume → verify 14 shards created
-   - Delete 4 shards → rebuild → verify data intact
-   - Read individual needles from EC volume
-   - Cross-compat with Go-generated EC shards
-
----
-
-### Phase 6: Backend / Tiered Storage
-**Goal:** Support tiered storage to remote backends (S3, etc).
-
-**Source files to port:**
-- `weed/storage/backend/` (1,850 lines)
-
-**Steps:**
-
-6.1. **Backend trait** — abstract `BackendStorage` trait with `ReadAt`, `WriteAt`, `Truncate`, `Close`, `Name`.
-
-6.2. **Disk backend** — default local disk implementation.
-
-6.3. **S3 backend** — upload .dat to S3, read ranges via S3 range requests.
-
-6.4. **Tier move operations:**
-   - `VolumeTierMoveDatToRemote`: upload .dat to remote, optionally delete local
-   - `VolumeTierMoveDatFromRemote`: download .dat from remote
-
-6.5. **Tests:**
-   - Disk backend read/write round-trip
-   - S3 backend with mock/localstack
-
----
-
-### Phase 7: Security Layer
-**Goal:** JWT authentication, whitelist guard, TLS configuration.
-
-**Source files to port:**
-- `weed/security/guard.go` → `src/security/guard.rs`
-- `weed/security/jwt.go` → `src/security/jwt.rs`
-- `weed/security/tls.go` → `src/security/tls.rs`
-
-**Steps:**
-
-7.1. **Guard** (`guard.rs`):
-   - Whitelist IP check (exact match on `r.RemoteAddr`)
-   - Wrap handlers with whitelist enforcement
-   - `UpdateWhiteList()` for live reload
-
-7.2. **JWT** (`jwt.rs`):
-   - `SeaweedFileIdClaims` with `fid` field
-   - Sign with HMAC-SHA256
-   - Verify + decode with expiry check
-   - Separate signing keys for read vs write
-   - `GetJwt(request)` — extract from `Authorization: Bearer` header or `jwt` query param
-
-7.3. **TLS** (`tls.rs`):
-   - Load server TLS cert/key for gRPC and HTTPS
-   - Load client TLS for mutual TLS
-   - Read from `security.toml` config (same format as Go's viper config)
-
-7.4. **Tests:**
-   - JWT sign → verify round-trip
-   - JWT with wrong key → reject
-   - JWT with expired token → reject
-   - JWT fid mismatch → reject
-   - Whitelist allow/deny
-
----
-
-### Phase 8: Prometheus Metrics
-**Goal:** Export same metric names as Go for dashboard compatibility.
-
-**Source files to port:**
-- `weed/stats/metrics.go` (volume server counters/gauges/histograms)
-
-**Steps:**
-
-8.1. Define all Prometheus metrics matching Go names:
-   - `VolumeServerRequestCounter` (labels: method, status)
-   - `VolumeServerRequestHistogram` (labels: method)
-   - `VolumeServerInFlightRequestsGauge` (labels: method)
-   - `VolumeServerInFlightUploadSize`
-   - `VolumeServerInFlightDownloadSize`
-   - `VolumeServerConcurrentUploadLimit`
-   - `VolumeServerConcurrentDownloadLimit`
-   - `VolumeServerHandlerCounter` (labels: type — UploadLimitCond, DownloadLimitCond)
-   - Read/Write/Delete request counters
-
-8.2. Metrics HTTP endpoint on `--metricsPort`.
-
-8.3. Optional push-based metrics loop (`LoopPushingMetric`).
-
-8.4. **Test:** Verify metric names and labels match Go output.
-
----
-
-### Phase 9: HTTP Server & Handlers
-**Goal:** All HTTP endpoints with exact same behavior as Go.
-
-**Source files to port:**
-- `weed/server/volume_server.go` → `src/server/volume_server.rs`
-- `weed/server/volume_server_handlers.go` → `src/server/http_handlers.rs`
-- `weed/server/volume_server_handlers_read.go` → `src/server/http_read.rs`
-- `weed/server/volume_server_handlers_write.go` → `src/server/http_write.rs`
-- `weed/server/volume_server_handlers_admin.go` → `src/server/http_admin.rs`
-- `weed/server/volume_server_handlers_helper.go` (URL parsing, proxy, JSON responses)
-- `weed/server/volume_server_handlers_ui.go` → `src/server/http_admin.rs`
-
-**Steps:**
-
-9.1. **URL path parsing** — from `handlers_helper.go`:
-   - Parse `/<vid>,<fid>` and `/<vid>/<fid>` patterns
-   - Extract volume ID, file ID, filename, ext
-
-9.2. **Route dispatch** — from `privateStoreHandler` and `publicReadOnlyHandler`:
-   - `GET /` → `GetOrHeadHandler`
-   - `HEAD /` → `GetOrHeadHandler`
-   - `POST /` → `PostHandler` (whitelist gated)
-   - `PUT /` → `PostHandler` (whitelist gated)
-   - `DELETE /` → `DeleteHandler` (whitelist gated)
-   - `OPTIONS /` → CORS preflight
-   - `GET /status` → JSON status
-   - `GET /healthz` → health check
-   - `GET /ui/index.html` → HTML UI page
-   - Static resources (CSS/JS for UI)
-
-9.3. **GET/HEAD handler** (`http_read.rs`) — from `handlers_read.go` (468 lines):
-   - JWT read authorization check
-   - Lookup needle by volume ID + needle ID + cookie
-   - ETag / If-None-Match / If-Modified-Since conditional responses
-   - Content-Type from stored MIME or filename extension
-   - Content-Disposition header
-   - Content-Encoding (gzip/zstd stored data)
-   - Range request support (HTTP 206 Partial Content)
-   - JPEG orientation fix (if configured)
-   - Proxy to replica on local miss (readMode=proxy)
-   - Redirect to replica (readMode=redirect)
-   - Download tracking (in-flight size accounting)
-
-9.4. **POST/PUT handler** (`http_write.rs`) — from `handlers_write.go` (170 lines):
-   - JWT write authorization check
-   - Multipart form parsing
-   - Extract file data, filename, content type, TTL, last-modified
-   - Optional gzip/zstd compression
-   - Write needle to volume
-   - Replicate to peers (same logic as Go's `DistributedOperation`)
-   - Return JSON: {name, size, eTag, error}
-
-9.5. **DELETE handler** — already in handlers.go:
-   - JWT authorization
-   - Delete from local volume
-   - Replicate delete to peers
-   - Return JSON result
-
-9.6. **Admin handlers** (`http_admin.rs`):
-   - `/status` → JSON with volumes, version, disk status
-   - `/healthz` → 200 OK if serving
-   - `/ui/index.html` → HTML dashboard
-
-9.7. **Concurrency limiting** — from `handlers.go`:
-   - Upload concurrency limit with `sync::Condvar` + timeout
-   - Download concurrency limit with proxy fallback to replicas
-   - HTTP 429 on timeout, 499 on client cancel
-   - Replication traffic bypasses upload limits
-
-9.8. **Public port** — if configured, separate listener with read-only routes (GET/HEAD/OPTIONS only).
-
-9.9. **Request ID middleware** — generate unique request ID per request.
-
-9.10. **Tests:**
-   - Integration: start server → upload file via POST → GET it back → verify content
-   - Integration: upload → DELETE → GET returns 404
-   - Integration: conditional GET with ETag → 304
-   - Integration: range request → 206 with correct bytes
-   - Integration: exceed upload limit → 429
-   - Integration: whitelist enforcement
-   - Integration: JWT enforcement
-
----
-
-### Phase 10: gRPC Service Implementation
-**Goal:** All 40 gRPC methods with exact logic.
-
-**Source files to port:**
-- `weed/server/volume_grpc_admin.go` (380 lines)
-- `weed/server/volume_grpc_vacuum.go` (124 lines)
-- `weed/server/volume_grpc_copy.go` (636 lines)
-- `weed/server/volume_grpc_copy_incremental.go` (66 lines)
-- `weed/server/volume_grpc_read_write.go` (74 lines)
-- `weed/server/volume_grpc_batch_delete.go` (124 lines)
-- `weed/server/volume_grpc_tail.go` (140 lines)
-- `weed/server/volume_grpc_erasure_coding.go` (619 lines)
-- `weed/server/volume_grpc_scrub.go` (121 lines)
-- `weed/server/volume_grpc_tier_upload.go` (98 lines)
-- `weed/server/volume_grpc_tier_download.go` (85 lines)
-- `weed/server/volume_grpc_remote.go` (95 lines)
-- `weed/server/volume_grpc_query.go` (69 lines)
-- `weed/server/volume_grpc_state.go` (26 lines)
-- `weed/server/volume_grpc_read_all.go` (35 lines)
-- `weed/server/volume_grpc_client_to_master.go` (325 lines)
-
-**Steps (grouped by functional area):**
-
-10.1. **Implement `tonic::Service` for `VolumeServer`** — the generated trait from proto.
-
-10.2. **Admin RPCs** (`grpc_admin.rs`):
-   - `AllocateVolume` — create volume on appropriate disk location
-   - `VolumeMount` / `VolumeUnmount` / `VolumeDelete`
-   - `VolumeMarkReadonly` / `VolumeMarkWritable`
-   - `VolumeConfigure` — change replication
-   - `VolumeStatus` — return read-only, size, file counts
-   - `VolumeServerStatus` — disk statuses, memory, version, DC, rack
-   - `VolumeServerLeave` — deregister from master
-   - `DeleteCollection`
-   - `VolumeNeedleStatus` — get needle metadata by ID
-   - `Ping` — latency measurement
-   - `GetState` / `SetState` — maintenance mode
-
-10.3. **Vacuum RPCs** (`grpc_vacuum.rs`):
-   - `VacuumVolumeCheck` — return garbage ratio
-   - `VacuumVolumeCompact` — stream progress (streaming response)
-   - `VacuumVolumeCommit` — finalize compaction
-   - `VacuumVolumeCleanup` — remove temp files
-
-10.4. **Copy RPCs** (`grpc_copy.rs`):
-   - `VolumeCopy` — stream .dat/.idx from source to create local copy
-   - `VolumeSyncStatus` — return sync metadata
-   - `VolumeIncrementalCopy` — stream .dat delta since timestamp (streaming)
-   - `CopyFile` — generic file copy by extension (streaming)
-   - `ReceiveFile` — receive streamed file (client streaming)
-   - `ReadVolumeFileStatus` — return file timestamps and sizes
-
-10.5. **Read/Write RPCs** (`grpc_read_write.rs`):
-   - `ReadNeedleBlob` — raw needle blob read
-   - `ReadNeedleMeta` — needle metadata
-   - `WriteNeedleBlob` — raw needle blob write
-   - `ReadAllNeedles` — stream all needles from volume(s) (streaming)
-
-10.6. **Batch delete** (`grpc_batch_delete.rs`):
-   - `BatchDelete` — delete multiple file IDs, return per-ID results
-
-10.7. **Tail RPCs** (`grpc_tail.rs`):
-   - `VolumeTailSender` — stream new needles since timestamp (streaming)
-   - `VolumeTailReceiver` — connect to another volume server and tail its changes
-
-10.8. **Erasure coding RPCs** (`grpc_erasure_coding.rs`):
-   - `VolumeEcShardsGenerate` — generate EC shards from volume
-   - `VolumeEcShardsRebuild` — rebuild missing shards
-   - `VolumeEcShardsCopy` — copy shards from another server
-   - `VolumeEcShardsDelete` — delete EC shards
-   - `VolumeEcShardsMount` / `VolumeEcShardsUnmount`
-   - `VolumeEcShardRead` — read from EC shard (streaming)
-   - `VolumeEcBlobDelete` — mark blob deleted in EC volume
-   - `VolumeEcShardsToVolume` — reconstruct volume from EC shards
-   - `VolumeEcShardsInfo` — return shard metadata
-
-10.9. **Scrub RPCs** (`grpc_scrub.rs`):
-   - `ScrubVolume` — integrity check volumes (INDEX / FULL / LOCAL modes)
-   - `ScrubEcVolume` — integrity check EC volumes
-
-10.10. **Tier RPCs** (`grpc_tier.rs`):
-   - `VolumeTierMoveDatToRemote` — upload to remote backend (streaming progress)
-   - `VolumeTierMoveDatFromRemote` — download from remote (streaming progress)
-
-10.11. **Remote storage** (`grpc_remote.rs`):
-   - `FetchAndWriteNeedle` — fetch from remote storage, write locally, replicate
-
-10.12. **Query** (`grpc_query.rs`):
-   - `Query` — experimental CSV/JSON/Parquet select on stored data (streaming)
-
-10.13. **Master heartbeat** (`grpc_client_to_master.rs`):
-   - `heartbeat()` background task — periodic gRPC stream to master
-   - Send: volume info, EC shard info, disk stats, has-no-space flags, deleted volumes
-   - Receive: volume size limit, leader address, metrics config
-   - Reconnect on failure with backoff
-   - `StopHeartbeat()` for graceful shutdown
-
-10.14. **Tests:**
-   - Integration test per RPC: call via tonic client → verify response
-   - Streaming RPCs: verify all chunks received
-   - Error cases: invalid volume ID, non-existent volume, etc.
-   - Heartbeat: mock master gRPC server, verify registration
-
----
-
-### Phase 11: Startup, Lifecycle & Graceful Shutdown
-**Goal:** Full server startup matching Go's `runVolume()` and `startVolumeServer()`.
-
-**Steps:**
-
-11.1. **Startup sequence** (match `volume.go` exactly):
-   1. Load security configuration from `security.toml`
-   2. Start metrics server on metrics port
-   3. Parse folder/max/minFreeSpace/diskType/tags
-   4. Validate all directory writable
-   5. Resolve IP, bind IP, public URL, gRPC port
-   6. Create `VolumeServer` struct
-   7. Check with master (initial handshake)
-   8. Create `Store` (loads all existing volumes from disk)
-   9. Create security `Guard`
-   10. Register HTTP routes on admin mux
-   11. Optionally register public mux
-   12. Start gRPC server on gRPC port
-   13. Start public HTTP server (if separated)
-   14. Start cluster HTTP server (with optional TLS)
-   15. Start heartbeat background task
-   16. Start metrics push loop
-   17. Register SIGHUP handler for config reload + new volume loading
-
-11.2. **Graceful shutdown** (match Go exactly):
-   1. On SIGINT/SIGTERM:
-   2. Stop heartbeat (notify master we're leaving)
-   3. Wait `preStopSeconds`
-   4. Stop public HTTP server
-   5. Stop cluster HTTP server
-   6. Graceful stop gRPC server
-   7. `volumeServer.Shutdown()` → `store.Close()` (flush all volumes)
-
-11.3. **Reload** (SIGHUP):
-   - Reload security config
-   - Update whitelist
-   - Load newly appeared volumes from disk
-
-11.4. **Tests:**
-   - Start server → send SIGTERM → verify clean shutdown
-   - Start server → SIGHUP → verify config reloaded
-
----
-
-### Phase 12: Integration & Cross-Compatibility Testing
-**Goal:** Rust volume server is a drop-in replacement for Go volume server.
-
-**Steps:**
-
-12.1. **Binary compatibility tests:**
-   - Create volumes with Go volume server
-   - Start Rust volume server on same data directory
-   - Read all data → verify identical
-   - Write new data with Rust → read with Go → verify
-
-12.2. **API compatibility tests:**
-   - Run same HTTP requests against both Go and Rust servers
-   - Compare response bodies, headers, status codes
-   - Test all gRPC RPCs against both
-
-12.3. **Master interop test:**
-   - Start Go master server
-   - Register Rust volume server
-   - Verify heartbeat works
-   - Verify volume assignment works
-   - Upload via filer → stored on Rust volume server → read back
-
-12.4. **Performance benchmarks:**
-   - Throughput: sequential writes, sequential reads
-   - Latency: p50/p99 for read/write
-   - Concurrency: parallel reads/writes
-   - Compare Rust vs Go numbers
-
-12.5. **Edge cases:**
-   - Volume at max size
-   - Disk full handling
-   - Corrupt .dat file recovery
-   - Network partition during replication
-   - EC shard loss + rebuild
-
----
-
-## Execution Order & Dependencies
-
-```
-Phase 1  (Skeleton + CLI)        ← no deps, start here
-   ↓
-Phase 2  (Storage types)         ← needs Phase 1 (types used everywhere)
-   ↓
-Phase 3  (Volume struct)         ← needs Phase 2
-   ↓
-Phase 4  (Store manager)         ← needs Phase 3
-   ↓
-Phase 7  (Security)              ← independent, can parallel with 3-4
-Phase 8  (Metrics)               ← independent, can parallel with 3-4
-   ↓
-Phase 9  (HTTP server)           ← needs Phase 4 + 7 + 8
-Phase 10 (gRPC server)           ← needs Phase 4 + 7 + 8
-   ↓
-Phase 5  (Erasure coding)        ← needs Phase 4, wire into Phase 10
-Phase 6  (Tiered storage)        ← needs Phase 4, wire into Phase 10
-   ↓
-Phase 11 (Startup + shutdown)    ← needs Phase 9 + 10
-   ↓
-Phase 12 (Integration tests)     ← needs all above
-```
-
-## Estimated Scope
-
-| Phase | Estimated Rust Lines | Complexity |
-|---|---|---|
-| 1. Skeleton + CLI | ~400 | Low |
-| 2. Storage types | ~2,000 | High (binary compat critical) |
-| 3. Volume struct | ~2,500 | High |
-| 4. Store manager | ~1,000 | Medium |
-| 5. Erasure coding | ~3,000 | High |
-| 6. Tiered storage | ~1,500 | Medium |
-| 7. Security | ~500 | Medium |
-| 8. Metrics | ~300 | Low |
-| 9. HTTP server | ~2,000 | High |
-| 10. gRPC server | ~3,500 | High |
-| 11. Startup/shutdown | ~500 | Medium |
-| 12. Integration tests | ~2,000 | Medium |
-| **Total** | **~19,000** | |
-
-## Critical Invariants to Preserve
-
-1. **Binary format compatibility** — Rust must read/write `.dat`, `.idx`, `.vif`, `.ecX` files identically to Go. A single byte off = data loss.
-2. **gRPC wire compatibility** — Same proto, same field semantics. Go master must talk to Rust volume server seamlessly.
-3. **HTTP API compatibility** — Same URL patterns, same JSON response shapes, same headers, same status codes.
-4. **Replication protocol** — Write replication between Go and Rust volume servers must work bidirectionally.
-5. **Heartbeat protocol** — Rust volume server must register with Go master and maintain heartbeat.
-6. **CRC32 algorithm** — Must use IEEE polynomial (same as Go's `crc32.ChecksumIEEE`).
-7. **JWT compatibility** — Tokens signed by Go filer/master must be verifiable by Rust volume server and vice versa.

cmd/weed-db/main.go

@@ -1,7 +0,0 @@
-package main
-
-import "os"
-
-func main() {
-	os.Exit(Run(os.Args[1:]))
-}

cmd/weed-sql/main.go

@@ -1,7 +0,0 @@
-package main
-
-import "os"
-
-func main() {
-	os.Exit(Run(os.Args[1:]))
-}

docker/Dockerfile.foundationdb_large

@@ -1,4 +1,4 @@
-FROM golang:1.25 AS builder
+FROM golang:1.24 AS builder
 
 RUN apt-get update && \
     apt-get install -y build-essential wget ca-certificates && \
@@ -77,7 +77,6 @@ LABEL author="Chris Lu"
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
     ca-certificates \
-    curl \
     fuse \
     wget && \
     rm -rf /var/lib/apt/lists/*

docker/Dockerfile.go_build

@@ -1,4 +1,4 @@
-FROM golang:1.25-alpine AS builder
+FROM golang:1.24-alpine as builder
 RUN apk add git g++ fuse
 RUN mkdir -p /go/src/github.com/seaweedfs/
 ARG BRANCH=${BRANCH:-master}
@@ -16,42 +16,15 @@ RUN cd /go/src/github.com/seaweedfs/seaweedfs/weed \
   && export LDFLAGS="-X github.com/seaweedfs/seaweedfs/weed/util/version.COMMIT=$(git rev-parse --short HEAD)" \
   && CGO_ENABLED=0 go install -tags "$TAGS" -ldflags "-extldflags -static ${LDFLAGS}"
 
-# Rust volume server builder. Alpine packages avoid depending on the
-# upstream rust:alpine manifest list, which no longer includes linux/386.
-FROM alpine:3.23 as rust_builder
-ARG TARGETARCH
-COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/seaweed-volume /build/seaweed-volume
-COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/weed /build/weed
-WORKDIR /build/seaweed-volume
-ARG TAGS
-RUN if [ "$TARGETARCH" = "amd64" ] || [ "$TARGETARCH" = "arm64" ]; then \
-      apk add --no-cache musl-dev openssl-dev protobuf-dev git rust cargo; \
-      if [ "$TAGS" = "5BytesOffset" ]; then \
-        cargo build --release; \
-      else \
-        cargo build --release --no-default-features; \
-      fi && \
-      cp target/release/weed-volume /weed-volume; \
-    else \
-      echo "Skipping Rust build for $TARGETARCH (unsupported)" && \
-      touch /weed-volume; \
-    fi
-
 FROM alpine AS final
 LABEL author="Chris Lu"
 COPY --from=builder /go/bin/weed /usr/bin/
-# Copy Rust volume server binary (real binary on amd64/arm64, empty placeholder on other platforms)
-COPY --from=rust_builder /weed-volume /usr/bin/weed-volume
 RUN mkdir -p /etc/seaweedfs
 COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/docker/filer.toml /etc/seaweedfs/filer.toml
 COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/docker/entrypoint.sh /entrypoint.sh
 
-# FIPS 140-3 mode is ON by default (Go 1.24+)
-# To disable: docker run -e GODEBUG=fips140=off ...
-
 # Install dependencies and create non-root user
-RUN apk upgrade --no-cache zlib && \
-    apk add --no-cache fuse curl su-exec && \
+RUN apk add --no-cache fuse su-exec && \
     addgroup -g 1000 seaweed && \
     adduser -D -u 1000 -G seaweed seaweed
 

docker/Dockerfile.local

@@ -7,8 +7,7 @@ COPY ./filer.toml /etc/seaweedfs/filer.toml
 COPY ./entrypoint.sh /entrypoint.sh
 
 # Install dependencies and create non-root user
-RUN apk upgrade --no-cache zlib && \
-    apk add --no-cache fuse curl su-exec && \
+RUN apk add --no-cache fuse curl su-exec && \
     addgroup -g 1000 seaweed && \
     adduser -D -u 1000 -G seaweed seaweed
 

docker/Dockerfile.rocksdb_dev_env

@@ -1,9 +1,9 @@
-FROM golang:1.25 AS builder
+FROM golang:1.24 AS builder
 
 RUN apt-get update
 RUN apt-get install -y build-essential libsnappy-dev zlib1g-dev libbz2-dev libgflags-dev liblz4-dev libzstd-dev
 
-ARG ROCKSDB_VERSION=v10.10.1
+ARG ROCKSDB_VERSION=v10.5.1
 ENV ROCKSDB_VERSION=${ROCKSDB_VERSION}
 
 # build RocksDB

docker/Dockerfile.rocksdb_large

@@ -1,9 +1,9 @@
-FROM golang:1.25 AS builder
+FROM golang:1.24 AS builder
 
 RUN apt-get update
 RUN apt-get install -y build-essential libsnappy-dev zlib1g-dev libbz2-dev libgflags-dev liblz4-dev libzstd-dev
 
-ARG ROCKSDB_VERSION=v10.10.1
+ARG ROCKSDB_VERSION=v10.5.1
 ENV ROCKSDB_VERSION=${ROCKSDB_VERSION}
 
 # build RocksDB
@@ -34,8 +34,7 @@ COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/docker/filer_rocksdb.
 COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/docker/entrypoint.sh /entrypoint.sh
 
 # Install dependencies and create non-root user
-RUN apk upgrade --no-cache zlib && \
-    apk add --no-cache fuse snappy gflags curl su-exec && \
+RUN apk add --no-cache fuse snappy gflags su-exec && \
     addgroup -g 1000 seaweed && \
     adduser -D -u 1000 -G seaweed seaweed
 

docker/Dockerfile.rocksdb_large_local

@@ -17,8 +17,7 @@ COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/docker/filer_rocksdb.
 COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/docker/entrypoint.sh /entrypoint.sh
 
 # Install dependencies and create non-root user
-RUN apk upgrade --no-cache zlib && \
-    apk add --no-cache fuse snappy gflags curl tmux su-exec && \
+RUN apk add --no-cache fuse snappy gflags tmux su-exec && \
     addgroup -g 1000 seaweed && \
     adduser -D -u 1000 -G seaweed seaweed
 

docker/admin_integration/docker-compose-ec-test.yml

@@ -25,7 +25,7 @@ services:
     ports:
       - "8080:8080"
       - "18080:18080"
-    command: "volume -master=master:9333 -ip=volume1 -dir=/data -max=10"
+    command: "volume -mserver=master:9333 -ip=volume1 -dir=/data -max=10"
     depends_on:
       - master
     volumes:
@@ -38,7 +38,7 @@ services:
     ports:
       - "8081:8080"
       - "18081:18080"
-    command: "volume -master=master:9333 -ip=volume2 -dir=/data -max=10"
+    command: "volume -mserver=master:9333 -ip=volume2 -dir=/data -max=10"
     depends_on:
       - master
     volumes:
@@ -51,7 +51,7 @@ services:
     ports:
       - "8082:8080"
       - "18082:18080"
-    command: "volume -master=master:9333 -ip=volume3 -dir=/data -max=10"
+    command: "volume -mserver=master:9333 -ip=volume3 -dir=/data -max=10"
     depends_on:
       - master
     volumes:
@@ -64,7 +64,7 @@ services:
     ports:
       - "8083:8080"
       - "18083:18080"
-    command: "volume -master=master:9333 -ip=volume4 -dir=/data -max=10"
+    command: "volume -mserver=master:9333 -ip=volume4 -dir=/data -max=10"
     depends_on:
       - master
     volumes:
@@ -77,7 +77,7 @@ services:
     ports:
       - "8084:8080"
       - "18084:18080"
-    command: "volume -master=master:9333 -ip=volume5 -dir=/data -max=10"
+    command: "volume -mserver=master:9333 -ip=volume5 -dir=/data -max=10"
     depends_on:
       - master
     volumes:
@@ -90,7 +90,7 @@ services:
     ports:
       - "8085:8080"
       - "18085:18080"
-    command: "volume -master=master:9333 -ip=volume6 -dir=/data -max=10"
+    command: "volume -mserver=master:9333 -ip=volume6 -dir=/data -max=10"
     depends_on:
       - master
     volumes:

docker/compose/e2e-mount.yml

@@ -13,7 +13,7 @@ services:
 
   volume:
     image: chrislusf/seaweedfs:e2e
-    command: "-v=4 volume -master=master:9333 -ip=volume -ip.bind=0.0.0.0 -preStopSeconds=1"
+    command: "-v=4 volume -mserver=master:9333 -ip=volume -ip.bind=0.0.0.0 -preStopSeconds=1"
     healthcheck:
       test: [ "CMD", "curl", "--fail", "-I", "http://localhost:8080/healthz" ]
       interval: 2s

docker/compose/local-brokers-compose.yml

@@ -36,7 +36,7 @@ services:
     ports:
       - 8080:8080
       - 18080:18080
-    command: 'volume -dataCenter=dc1 -rack=v1 -master="master0:9333,master1:9334,master2:9335" -port=8080 -ip=volume1 -publicUrl=localhost:8080 -preStopSeconds=1'
+    command: 'volume -dataCenter=dc1 -rack=v1 -mserver="master0:9333,master1:9334,master2:9335" -port=8080 -ip=volume1 -publicUrl=localhost:8080 -preStopSeconds=1'
     depends_on:
       - master0
       - master1
@@ -46,7 +46,7 @@ services:
     ports:
       - 8082:8082
       - 18082:18082
-    command: 'volume -dataCenter=dc2 -rack=v2 -master="master0:9333,master1:9334,master2:9335" -port=8082 -ip=volume2 -publicUrl=localhost:8082 -preStopSeconds=1'
+    command: 'volume -dataCenter=dc2 -rack=v2 -mserver="master0:9333,master1:9334,master2:9335" -port=8082 -ip=volume2 -publicUrl=localhost:8082 -preStopSeconds=1'
     depends_on:
       - master0
       - master1
@@ -56,7 +56,7 @@ services:
     ports:
       - 8083:8083
       - 18083:18083
-    command: 'volume -dataCenter=dc3 -rack=v3 -master="master0:9333,master1:9334,master2:9335" -port=8083 -ip=volume3 -publicUrl=localhost:8083 -preStopSeconds=1'
+    command: 'volume -dataCenter=dc3 -rack=v3 -mserver="master0:9333,master1:9334,master2:9335" -port=8083 -ip=volume3 -publicUrl=localhost:8083 -preStopSeconds=1'
     depends_on:
       - master0
       - master1

docker/compose/local-cluster-compose.yml

@@ -36,7 +36,7 @@ services:
     ports:
       - 8080:8080
       - 18080:18080
-    command: 'volume -dataCenter=dc1 -rack=v1 -master="master0:9333,master1:9334,master2:9335" -port=8080 -ip=volume1 -publicUrl=localhost:8080 -preStopSeconds=1'
+    command: 'volume -dataCenter=dc1 -rack=v1 -mserver="master0:9333,master1:9334,master2:9335" -port=8080 -ip=volume1 -publicUrl=localhost:8080 -preStopSeconds=1'
     depends_on:
       - master0
       - master1
@@ -46,7 +46,7 @@ services:
     ports:
       - 8082:8082
       - 18082:18082
-    command: 'volume -dataCenter=dc2 -rack=v2 -master="master0:9333,master1:9334,master2:9335" -port=8082 -ip=volume2 -publicUrl=localhost:8082 -preStopSeconds=1'
+    command: 'volume -dataCenter=dc2 -rack=v2 -mserver="master0:9333,master1:9334,master2:9335" -port=8082 -ip=volume2 -publicUrl=localhost:8082 -preStopSeconds=1'
     depends_on:
       - master0
       - master1
@@ -56,7 +56,7 @@ services:
     ports:
       - 8083:8083
       - 18083:18083
-    command: 'volume -dataCenter=dc3 -rack=v3 -master="master0:9333,master1:9334,master2:9335" -port=8083 -ip=volume3 -publicUrl=localhost:8083 -preStopSeconds=1'
+    command: 'volume -dataCenter=dc3 -rack=v3 -mserver="master0:9333,master1:9334,master2:9335" -port=8083 -ip=volume3 -publicUrl=localhost:8083 -preStopSeconds=1'
     depends_on:
       - master0
       - master1

docker/compose/local-dev-compose.yml

@@ -16,7 +16,7 @@ services:
     ports:
       - 8080:8080
       - 18080:18080
-    command: "-v=1 volume -master=master:9333 -port=8080 -ip=volume -preStopSeconds=1 -max=10000"
+    command: "-v=1 volume -mserver=master:9333 -port=8080 -ip=volume -preStopSeconds=1 -max=10000"
     depends_on:
       - master
     volumes:

docker/compose/local-hashicorp-raft-compose.yml

@@ -42,7 +42,7 @@ services:
     ports:
       - 8080:8080
       - 18080:18080
-    command: 'volume -dataCenter=dc1 -rack=v1 -master="master0:9333,master1:9334,master2:9335" -port=8080 -ip=volume1 -publicUrl=localhost:8080 -preStopSeconds=1'
+    command: 'volume -dataCenter=dc1 -rack=v1 -mserver="master0:9333,master1:9334,master2:9335" -port=8080 -ip=volume1 -publicUrl=localhost:8080 -preStopSeconds=1'
     depends_on:
       - master0
       - master1
@@ -51,7 +51,7 @@ services:
     ports:
       - 8082:8082
       - 18082:18082
-    command: 'volume -dataCenter=dc2 -rack=v2 -master="master0:9333,master1:9334,master2:9335" -port=8082 -ip=volume2 -publicUrl=localhost:8082 -preStopSeconds=1'
+    command: 'volume -dataCenter=dc2 -rack=v2 -mserver="master0:9333,master1:9334,master2:9335" -port=8082 -ip=volume2 -publicUrl=localhost:8082 -preStopSeconds=1'
     depends_on:
       - master0
       - master1
@@ -60,7 +60,7 @@ services:
     ports:
       - 8083:8083
       - 18083:18083
-    command: 'volume -dataCenter=dc3 -rack=v3 -master="master0:9333,master1:9334,master2:9335" -port=8083 -ip=volume3 -publicUrl=localhost:8083 -preStopSeconds=1'
+    command: 'volume -dataCenter=dc3 -rack=v3 -mserver="master0:9333,master1:9334,master2:9335" -port=8083 -ip=volume3 -publicUrl=localhost:8083 -preStopSeconds=1'
     depends_on:
       - master0
       - master1

docker/compose/local-k8s-compose.yml

@@ -12,7 +12,7 @@ services:
     ports:
       - 8080:8080
       - 18080:18080
-    command: "volume -master=master:9333 -port=8080 -ip=volume"
+    command: "volume -mserver=master:9333 -port=8080 -ip=volume"
     depends_on:
       - master
   mysql:

docker/compose/local-minio-gateway-compose.yml

@@ -12,7 +12,7 @@ services:
     ports:
       - 8080:8080
       - 18080:18080
-    command: "volume -master=master:9333 -port=8080 -ip=volume -max=0 -preStopSeconds=1"
+    command: "volume -mserver=master:9333 -port=8080 -ip=volume -max=0 -preStopSeconds=1"
     depends_on:
       - master
   s3:

docker/compose/local-mount-compose.yml

@@ -12,7 +12,7 @@ services:
     ports:
       - 7455:8080
       - 9325:9325
-    command: 'volume -master="master:9333" -port=8080 -metricsPort=9325 -preStopSeconds=1 -publicUrl=localhost:7455'
+    command: 'volume -mserver="master:9333" -port=8080 -metricsPort=9325 -preStopSeconds=1 -publicUrl=localhost:7455'
     depends_on:
       - master
   filer:

docker/compose/local-mount-profile-compose.yml

@@ -14,7 +14,7 @@ services:
       - 9325:9325
     volumes:
       - /Volumes/mobile_disk/99:/data
-    command: 'volume -master="master:9333" -port=8080 -metricsPort=9325 -preStopSeconds=1 -publicUrl=localhost:7455'
+    command: 'volume -mserver="master:9333" -port=8080 -metricsPort=9325 -preStopSeconds=1 -publicUrl=localhost:7455'
     depends_on:
       - master
   filer:

docker/compose/local-nextcloud-compose.yml

@@ -12,7 +12,7 @@ services:
     ports:
       - 8080:8080
       - 18080:18080
-    command: "volume -master=master:9333 -port=8080 -ip=volume"
+    command: "volume -mserver=master:9333 -port=8080 -ip=volume"
     depends_on:
       - master
   s3:

docker/compose/local-registry-compose.yml

@@ -12,7 +12,7 @@ services:
     ports:
       - 8080:8080
       - 18080:18080
-    command: "volume -master=master:9333 -port=8080 -ip=volume -max=0 -preStopSeconds=1"
+    command: "volume -mserver=master:9333 -port=8080 -ip=volume -max=0 -preStopSeconds=1"
     depends_on:
       - master
   s3:

docker/compose/local-replicate-compose.yml

@@ -12,7 +12,7 @@ services:
     ports:
       - 8080:8080
       - 18080:18080
-    command: "volume -master=master:9333 -port=8080 -ip=volume -preStopSeconds=1"
+    command: "volume -mserver=master:9333 -port=8080 -ip=volume -preStopSeconds=1"
     depends_on:
       - master
   filer:

docker/compose/local-s3tests-compose.yml

@@ -15,7 +15,7 @@ services:
     ports:
       - 8080:8080
       - 18080:18080
-    command: "volume -master=master:9333 -port=8080 -ip=volume -preStopSeconds=1"
+    command: "volume -mserver=master:9333 -port=8080 -ip=volume -preStopSeconds=1"
     depends_on:
       - master
   s3:
@@ -24,7 +24,7 @@ services:
       - 8888:8888
       - 18888:18888
       - 8000:8000
-    command: 'filer -master="master:9333" -s3 -s3.config=/etc/seaweedfs/s3.json -s3.port=8000 -s3.allowDeleteBucketNotEmpty=false'
+    command: 'filer -master="master:9333" -s3 -s3.config=/etc/seaweedfs/s3.json -s3.port=8000 -s3.allowEmptyFolder=false -s3.allowDeleteBucketNotEmpty=false'
     volumes:
       - ./s3.json:/etc/seaweedfs/s3.json
     depends_on:

docker/compose/master-cloud.toml

@@ -7,7 +7,6 @@
 
 [master.maintenance]
 # periodically run these scripts are the same as running them from 'weed shell'
-# Scripts are skipped while an admin server is connected.
 scripts = """
   lock
   ec.encode -fullPercent=95 -quietFor=1h

docker/compose/swarm-etcd.yml

@@ -71,7 +71,7 @@ services:
       - net
     command:
       - 'volume'
-      - '-master=master:9333'
+      - '-mserver=master:9333'
       - '-port=8080'
     deploy:
       mode: global

docker/compose/test-etcd-filer.yml

@@ -17,7 +17,7 @@ services:
     ports:
       - 8080:8080
       - 18080:18080
-    command: "volume -master=master:9333 -port=8080 -ip=volume -max=0 -preStopSeconds=1"
+    command: "volume -mserver=master:9333 -port=8080 -ip=volume -max=0 -preStopSeconds=1"
     depends_on:
       - master
   s3:

docker/compose/test-git-on-mount.sh

@@ -1,260 +0,0 @@
-#!/usr/bin/env bash
-#
-# Integration test: git clone & pull on a SeaweedFS FUSE mount.
-#
-# Verifies that the mount correctly supports git's file operations by:
-#   1. Creating a bare repo on the mount (acts as a remote)
-#   2. Cloning it, making commits, and pushing back to the mount
-#   3. Cloning from the mount into a working directory also on the mount
-#   4. Pushing additional commits to the bare repo
-#   5. Checking out an older revision in the on-mount clone
-#   6. Running git pull to fast-forward with real changes
-#   7. Verifying file content integrity at each step
-#
-# Usage:
-#   bash test-git-on-mount.sh /path/to/mount/point
-#
-# The mount must already be running. All test artifacts are created under
-# <mount>/git-test-<pid> and cleaned up on exit (unless TEST_KEEP=1).
-#
-set -euo pipefail
-
-MOUNT_DIR="${1:?Usage: $0 <mount-dir>}"
-TEST_DIR="$MOUNT_DIR/git-test-$$"
-LOCAL_DIR=$(mktemp -d)
-PASS=0
-FAIL=0
-
-cleanup() {
-    if [[ "${TEST_KEEP:-}" == "1" ]]; then
-        echo "TEST_KEEP=1 — leaving artifacts:"
-        echo "  mount: $TEST_DIR"
-        echo "  local: $LOCAL_DIR"
-    else
-        rm -rf "$TEST_DIR" 2>/dev/null || true
-        rm -rf "$LOCAL_DIR" 2>/dev/null || true
-    fi
-}
-trap cleanup EXIT
-
-# --- helpers ---------------------------------------------------------------
-
-pass() { PASS=$((PASS + 1)); echo "  PASS: $1"; }
-fail() { FAIL=$((FAIL + 1)); echo "  FAIL: $1"; }
-
-assert_file_contains() {
-    local file=$1 expected=$2 label=$3
-    if [[ -f "$file" ]] && grep -qF "$expected" "$file" 2>/dev/null; then
-        pass "$label"
-    else
-        fail "$label (expected '$expected' in $file)"
-    fi
-}
-
-assert_file_exists() {
-    local file=$1 label=$2
-    if [[ -f "$file" ]]; then
-        pass "$label"
-    else
-        fail "$label ($file not found)"
-    fi
-}
-
-assert_file_not_exists() {
-    local file=$1 label=$2
-    if [[ ! -f "$file" ]]; then
-        pass "$label"
-    else
-        fail "$label ($file should not exist)"
-    fi
-}
-
-assert_eq() {
-    local actual=$1 expected=$2 label=$3
-    if [[ "$actual" == "$expected" ]]; then
-        pass "$label"
-    else
-        fail "$label (expected '$expected', got '$actual')"
-    fi
-}
-
-# --- setup -----------------------------------------------------------------
-
-echo "========================================"
-echo "  Git-on-mount integration test"
-echo "========================================"
-echo "Mount:  $MOUNT_DIR"
-echo "Test:   $TEST_DIR"
-echo "Local:  $LOCAL_DIR"
-echo ""
-
-if ! mountpoint -q "$MOUNT_DIR" 2>/dev/null && [[ ! -d "$MOUNT_DIR" ]]; then
-    echo "ERROR: $MOUNT_DIR is not a valid directory"
-    exit 1
-fi
-
-mkdir -p "$TEST_DIR"
-
-# --- Phase 1: Create bare repo on mount -----------------------------------
-
-echo "--- Phase 1: Create bare repo on mount ---"
-
-BARE_REPO="$TEST_DIR/repo.git"
-git init --bare "$BARE_REPO" >/dev/null 2>&1
-pass "bare repo created on mount"
-
-# --- Phase 2: Clone locally, make initial commits, push -------------------
-
-echo "--- Phase 2: Clone locally, make initial commits, push ---"
-
-LOCAL_CLONE="$LOCAL_DIR/clone1"
-git clone "$BARE_REPO" "$LOCAL_CLONE" >/dev/null 2>&1
-cd "$LOCAL_CLONE"
-git config user.email "test@seaweedfs.test"
-git config user.name "SeaweedFS Test"
-
-# Commit 1: initial files
-echo "hello world" > README.md
-mkdir -p src
-echo 'package main; import "fmt"; func main() { fmt.Println("v1") }' > src/main.go
-git add -A && git commit -m "initial commit" >/dev/null 2>&1
-COMMIT1=$(git rev-parse HEAD)
-
-# Commit 2: add more files
-mkdir -p data
-for i in $(seq 1 20); do
-    printf "file-%03d: %s\n" "$i" "$(head -c 64 /dev/urandom | base64)" > "data/file-$(printf '%03d' $i).txt"
-done
-git add -A && git commit -m "add data files" >/dev/null 2>&1
-COMMIT2=$(git rev-parse HEAD)
-
-# Commit 3: modify and add
-echo 'package main; import "fmt"; func main() { fmt.Println("v2") }' > src/main.go
-echo "# Updated readme" >> README.md
-mkdir -p docs
-echo "documentation content" > docs/guide.md
-git add -A && git commit -m "update src and add docs" >/dev/null 2>&1
-COMMIT3=$(git rev-parse HEAD)
-
-git push origin master >/dev/null 2>&1 || git push origin main >/dev/null 2>&1
-BRANCH=$(git rev-parse --abbrev-ref HEAD)
-pass "3 commits pushed to mount bare repo (branch=$BRANCH)"
-
-# --- Phase 3: Clone from mount bare repo to mount working dir -------------
-
-echo "--- Phase 3: Clone from mount bare repo to on-mount working dir ---"
-
-MOUNT_CLONE="$TEST_DIR/working"
-git clone "$BARE_REPO" "$MOUNT_CLONE" >/dev/null 2>&1
-
-# Verify clone integrity
-assert_file_exists "$MOUNT_CLONE/README.md" "README.md exists after clone"
-assert_file_contains "$MOUNT_CLONE/README.md" "# Updated readme" "README.md has latest content"
-assert_file_contains "$MOUNT_CLONE/src/main.go" 'v2' "src/main.go has v2"
-assert_file_exists "$MOUNT_CLONE/docs/guide.md" "docs/guide.md exists"
-assert_file_exists "$MOUNT_CLONE/data/file-001.txt" "data files exist"
-assert_file_exists "$MOUNT_CLONE/data/file-020.txt" "data/file-020.txt exists"
-
-CLONE_HEAD=$(cd "$MOUNT_CLONE" && git rev-parse HEAD)
-assert_eq "$CLONE_HEAD" "$COMMIT3" "on-mount clone HEAD matches commit 3"
-
-# Count files
-FILE_COUNT=$(find "$MOUNT_CLONE/data" -name '*.txt' | wc -l | tr -d ' ')
-assert_eq "$FILE_COUNT" "20" "data/ has 20 files"
-
-# --- Phase 4: Push more commits from local clone --------------------------
-
-echo "--- Phase 4: Push more commits from local clone ---"
-
-cd "$LOCAL_CLONE"
-
-# Commit 4: larger changes
-for i in $(seq 21 50); do
-    printf "file-%03d: %s\n" "$i" "$(head -c 128 /dev/urandom | base64)" > "data/file-$(printf '%03d' $i).txt"
-done
-echo 'package main; import "fmt"; func main() { fmt.Println("v3") }' > src/main.go
-git add -A && git commit -m "expand data and update to v3" >/dev/null 2>&1
-COMMIT4=$(git rev-parse HEAD)
-
-# Commit 5: rename and delete
-git mv docs/guide.md docs/manual.md
-git rm data/file-001.txt >/dev/null 2>&1
-git commit -m "rename guide, remove file-001" >/dev/null 2>&1
-COMMIT5=$(git rev-parse HEAD)
-
-git push origin "$BRANCH" >/dev/null 2>&1
-pass "2 more commits pushed (5 total)"
-
-# --- Phase 5: Checkout older revision in on-mount clone -------------------
-
-echo "--- Phase 5: Checkout older revision in on-mount clone ---"
-
-cd "$MOUNT_CLONE"
-git checkout "$COMMIT2" >/dev/null 2>&1
-
-# Verify we're at commit 2 state
-DETACHED_HEAD=$(git rev-parse HEAD)
-assert_eq "$DETACHED_HEAD" "$COMMIT2" "on-mount clone at commit 2 (detached)"
-assert_file_not_exists "$MOUNT_CLONE/docs/guide.md" "docs/guide.md not in commit 2"
-assert_file_contains "$MOUNT_CLONE/src/main.go" 'v1' "src/main.go has v1 at commit 2"
-
-# --- Phase 6: Return to branch and pull -----------------------------------
-
-echo "--- Phase 6: Return to branch and pull with real changes ---"
-
-cd "$MOUNT_CLONE"
-git checkout "$BRANCH" >/dev/null 2>&1
-# At this point the on-mount clone is at commit 3, remote is at commit 5
-OLD_HEAD=$(git rev-parse HEAD)
-assert_eq "$OLD_HEAD" "$COMMIT3" "on-mount clone at commit 3 before pull"
-
-git pull >/dev/null 2>&1
-NEW_HEAD=$(git rev-parse HEAD)
-assert_eq "$NEW_HEAD" "$COMMIT5" "HEAD matches commit 5 after pull"
-
-# Verify commit 5 state
-assert_file_contains "$MOUNT_CLONE/src/main.go" 'v3' "src/main.go has v3 after pull"
-assert_file_exists "$MOUNT_CLONE/docs/manual.md" "docs/manual.md exists (renamed)"
-assert_file_not_exists "$MOUNT_CLONE/docs/guide.md" "docs/guide.md gone (renamed)"
-assert_file_not_exists "$MOUNT_CLONE/data/file-001.txt" "data/file-001.txt removed"
-assert_file_exists "$MOUNT_CLONE/data/file-050.txt" "data/file-050.txt exists"
-
-FINAL_COUNT=$(find "$MOUNT_CLONE/data" -name '*.txt' | wc -l | tr -d ' ')
-assert_eq "$FINAL_COUNT" "49" "data/ has 49 files (50 added, 1 removed)"
-
-# --- Phase 7: Verify git log integrity -----------------------------------
-
-echo "--- Phase 7: Verify git log integrity ---"
-
-cd "$MOUNT_CLONE"
-GIT_LOG=$(git log --format=%s)
-LOG_COUNT=$(echo "$GIT_LOG" | wc -l | tr -d ' ')
-assert_eq "$LOG_COUNT" "5" "git log shows 5 commits"
-
-# Verify commit messages
-echo "$GIT_LOG" | grep -qF "initial commit" && pass "commit 1 message in log" || fail "commit 1 message missing"
-echo "$GIT_LOG" | grep -qF "expand data" && pass "commit 4 message in log" || fail "commit 4 message missing"
-echo "$GIT_LOG" | grep -qF "rename guide" && pass "commit 5 message in log" || fail "commit 5 message missing"
-
-# --- Phase 8: Verify git status is clean ----------------------------------
-
-echo "--- Phase 8: Verify git status is clean ---"
-
-cd "$MOUNT_CLONE"
-STATUS=$(git status --porcelain)
-if [[ -z "$STATUS" ]]; then
-    pass "git status is clean"
-else
-    fail "git status has changes: $STATUS"
-fi
-
-# --- Results ---------------------------------------------------------------
-
-echo ""
-echo "========================================"
-echo "  Results: $PASS passed, $FAIL failed"
-echo "========================================"
-
-if [[ "$FAIL" -gt 0 ]]; then
-    exit 1
-fi

docker/compose/test-tarantool-filer.yml

@@ -15,7 +15,7 @@ services:
 
   s3:
     image: chrislusf/seaweedfs:local
-    command: "server -ip=127.0.0.1 -filer -master.volumeSizeLimitMB=16 -volume.max=0 -volume -volume.preStopSeconds=1 -s3 -s3.config=/etc/seaweedfs/s3.json -s3.port=8000 -s3.allowDeleteBucketNotEmpty=false"
+    command: "server -ip=127.0.0.1 -filer -master.volumeSizeLimitMB=16 -volume.max=0 -volume -volume.preStopSeconds=1 -s3 -s3.config=/etc/seaweedfs/s3.json -s3.port=8000 -s3.allowEmptyFolder=false -s3.allowDeleteBucketNotEmpty=false"
     volumes:
       - ./s3.json:/etc/seaweedfs/s3.json
     environment:

docker/compose/test-ydb-filer.yml

@@ -20,7 +20,7 @@ services:
       - 8888:8888
       - 8000:8000
       - 18888:18888
-    command: "server -ip=s3 -filer -master.volumeSizeLimitMB=16 -volume.max=0 -volume -volume.preStopSeconds=1 -s3 -s3.config=/etc/seaweedfs/s3.json -s3.port=8000 -s3.allowDeleteBucketNotEmpty=false"
+    command: "server -ip=s3 -filer -master.volumeSizeLimitMB=16 -volume.max=0 -volume -volume.preStopSeconds=1 -s3 -s3.config=/etc/seaweedfs/s3.json -s3.port=8000 -s3.allowEmptyFolder=false -s3.allowDeleteBucketNotEmpty=false"
     volumes:
       - ./s3.json:/etc/seaweedfs/s3.json
     environment:

docker/entrypoint.sh

@@ -1,9 +1,5 @@
 #!/bin/sh
 
-# Enable FIPS 140-3 mode by default (Go 1.24+)
-# To disable: docker run -e GODEBUG=fips140=off ...
-export GODEBUG="${GODEBUG:+$GODEBUG,}fips140=on"
-
 # Fix permissions for mounted volumes
 # If /data is mounted from host, it might have different ownership
 # Fix this by ensuring seaweed user owns the directory
@@ -20,17 +16,13 @@ if [ "$(id -u)" = "0" ]; then
   
   DATA_UID=$(stat -c '%u' /data 2>/dev/null)
   DATA_GID=$(stat -c '%g' /data 2>/dev/null)
-
-  # Only run chown -R if ownership doesn't already match (avoids expensive
-  # recursive chown on subsequent starts, and is a no-op on OpenShift when
-  # fsGroup has already set correct ownership on the PVC).
-  if [ "$DATA_UID" != "$SEAWEED_UID" ] || [ "$DATA_GID" != "$SEAWEED_GID" ]; then
+  
+  # Only run chown -R if ownership doesn't match (much faster for subsequent starts)
     echo "Fixing /data ownership for seaweed user (uid=$SEAWEED_UID, gid=$SEAWEED_GID)"
     if ! chown -R seaweed:seaweed /data; then
       echo "Warning: Failed to change ownership of /data. This may cause permission errors." >&2
       echo "If /data is read-only or has mount issues, the application may fail to start." >&2
     fi
-  fi
   
   # Use su-exec to drop privileges and run as seaweed user
   exec su-exec seaweed "$0" "$@"
@@ -58,7 +50,7 @@ isArgPassed() {
 case "$1" in
 
   'master')
-  	ARGS="-mdir=/data -volumeSizeLimitMB=1024"
+  	ARGS="-mdir=/data -volumePreallocate -volumeSizeLimitMB=1024"
   	shift
   	exec /usr/bin/weed -logtostderr=true master $ARGS $@
 	;;
@@ -72,24 +64,10 @@ case "$1" in
   	exec /usr/bin/weed -logtostderr=true volume $ARGS $@
 	;;
 
-  'volume-rust')
-  	ARGS="-dir /data -max 0"
-  	if isArgPassed "-max" "$@"; then
-  	  ARGS="-dir /data"
-  	fi
-  	shift
-  	if [ ! -s /usr/bin/weed-volume ]; then
-  	  echo "Error: Rust volume server is not available on this platform ($(uname -m))." >&2
-  	  echo "Use 'volume' for the Go volume server instead." >&2
-  	  exit 1
-  	fi
-  	exec /usr/bin/weed-volume $ARGS $@
-	;;
-
   'server')
-  	ARGS="-dir=/data -volume.max=0 -master.volumeSizeLimitMB=1024"
+  	ARGS="-dir=/data -volume.max=0 -master.volumePreallocate -master.volumeSizeLimitMB=1024"
   	if isArgPassed "-volume.max" "$@"; then
-  	  ARGS="-dir=/data -master.volumeSizeLimitMB=1024"
+  	  ARGS="-dir=/data -master.volumePreallocate -master.volumeSizeLimitMB=1024"
   	fi
  	shift
   	exec /usr/bin/weed -logtostderr=true server $ARGS $@

docker/entrypoint_e2e.sh

@@ -33,7 +33,7 @@ isArgPassed() {
 case "$1" in
 
   'master')
-  	ARGS="-mdir=/data -volumeSizeLimitMB=1024"
+  	ARGS="-mdir=/data -volumePreallocate -volumeSizeLimitMB=1024"
   	shift
   	exec /usr/bin/weed -logtostderr=true master $ARGS "$@"
 	;;
@@ -48,9 +48,9 @@ case "$1" in
 	;;
 
   'server')
-  	ARGS="-dir=/data -volume.max=0 -master.volumeSizeLimitMB=1024"
+  	ARGS="-dir=/data -volume.max=0 -master.volumePreallocate -master.volumeSizeLimitMB=1024"
   	if isArgPassed "-volume.max" "$@"; then
-  	  ARGS="-dir=/data -master.volumeSizeLimitMB=1024"
+  	  ARGS="-dir=/data -master.volumePreallocate -master.volumeSizeLimitMB=1024"
   	fi
  	shift
   	exec /usr/bin/weed -logtostderr=true server $ARGS "$@"

docker/seaweedfs-compose.yml

@@ -14,7 +14,7 @@ services:
       - 8080:8080
       - 18080:18080
       - 9325:9325
-    command: 'volume -ip=volume -master="master:9333" -ip.bind=0.0.0.0 -port=8080 -metricsPort=9325'
+    command: 'volume -ip=volume -mserver="master:9333" -ip.bind=0.0.0.0 -port=8080 -metricsPort=9325'
     depends_on:
       - master
   filer:

docker/seaweedfs-dev-compose.yml

@@ -12,7 +12,7 @@ services:
     ports:
       - 8080:8080
       - 18080:18080
-    command: 'volume -ip=volume -master="master:9333" -ip.bind=0.0.0.0 -port=8080'
+    command: 'volume -ip=volume -mserver="master:9333" -ip.bind=0.0.0.0 -port=8080'
     depends_on:
       - master
   filer:
@@ -42,12 +42,3 @@ services:
       - master
       - volume
       - filer
-  admin:
-    image: chrislusf/seaweedfs:dev # use a remote dev image
-    ports:
-      - 23646:23646
-    command: 'admin -master=master:9333'
-    depends_on:
-      - master
-      - volume
-      - filer