safebucket

Features

• Direct uploads and downloads via presigned URLs: files bypass the server
• Swappable infrastructure: every component (storage, database, events, cache, notifier) can be replaced
• SSO via any OIDC provider, with local auth for external users
• Role-based access control at platform and bucket level
• Quick/reverse share: share file via public links with options (password, max downloads, max views, etc...)
• Real-time activity tracking and audit logs
• Multifactor authentication (TOTP)
• File expiration, trash with configurable retention
• Admin dashboard with platform-wide statistics

And more... see the full list of features.

Architecture

Quick Start

git clone https://github.com/safebucket/safebucket.git
cd safebucket/deployments/local/lite
docker compose up -d

• Go to http://localhost:8080
• Log in with:
  • login: [email protected]
  • password: ChangeMePlease

Note: If you are accessing Safebucket from an external machine (e.g. Proxmox), you need to update the following environment variables in the .env file with your host's IP or domain:

• STORAGE__RUSTFS__EXTERNAL_ENDPOINT
• APP__ALLOWED_ORIGINS
• APP__API_URL
• APP__WEB_URL

Verify Image Signature

All published container images are signed with cosign using keyless signing via GitHub Actions OIDC: no manual keys are involved.

You can verify the signature of any published image using the following commands:

cosign verify \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-identity-regexp=https://github.com/safebucket/safebucket/ \
  ghcr.io/safebucket/safebucket:

Replace `` with the image tag you want to verify (e.g., latest, v1.0.0).

License

This project is licensed under the Apache 2.0 - see the LICENSE file for details.

Acknowledgments

• Built with ❤️ using Go and React
• UI components by Radix UI and shadcn/ui
• Database ORM by Gorm
• Database migrations by Goose
• Pub/sub integrations by Watermill
• Configuration management by Koanf
• Icons by Lucide