Garage (S3)

Garage is the bundled lightweight S3-compatible object store used by the Code Interpreter. Its GARAGE_*/S3_* keys, garage.toml, the one-time bootstrap, swapping in external S3, and links to the official Garage docs.

Garage is a lightweight (~25 MB) self-hosted, S3-compatible object store. In this stack it backs the Code Interpreter, which writes generated files to an S3 bucket. Its S3 API stays internal-only (garage:3900).

Overview


Compose file	`config/codeapi.compose.yml` (bundled with the code interpreter)
Service name	`garage`
Module	`garage` (optional — `intelliask module disable garage`)
Image variable	`GARAGE_IMAGE` (e.g. `garage:v1.0.1`)
Config file	`config/garage.toml` (mounted read-only)
Exposed	internal only (S3 API on `garage:3900`)
Data	`${STORAGE_ROOT}/garage-s3-meta` and `…/garage-s3-data`

Environment variables

Garage's own secrets use the GARAGE_ prefix; the S3 client keys (shared with the Code Interpreter) use the S3_ prefix:

Variable	Default	What it does
`GARAGE_IMAGE`	`garage:v1.0.1`	Image + tag to run.
`GARAGE_CPUS`	`0.25`	CPU ceiling.
`GARAGE_MEMORY`	`128m`	Memory ceiling.
`GARAGE_RPC_SECRET`	(secret)	Cluster RPC secret (64 hex).
`GARAGE_ADMIN_TOKEN`	(secret)	Admin API token.
`MINIO_ENDPOINT`	`garage`	S3 host the Code Interpreter client uses.
`MINIO_PORT`	`3900`	S3 port on that host.
`MINIO_BUCKET`	`intelliask-codeinterpreter`	Bucket created at bootstrap.
`MINIO_ACCESS_KEY`	(bootstrap)	Access key — must be `GK` + 24 hex.
`MINIO_SECRET_KEY`	(bootstrap)	Secret key — 64 hex.
`MINIO_USE_SSL`	`false`	Use TLS to the endpoint.

Key format matters

MINIO_ACCESS_KEY must be GK followed by 24 hex chars and MINIO_SECRET_KEY exactly 64 hex chars, or Garage rejects the import. Change MINIO_ACCESS_KEY / MINIO_SECRET_KEY, GARAGE_RPC_SECRET, and GARAGE_ADMIN_TOKEN from their defaults before real use.

Config file: garage.toml

Cluster-level settings (replication, data/meta dirs, the S3 API bind, region) live in config/garage.toml, mounted at /etc/garage.toml. The defaults suit a single-node deployment; edit it only for multi-node clusters or custom paths. After changing it:

intelliask up garage

One-time bootstrap

On the first start, intelliask garage (run automatically by intelliask provision) creates the cluster layout, the MINIO_BUCKET, and a deterministic access key from MINIO_ACCESS_KEY / MINIO_SECRET_KEY. It is idempotent — safe to re-run. You normally never call it by hand.

Using an external S3 store instead

Garage is an optional module — any S3-compatible backend (AWS S3, MinIO, Cloudflare R2) works. To switch:

Disable the bundled Garage: intelliask module disable garage.
Point MINIO_ENDPOINT / MINIO_PORT at the external store and set MINIO_ACCESS_KEY / MINIO_SECRET_KEY / MINIO_BUCKET (and MINIO_USE_SSL=true for HTTPS endpoints).
intelliask up.

Resource limits

Garage idles small; the defaults (GARAGE_CPUS=0.25, GARAGE_MEMORY=128m) are plenty for Code Interpreter file storage. Raise them only for heavy object workloads.

Updating Garage

# 1. Bump the tag in config/.env, e.g. GARAGE_IMAGE=garage:v1.0.2
# 2. Pull + recreate only Garage
intelliask update garage

Back up ${STORAGE_ROOT}/garage-s3-meta and …-data before major upgrades.