DCA Hardened Object Store for SeaweedFS — Support & Quick Start

At a glance

Status	Live on Oracle Cloud Marketplace
Version	4.48
Platform	Oracle Linux 9
Ports open in the host firewall	SSH (22/tcp), 8333/tcp
Category	Storage
Upstream licence	Apache-2.0
Pricing	Pay-as-you-go software fee per OCPU-hour, billed by Oracle on your OCI invoice — see the listing's Pricing tab

Quick start

This is the listing's usage information, verbatim. Every command in it is run by our QA on a freshly launched instance before an image version can publish, so the text and the tested procedure cannot drift apart.

After launch:

1. Connect over SSH as the opc user with the key you supplied at launch:

   ssh opc@PUBLIC_IP

2. SeaweedFS runs as a systemd service with the S3 gateway on 127.0.0.1:8333. Check status:

   sudo systemctl status seaweedfs

3. Read the instance-unique S3 credentials (root only):

   sudo cat /root/.seaweedfs_default_credentials

4. Use any S3 client over an SSH tunnel:

   ssh -L 8333:127.0.0.1:8333 opc@PUBLIC_IP
   aws --endpoint-url http://localhost:8333 s3 ls

5. To expose S3 beyond the instance, move only the S3 gateway (8333) off loopback; master, volume and filer stay on 127.0.0.1:

   sudo sed -i 's/^S3_BIND=127.0.0.1$/S3_BIND=0.0.0.0/' /etc/seaweedfs/seaweedfs.env && sudo systemctl restart seaweedfs

   8333 is already permitted in the host firewall (the gateway's internal gRPC port 18333 moves with it and stays firewalled).

   Terminate TLS in front (OCI load balancer or reverse proxy) and restrict 8333 in your VCN security list; never expose it to the internet.

6. Rotate the S3 keys by editing /etc/seaweedfs/s3.json, then:

   sudo systemctl restart seaweedfs

   Data lives in /var/lib/seaweedfs; attach block volumes for capacity. Recommended sizing: at least 2 OCPU (4 vCPU) and 16 GB memory.

The image is CVE-patched at build time. Apply ongoing updates with:

sudo dnf -y update

What the image provides

• SeaweedFS 4.48, installed from the project's official release with its checksum verified at build time, running the combined master, volume, filer, and S3 gateway as a single dedicated unprivileged service.
• Loopback-bound by default. Every service binds to 127.0.0.1, and the S3 gateway is given an instance-unique access key and secret generated on first boot — no credential is baked into the image.
• A least-privilege systemd unit (NoNewPrivileges, ProtectSystem, ProtectHome, PrivateTmp).
• Security hardening aligned to the Oracle Cloud Marketplace image standards: SELinux enforcing, host firewall default-deny with only SSH and the S3 port permitted, no account with a usable password, no stray keys, and the image fully patched at build time.

Fixed issues

Found by our customer-path QA, fixed in a new image version. Launch the current version for new deployments.

• Fixed in 4.48 (2026-10-07): On version 4.39 the usage information gave no working command to expose the S3 gateway (editing the unit's bind address does nothing without a systemd daemon-reload, and the unit's only bind address would also expose the master, volume and filer, which have no authentication), its key-rotation step omitted the restart, and an undocumented Iceberg catalog listened on 127.0.0.1:8181. 4.48 exposes only the S3 gateway with one documented command, turns the Iceberg and Lance catalogs off, and turns off upstream usage telemetry (on by default since SeaweedFS 4.41).
  On an instance launched from 4.39: after editing keys in /etc/seaweedfs/s3.json, restart the service; to expose only the S3 gateway:

  sudo sed -i 's/-s3.config=/-s3.ip.bind=0.0.0.0 -s3.config=/' /etc/systemd/system/seaweedfs.service && sudo systemctl daemon-reload && sudo systemctl restart seaweedfs

Still stuck?

Email support@dcassociatesgroup.com (response within 1 business day) or use the contact form. Include the listing name, your OCI region, the instance OCID and the output of sudo journalctl -u <service> -n 100 for the unit named in the quick start.

SeaweedFS is a trademark of its respective owner. This image is an independent hardened distribution and is not affiliated with, endorsed by, or sponsored by the SeaweedFS project.