Lockwell is S3-compatible object storage that runs as one container with one volume. Encryption at rest is always on, every tenant has its own keys, and there are no public buckets.
Lockwell is private, self-hosted, S3-compatible object storage. It ships as a single binary with an embedded database, so it runs as one container with one volume: no external database, message broker or cache to operate.
It is private by design. There are no public buckets and no anonymous reads; every request carries a tenant key, and encryption at rest is always on, with per-tenant data keys. S3 calls Lockwell does not support fail loudly instead of silently.
Lockwell is already running in production at a Portuguese mutual-sector organisation. It is single-node today; multi-node clustering is not yet released, and a managed hosted service is not offered yet.
Closed source during early access; an MIT-licensed source release is planned.
This page is an overview; the source code is not public. For access, pricing or questions, write to hello@rusticstack.com.
Private, self-hosted S3-compatible object storage
SigV4, versioning, multipart uploads, conditional writes, presigned URLs, Object Lock (retention and legal hold), tagging and lifecycle rules.
Data at rest is encrypted with AES-256-GCM or XChaCha20-Poly1305 using per-tenant data keys. There is no switch to turn it off.
Per-tenant isolation, scoped access keys (read, write, delete, optional bucket scope), quotas, role-based access control and an audit trail.
A single binary with an embedded BadgerDB database. Runs on Linux amd64 and arm64 via Docker; a 1 vCPU / 1 GiB VPS handles small workloads.
A native JSON API at /api/v1, an admin API on a private listener with OpenAPI, an admin console, first-party Go, Node and Java SDKs, and HMAC-SHA256 signed webhooks.
Scrub and repair, backup and restore drills, signed browser upload and download URLs, edge runtime support, and a migration planner for moving from other S3-compatible stores.
| Status | In production |
|---|---|
| Licence | Closed source during early access; an MIT-licensed source release is planned |
| Source | Closed source |
| Platforms | Linux amd64 (Docker), Linux arm64 (Docker) |
| Built with | Single binary, BadgerDB (embedded), Docker, S3 API (SigV4), OpenAPI |
| Links |
Yes. Lockwell is a single binary with an embedded BadgerDB database, so it runs as one container with one volume on Linux amd64 or arm64. It needs no external database, message broker or cache.
A 1 vCPU / 1 GiB VPS handles small workloads.
SigV4, versioning, multipart uploads, conditional writes, presigned URLs, Object Lock (retention and legal hold), tagging and lifecycle rules. S3 calls Lockwell does not support fail loudly instead of silently.
Encryption at rest is always on, with AES-256-GCM or XChaCha20-Poly1305 and per-tenant data keys. There is no switch to turn it off.
Yes. Lockwell supports S3 Object Lock, including retention and legal hold.
No. There are no public buckets and no anonymous reads, and every request carries a tenant key. To share files with browsers, use presigned URLs or Lockwell's signed browser upload and download URLs.
Each tenant is isolated and has its own data keys. Access keys are scoped to read, write and delete, with an optional bucket scope. Lockwell also provides quotas, role-based access control and an audit trail.
Yes. Lockwell includes a migration planner for moving from other S3-compatible stores.
Besides the S3 API, there is a native JSON API at /api/v1, an admin API on a private listener with OpenAPI, an admin console, first-party Go, Node and Java SDKs, and HMAC-SHA256 signed webhooks.
Lockwell is closed source during early access, and an MIT-licensed source release is planned. A managed hosted service is not offered yet. Access is by request, and the documentation at lockwell.rusticstack.com is public.
· Company
Lockwell object storage, the Sentinel CI engine, the TangibleShift ERP, the Komorebi email client, two game tools and a Pico CSS fork: what each is for.
A self-hosted CI engine in Rust
Sentinel runs your pull request checks on your own machines, in rootless containers, and reports them back as native GitHub checks. It is in early development; sub-minute warm checks are a goal, not a measured result.
A Portugal-first ERP for small businesses
A Portugal-first SaaS ERP for small and medium businesses, their accountants and owner-operators, with IVA, invoicing and SAF-T (PT) handled correctly from the start.
A small, fast, private email client for Windows
Komorebi is an IMAP email client for Windows 10 and 11. It works with any IMAP and SMTP server, blocks remote content by default, and has no telemetry, no ads and no AI.