OpenShift

Give a Red Hat OpenShift agent pod durable memory — /workspace mounted as a MinIO AIStor Memory Bucket (cortex).

Status — Ready

The OpenShift example is wired for a one-command release path: deploy.sh creates the SCC, service account, config, credentials, pod, FUSE mount, and smoke check. The default image is the public release image placeholder, quay.io/minio/aimem-openshift:latest.

An OpenShift agent pod is disposable — when it's torn down, anything the agent wrote to the container's own filesystem is gone. AIStor Memory gives that pod durable memory: it mounts a Memory Bucket (cortex) at /workspace, so the agent both works in and remembers through a customer-owned cortex on MinIO AIStor. Everything written under /workspace persists to AIStor — your storage, your keys — and re-mounts at full fidelity on the next pod, so a new run starts with what the last one learned.

The workload ships as one UBI container that brings up the mount, waits for it to become ready, then runs your agent command or stays alive for oc rsh.

aimem only mounts a cortex

aimem mounts a Memory Bucket (cortex) and nothing else. Before the mount is attempted, aimem verifies the target with the Memory API and refuses a plain S3 bucket. The mount needs, in order: an explicit --endpoint-url, real signing credentials (AIMEM_ACCESS_KEY / AIMEM_SECRET_KEY — anonymous or default-chain mounts are rejected), and a target that is already a cortex on a paid-tier (Enterprise) AIStor. Create one launcher-side first:

aimem cortex create my-project \
  --endpoint-url https://aistor.example.com \
  --access-key ... --secret-key ...

If the bucket is not a cortex, the mount fails with 'my-project' is not a Memory Bucket (cortex); on a free-tier server or without memory:GetCortex, it fails with access denied by the Memory API.

Quick start

Prerequisites:

oc installed, plus cluster-admin or kubeadmin credentials.
A Memory Bucket (cortex) on a paid-tier AIStor endpoint, plus signing credentials reachable from the cluster (see the note above; create the cortex with aimem cortex create before deploying).
The release image quay.io/minio/aimem-openshift:latest published and pullable. For prerelease testing, set AIMEM_IMAGE to a private build.

oc login ...

AIMEM_BUCKET=my-project \
AIMEM_ENDPOINT=https://aistor.example.com \
AIMEM_ACCESS_KEY=... \
AIMEM_SECRET_KEY=... \
examples/openshift/deploy.sh

The script deploys into the aimem namespace by default, waits for /workspace to become a FUSE mount, writes a smoke file through it, and leaves the pod running.

Open a shell in the mounted workspace:

oc rsh -n aimem aimem-workspace

Run an agent command after the mount is ready:

AIMEM_BUCKET=my-project \
AIMEM_ENDPOINT=https://aistor.example.com \
AIMEM_ACCESS_KEY=... \
AIMEM_SECRET_KEY=... \
AIMEM_COMMAND='my-agent --flag' \
examples/openshift/deploy.sh

What the script creates

deploy.sh applies the custom SCC, creates the aimem service account and SCC binding, creates aimem-config and aimem-credentials, deploys aimem-workspace, waits for readiness, then verifies both AIStor Memory SKILLS and read/write behavior under /workspace.

Use these environment variables when the default path is not enough:

Variable	Default	Use it for
`NAMESPACE`	`aimem`	A different target namespace.
`AIMEM_VERSION`	`latest`	A specific release image tag.
`AIMEM_IMAGE`	`quay.io/minio/aimem-openshift:<version>`	A private or locally built image.
`AIMEM_COMMAND`	`sleep infinity`	Starting an agent after the mount.
`AIMEM_REGION`	unset	Endpoints needing an explicit region.
`AIMEM_PREFIX`	unset	Mounting a sub-prefix of the cortex.
`AIMEM_LOCAL`	`/var/cache/aimem-staging`	Overriding the mandatory local staging dir.
`AIMEM_AGENT`	`auto`	Selecting the agent-memory profile.
`AIMEM_ALLOW_OTHER`	unset	Setting `allow_other` on the mount.
`KEEP`	`1`	Set `0` to delete the pod on exit.
`CLEANUP`	unset	With `KEEP=0`, also remove SCC/RBAC/config.

Private image fallback

You only need to build an image for unreleased, offline, or patched binaries:

cd examples/openshift
podman build -f openshift.Dockerfile -t quay.io/your-org/aimem-openshift:latest .
podman push quay.io/your-org/aimem-openshift:latest

AIMEM_IMAGE=quay.io/your-org/aimem-openshift:latest \
AIMEM_BUCKET=my-project \
AIMEM_ENDPOINT=https://aistor.example.com \
AIMEM_ACCESS_KEY=... \
AIMEM_SECRET_KEY=... \
./deploy.sh

To build offline, stage Linux/amd64 aimem and aimem-fusermount in examples/openshift/bin/; the Dockerfile uses staged binaries before it tries the public CDN.

Where this works

FUSE needs CAP_SYS_ADMIN, privilege escalation for the setuid aimem-fusermount fallback, and access to /dev/fuse. OpenShift's default restricted-v2 SCC blocks that, so the script applies scc.yaml. This requires cluster-admin.

Target	Works?	Notes
Self-managed OpenShift / OKD	Yes	Use a cluster-admin account.
OpenShift Local (CRC)	Yes	Log in as `kubeadmin`.
MicroShift	Yes	Use the generated kubeadmin kubeconfig.
ROSA / OpenShift Dedicated	Maybe	Grant cluster-admin first, then use this SCC path.
Free hosted Developer Sandbox	No	You cannot create or bind the SCC, so FUSE is blocked.

How it works

aimem opens /dev/fuse directly and performs mount(2). With CAP_SYS_ADMIN present, the mount succeeds directly; on EPERM, AIStor Memory uses the setuid-root aimem-fusermount helper. The container still runs as a non-root UID.

The manifest carries both /dev/fuse paths so the operator does not have to choose per-cluster:

a hostPath CharDevice volume for runtimes that expose /dev/fuse on the node, and
the OpenShift / CRI-O annotations used by OpenShift 4.15+.

Reference

examples/openshift/deploy.sh - one-command deployment and smoke check.
examples/openshift/aimem-workspace.yaml - the workspace pod.
examples/openshift/scc.yaml - the FUSE SCC.
examples/openshift/openshift.Dockerfile - private image build fallback.