MinIO, LocalStack, Boundary and Portainer Ended or Froze Community Editions From December 2025 to October 2026, With Differing Security-Fix Positions

Background

Four developer-infrastructure projects that pair a free community edition with a paid product ended or froze that free edition between December 2025 and October 2026: MinIO, LocalStack, HashiCorp Boundary and Portainer. In the Herald’s own check of GitHub’s repository metadata on November 8, 2026, the MinIO, LocalStack and Boundary repositories were archived, while the Portainer repository was not. The difference this article examines is what each vendor said about security fixes once the change was made, drawing on the projects’ own pages and on news coverage.

MinIO, an S3-compatible object store, moved in steps. It’s FOSS reports that in May 2025 a breaking release removed most management features from the community edition’s web UI and moved them to the enterprise product, and that in October 2025 MinIO “stopped publishing Docker images and pre-built binaries for the community edition entirely.” The same outlet adds that users who needed to patch a CVE that appeared that month “had to build from source instead.” The Herald’s own look at the repository fits that account: the newest entry on its releases page is named “Security/CVE RELEASE.2025-10-15T17-29-55Z” and was published on 2025-10-16 (UTC), and its notes tell container users to “clone the source and build the latest container.”

On December 3, 2025 a commit to MinIO’s README declared maintenance mode. Among its bullets: “No new features, enhancements, or pull requests will be accepted” and “Critical security fixes may be evaluated on a case-by-case basis.” InfoQ reported the maintenance mode on December 28, 2025, and Linuxiac wrote on December 5, 2025 that “MinIO is effectively done.” The README today reads “THIS REPOSITORY IS NO LONGER MAINTAINED.” The sources differ on the archive date. LWN.net says the project was archived in February 2026, while It’s FOSS says it was archived in February, briefly unarchived, and archived again on April 25, 2026.

Current situation

The other three changes came later and took different forms.

LocalStack. InfoQ reported on February 15, 2026 that LocalStack was dropping its Apache 2.0 Community Edition and creating a single image that requires registration, with the switch “currently planned for March.” The company’s co-CEOs, quoted by InfoQ, cited “the scope, security requirements, and operational complexity of maintaining high-fidelity AWS emulation.” The repository’s README now says it “is now archived and read-only”; the commit that added that notice is dated 2026-03-23 (UTC). The notice points to a free Hobby plan “for non-commercial use.”

Portainer. It’s FOSS reported on September 21, 2026 that Portainer’s chief executive, Neil Cresswell, said Community Edition would “continue being based on Portainer 2.45 LTS, the last release in the 2.x line,” while Portainer 3.0 would not be the base for CE. The outlet gives his reason as a maintenance problem: each policy or API capability had to be built “three separate times.” Unlike the other three, the Portainer repository is not archived. The Herald’s check of its releases found 2.45.2 (published 2026-10-08, UTC) and 2.45.3 (2026-10-21, UTC), both after It’s FOSS’s report, and the notes for 2.45.2 and 2.45.3 each contain a security section.

Boundary. HashiCorp’s README says Boundary Community Edition “is no longer under active development, and this repository has been archived as of October 8, 2026.” The Herald’s earlier briefing recorded that GitHub’s banner gives October 9 instead; neither page explains the difference.

What each vendor said about security fixes

The wording differs. The list gives each statement as its source states it:

• MinIO: “Critical security fixes may be evaluated on a case-by-case basis” (README commit, December 3, 2025). LWN reports that the company “has continued to publish vulnerability information” about the last version at least through April 2026 but “is no longer supplying updates to the open-source project.”
• LocalStack: per InfoQ, “LocalStack will not release any further updates to the Community Edition, with product enhancements and security patches applied only to the new version.”
• Boundary: “No new Boundary CE releases, maintenance updates, bug fixes, or security patches are currently planned.”
• Portainer: per It’s FOSS, “CE will get security fixes, bug fixes, and backports of 3.x features, but only where a matching Docker API exists to interface with.” Portainer’s own README, however, says CE “is not intended for, or supported in, business, production, or any other environment where uptime, security posture, or data integrity matter,” that there is “no SLA,” and that CE “is updated periodically, with no guarantees on cadence.”

Reasons and free routes

LocalStack and Portainer gave reasons in the coverage cited above. LWN states that MinIO “did not state its reasons for retiring the project.” Boundary’s README says future development “will focus on HCP Boundary and Boundary Enterprise” and, in the text the Herald read, gives no further reason.

The pages also differ on whether a free route onto the vendor’s proprietary build is named. The Herald found one in the MinIO README (“AIStor Free,” described as for “community use (free license)”), in LocalStack’s notice, and in It’s FOSS’s account of Portainer, where the only no-cost route onto 3.x runs through “3 Nodes Free,” a node-capped license for the closed-source Business Edition. The Boundary README text read for this article names HCP Boundary and Boundary Enterprise but no free tier.

Implications

Linuxiac, It’s FOSS and LWN each frame the practical consequence for MinIO users as finding an alternative. Linuxiac wrote that “the priority now is clear: begin planning an urgent migration to an alternative”, which is that outlet’s recommendation in an opinionated piece. It’s FOSS says an existing MinIO deployment “still works” but gets “no guaranteed security patches,” and LWN’s contributed article compares Ceph and Garage as replacements. For LocalStack, the co-CEOs warned, as InfoQ quotes them, that any project that automatically pulls the latest image “will need to be updated before the change goes live.”

Stewardship by a third party is the other route the sources describe. The New Stack reported on January 27, 2026 that Chainguard’s EmeritOSS program was adding 10 more programs, and the outlet singled out MinIO among them. It wrote that Chainguard’s “forked, stability-focused EmeritOSS versions will remain freely available on GitHub in source code,” while “secure, continuously maintained container images” are offered through Chainguard’s commercial distributions. Chainguard is the party selling those images, so that offer is the vendor’s own.

On community forks, the sources are dated apart. InfoQ wrote on December 28, 2025 that, “So far, no fork of the MinIO community edition has gained traction.” LWN reported in June 2026 that a fork called Silo exists, with its maintainer limiting plans to bugs and security fixes and a most recent release on June 18, 2026. LWN also writes: “Most users of MinIO have moved on to other projects that remain on open-source licenses.”

One narrower point follows from the comparison. A repository’s archived flag does not say what its owner will do about vulnerabilities. The three archived repositories carry three different statements: case-by-case evaluation (MinIO, before the README said it was no longer maintained), security patches only in the new image (LocalStack), and none planned (Boundary). The one repository still releasing, Portainer’s, carries a README that disclaims security posture for production use. For each of the four, the vendor’s current statement, not the repository status alone, carries the security-fix position.

What the sources do not settle

The Boundary README’s wording is “currently planned,” which leaves open a later change. The MinIO archive date is reported differently by the sources above and is not reconciled here beyond It’s FOSS’s account of an archive, unarchive and re-archive. The README for Portainer’s CE gives “no guarantees on cadence” for releases, so the sources do not say how long security releases will continue. This article does not predict whether other vendors will follow the same path.

Sources and independence

The GitHub repositories, READMEs, commits and release notes are the projects’ own and are not independent of the vendors. The independent accounts come from five outlets: InfoQ, It’s FOSS, Linuxiac, LWN.net (the cited piece is a contributed article by Tyler Langlois) and The New Stack. Linuxiac’s pieces include the author’s opinions, and The New Stack’s piece covers a program run by Chainguard, a vendor.