Releases · beleon/buckets

Smaller changes on top of the v2 rewrite: transcribable slugs, three memory fixes,
and looser rate limits.

What's new since v2.0.0

Slugs are now 15 characters of Crockford base32 — digits and lowercase letters
without i, l, o and u — sampled from crypto/rand for 75 bits. Lookups
normalize what you type: case-insensitive, with i and l read as 1 and o
as 0, so a slug survives being read aloud or typed on another device.
The slug alone is the secret. GET /<slug> has always redirected to the full
path, so the filename was never part of it, despite what the README and code
comments said. The slug now carries the whole secret.
Rate limits raised to 12 uploads and 240 other requests per minute. The upload
limit caps store churn rather than memory, and 6/min made batch uploads from a
shell loop tedious; at 75 bits the read limit is no longer doing meaningful work
against slug guessing.
Three memory fixes from a measured pass: deleting or expiring the newest bucket
no longer leaves up to 500 MB uncollectable; uploads with a known
Content-Length read into a right-sized buffer instead of peaking at ~2.4x the
body; and an oversize Content-Length is rejected before the body is read
rather than after buffering it.
Piped (chunked) uploads can still peak near 2 GB, which the README now notes.

What's new since the v1 line

Rewritten as a single main.go with no dependencies beyond the standard library.

Web UI: paste text, drop a file, or paste an image. Ctrl+Enter shares.

POST /<filename> to upload, GET /<slug>/<filename> to download, replace and
delete on the full path. GET /<slug> redirects to the full path.

Content-Type detection at upload, range requests and HEAD supported.

24h TTL per bucket; replacing a bucket resets its clock.

500 MB per upload and 500 MB total, oldest-first eviction, 413 while streaming.

Rate limits: 6 uploads/min and 60 other requests/min, global, returning 429.

Slugs are 48 bits from crypto/rand, 8 base64url chars, and guessing one needs
the filename too.

Everything lives in memory. No disk, no database, nothing survives a restart.

FROM scratch container image holding a single static binary.

The v1 line is preserved in this repository's history at the v1-final tag.