Global Options
These are options that apply to the gateway itself independent of any backend type. When available, the shorthand option can be used in place of the long option. Alternatively, the optional environment variable setting is specified in []s. Setting this env var has the same effect as using the command line option. For boolean options set env var value to "true", for example VGW_QUIET=true.
--version, -v list versitygw version (default: false)
The version option will print the current binary version and exit. For example:
$ ./versitygw --version
Version : v0.1
Build : a881893
BuildTime: 2023-05-29_05:16:34AM --port value, -p value gateway listen address: <ip>:<port>, :<port>, /path/to/socket for file-backed UNIX sockets, or @name for Linux abstract namespace sockets (default: ":7070") (can be specified multiple times) [$VGW_PORT]
The port option specifies the listening address for the S3 server. It accepts TCP addresses in the form <ip>:<port> (listen on a specific network interface) or :<port> (listen on all interfaces). The <ip> can be IP dotted notation or a resolvable hostname; the <port> can be a numeric port or a service name from /etc/services. UNIX socket paths are also supported (e.g. /run/vgw/s3.sock for a file-backed socket, or @vgw-s3 for a Linux abstract namespace socket). The option can be specified multiple times to listen on multiple addresses simultaneously.
This option determines the S3 client endpoint to use. For example --port 192.168.0.1:6000 would require the S3 client to configure a server endpoint such as http://192.168.0.1:6000.
--access value root user access key [$ROOT_ACCESS_KEY_ID, $ROOT_ACCESS_KEY]
--secret value root user secret access key [$ROOT_SECRET_ACCESS_KEY, $ROOT_SECRET_KEY]
--region value s3 region string (default: "us-east-1") [$VGW_REGION]
The access and secret options will specify the root account credentials. The root account is granted full authorization to all API requests after authentication. This is generally useful for creating user level buckets and assigning ACL grants. The access and secret options can be specified through environment variables (access: ROOT_ACCESS_KEY_ID or ROOT_ACCESS_KEY) (secret: ROOT_SECRET_ACCESS_KEY or ROOT_SECRET_KEY) or with the command line options. The environment variables can help to hide the credentials from process listings. The region is an optional argument, and will default to us-east-1 if not specified.
--max-connections value, --mc value maximum number of concurrent connections s3 api server may serve (default: 250000) [$VGW_MAX_CONNECTIONS]
--max-requests value, --mr value maximum number of in-flight requests s3 api server may serve (default: 100000) [$VGW_MAX_REQUESTS]
The --max-connections option limits the total number of concurrent TCP connections the S3 API server will accept. The --max-requests option limits the number of requests actively being processed at any given time. These limits help protect the gateway from being overwhelmed under heavy load. Requests that exceed the max-requests limit will receive a 503 response. The defaults of 250,000 concurrent connections and 100,000 in-flight requests are suitable for most deployments.
--webui value enable WebUI server on the specified listen address (e.g. ':7071', '127.0.0.1:7071', 'localhost:7071', '/run/vgw/webui.sock'; supports the same address forms as --port; can be specified multiple times; disabled when omitted) [$VGW_WEBUI_PORT]
--webui-cert value TLS cert file for WebUI (defaults to --cert value when WebUI is enabled) [$VGW_WEBUI_CERT]
--webui-key value TLS key file for WebUI (defaults to --key value when WebUI is enabled) [$VGW_WEBUI_KEY]
--webui-no-tls disable TLS for WebUI even if TLS is configured for the gateway (default: false) [$VGW_WEBUI_NO_TLS]
The --webui option specifies the listening address for a server that hosts the web-based GUI. The WebUI is only enabled when this option is specified. It supports the same address forms as --port (TCP addresses, UNIX socket paths, and Linux abstract namespace sockets) and can be specified multiple times to listen on multiple addresses. The WebUI provides a browser-based interface for managing and monitoring the gateway. More details on configuring and using the WebGUI can be found at WebGUI.
The --webui-cert and --webui-key options specify separate TLS certificate files for the WebUI server. If not specified but WebUI is enabled, these will default to the values of --cert and --key respectively. The --webui-no-tls option allows you to disable TLS for the WebUI even when TLS is configured for the main S3 gateway.
--webui-gateways value [ --webui-gateways value ] override auto-detected S3 gateway URLs for WebUI (e.g. 'http://localhost:7070', 'https://s3.example.com'; can be specified multiple times) [$VGW_WEBUI_GATEWAYS]
--webui-admin-gateways value [ --webui-admin-gateways value ] override auto-detected admin gateway URLs for WebUI (e.g. 'http://localhost:7080', 'https://admin.example.com'; can be specified multiple times) [$VGW_WEBUI_ADMIN_GATEWAYS]
By default, the WebUI auto-detects the S3 and admin gateway URLs from the gateway's listen address configuration. The --webui-gateways option overrides the auto-detected S3 gateway URLs presented to the WebUI, useful when the gateway is behind a reverse proxy or load balancer and the publicly accessible URL differs from the local listen address. Similarly, --webui-admin-gateways overrides the auto-detected admin gateway URLs. Both options can be specified multiple times to provide multiple gateway endpoints.
--webui-path-prefix value mount the WebUI under a path prefix (e.g. '/ui'); must be a single segment path starting with '/' [$VGW_WEBUI_PATH_PREFIX]
--webui-s3-prefix value mount the WebUI on the S3 port at the given path prefix (e.g. '/ui'); must start with '/', must not be '/', and must not end with '/' [$VGW_WEBUI_S3_PREFIX]
The --webui-path-prefix option mounts the WebUI under a specified path prefix on the WebUI port, useful when the WebUI is served behind a reverse proxy that expects a path prefix. The --webui-s3-prefix option additionally serves the WebUI directly on the S3 port at the given path prefix, which allows accessing the WebUI without a separate WebUI port.
--website value enable static website hosting endpoint on the specified listen address (e.g. ':8080'; same forms as --port; can be specified multiple times) [$VGW_WEBSITE_PORT]
--website-domain value base domain for website virtual-host routing (e.g. 'example.com'); host 'blog.example.com' serves bucket 'blog', host 'example.com' serves bucket 'example.com'; when omitted the full hostname is used as the bucket name (catch-all mode, buckets named as FQDNs) [$VGW_WEBSITE_DOMAIN]
--website-cert value TLS cert file for website endpoint (defaults to --cert value when website is enabled) [$VGW_WEBSITE_CERT]
--website-key value TLS key file for website endpoint (defaults to --key value when website is enabled) [$VGW_WEBSITE_KEY]
--website-no-tls disable TLS for website endpoint even if TLS is configured for the gateway (default: false) [$VGW_WEBSITE_NO_TLS]
The --website option enables a static website hosting endpoint on one or more listen addresses using the same address forms as --port (TCP addresses, UNIX socket paths, and Linux abstract namespace sockets). This endpoint serves bucket website content and is disabled unless --website is specified.
The --website-domain option controls virtual-host bucket mapping for the website endpoint. With --website-domain example.com, requests for blog.example.com serve bucket blog, and requests for example.com serve bucket example.com. If --website-domain is omitted, the full request hostname is used as the bucket name (catch-all mode for FQDN-named buckets).
The --website-cert and --website-key options configure TLS specifically for the website endpoint. When website hosting is enabled and these are not set, they default to --cert and --key. Use --website-no-tls to force plaintext HTTP on the website endpoint even if TLS is configured for the main gateway.
--cors-allow-origin value default CORS Access-Control-Allow-Origin value (applied when no bucket CORS configuration exists, and for admin APIs) [$VGW_CORS_ALLOW_ORIGIN]
The cors-allow-origin option sets a default CORS (Cross-Origin Resource Sharing) Access-Control-Allow-Origin header value. This is applied when no bucket-specific CORS configuration exists, and is also used for admin API responses. This is useful for allowing web applications from specific domains to access the gateway.
--cert value TLS cert file [$VGW_CERT]
--key value TLS key file [$VGW_KEY]
The cert and key values are optional. When not specified, the server will not use TLS. To enable TLS connections, both cert and key must be provided. The value for these options are the filenames for the respective options. The files must contain PEM encoded data. The certificate file may contain intermediate certificates following the leaf certificate to form a certificate chain.
--admin-port value, --ap value gateway admin server listen address: <ip>:<port>, :<port>, /path/to/socket for file-backed UNIX sockets, or @name for Linux abstract namespace sockets (can be specified multiple times) [$VGW_ADMIN_PORT]
--admin-cert value TLS cert file for admin server [$VGW_ADMIN_CERT]
--admin-cert-key value TLS key file for admin server [$VGW_ADMIN_CERT_KEY]
The admin server endpoint can optionally be set to listen on a different interface, port, or UNIX socket than the S3 service. This allows for better control of firewall restrictions to the admin endpoint. The option supports the same address forms as --port and can be specified multiple times to listen on multiple addresses. The certs for this can be different certs than specified for the S3 service.
The default when these are not specified is to have the admin server listen on the same endpoint as the S3 service.
--admin-max-connections value, --amc value maximum number of concurrent connections s3 admin server may handle (default: 250000) [$VGW_ADMIN_MAX_CONNECTIONS]
--admin-max-requests value, --amr value maximum number of in-flight requests s3 admin server may handle (default: 100000) [$VGW_ADMIN_MAX_REQUESTS]
These options apply the same connection and in-flight request limits as --max-connections and --max-requests, but specifically for the admin API server. They allow independent tuning of the admin server's concurrency limits separate from the S3 API server.
--virtual-domain value, --vd value enables the virtual host style bucket addressing with the specified arg as the base domain [$VGW_VIRTUAL_DOMAIN]
The virtual domain option enables the virtual host style bucket addressing. The path style addressing is the default, and remains enabled even when virtual host style is enabled. The virtual domain option specifies the domain name that will be used for the virtual host style addressing. For virtual addressing, access to a bucket is in the request form:
https://<bucket>.<VGW_VIRTUAL_DOMAIN>/
for example: https://mybucket.example.com/ where virtual domain option is set to example.com and all subdomains of the virtual domain should be reserved for buckets. This means that virtual host addressing will generally require a DNS entry for each bucket that needs to be accessed. The default path style request is of the form:
https://<VGW_ENDPOINT>/<bucket>
--disable-acl, --noacl disables gateway ACLs, by ignoring all ACL headers (default: false) [$VGW_DISABLE_ACL]
The --disable-acl option disables all bucket ACL (Access Control List) processing in the gateway. When set, all ACL-related request headers are ignored and no ACL enforcement is performed. This option is useful for backends that do not support storing ACL metadata.
--quiet, -q silence stdout request logging output (default: false) [$VGW_QUIET]
The quiet option will silence the request info output enabled by default to stdout.
--access-log value enable server access logging to specified file [$LOGFILE, $VGW_ACCESS_LOG]
The access-log value is optional. When defined, the server will write s3 server access log output to the specified file. It is suggested to use absolute paths for the server log file because the server may chdir into the backend root directory and change locations for relative paths. This option can also be set through LOGFILE env var. This option can only be set if log-webhook-url is not set. See LogFile for more details and log format.
--admin-access-log value enable admin server access logging to specified file [$LOGFILE, $VGW_ADMIN_ACCESS_LOG]
The admin-access-log is similar to the access-log option, but is logging access to the versitygw admin API generally used for user management and bucket ownership.
--log-webhook-url value webhook url to send the audit logs [$WEBHOOK, $VGW_LOG_WEBHOOK_URL]
The log-webhook-url is optional. When defined, the server will send s3 server access log entries to the provided webhook URL formatted as JSON. This option can also be set through the WEBHOOK or VGW_LOG_WEBHOOK_URL environment variables. This option can only be set if access-log is not set. See Webhook for more details and log format.
--socket-perm value file permissions for file-backed UNIX domain sockets (octal, e.g. '0660'); ignored for TCP/IP and abstract namespace sockets [$VGW_SOCKET_PERM]
The --socket-perm option sets the file mode used when the gateway creates file-backed UNIX domain sockets for --port, --admin-port, --webui, or --website. The value must be an octal permission string such as 0660. This option has no effect for TCP listeners or Linux abstract namespace sockets.
--health value health check endpoint path. Health endpoint will be configured on GET http method: GET <health>
NOTICE: the path has to be specified with '/'. e.g /health [$VGW_HEALTH]
The health option specifies a health check endpoint often used for load balancers to verify the gateway is alive. The health endpoint masks any bucket with this setting. For example, if the health endpoint is set to /health, the gateway will not allow creating or listing contents of a bucket called health. The health endpoint is unauthenticated, and returns a 200 status for GET.
--event-kafka-url value, --eku value kafka server url to send the bucket notifications. [$VGW_EVENT_KAFKA_URL]
--event-kafka-topic value, --ekt value kafka server pub-sub topic to send the bucket notifications to [$VGW_EVENT_KAFKA_TOPIC]
--event-kafka-key value, --ekk value kafka server put-sub topic key to send the bucket notifications to [$VGW_EVENT_KAFKA_KEY]
Bucket events can be sent to a kafka message bus. When event-kafka-url, event-kafka-topic, and optionally event-kafka-key are specified, all configured bucket events will be sent to the kafka service. See Events-Notifications for more details and format.
--event-nats-url value, --enu value nats server url to send the bucket notifications [$VGW_EVENT_NATS_URL]
--event-nats-topic value, --ent value nats server pub-sub topic to send the bucket notifications to [$VGW_EVENT_NATS_TOPIC]
Bucket events can be sent to a NATS messaging service. When event-nats-url and event-nats-topic are specified, all configured bucket events will be sent to the NATS messaging service. See Events-Notifications for more details and format.
--event-rabbitmq-url value, --eru value rabbitmq server url to send the bucket notifications (amqp or amqps scheme) [$VGW_EVENT_RABBITMQ_URL]
--event-rabbitmq-exchange value, --ere value rabbitmq exchange to publish bucket notifications to (blank for default) [$VGW_EVENT_RABBITMQ_EXCHANGE]
--event-rabbitmq-routing-key value, --errk value rabbitmq routing key when publishing bucket notifications (defaults to bucket name when blank) [$VGW_EVENT_RABBITMQ_ROUTING_KEY]
Bucket events can be sent to a RabbitMQ messaging service. When event-rabbitmq-url is specified, all configured bucket events will be sent to the RabbitMQ service. The exchange and routing key are optional parameters that allow for more granular message routing. If the routing key is not specified, it defaults to the bucket name. See Events-Notifications for more details and format.
--event-webhook-url value, --ewu value webhook url to send bucket notifications [$VGW_EVENT_WEBHOOK_URL]
Bucket events can be sent to a webhook URL. When event-webhook-url is specified, all configured bucket events will be sent to the configured webhook endpoint. See Events-Notifications for more details and format.
--event-filter value, --ef value bucket event notifications filters configuration file path [$VGW_EVENT_FILTER]
Bucket events can be filtered using the notifications filters configuration file to only send configured events to the enabled event service. This is used in conjunction with one of the service event options. See Events-Notifications for more details and format.
--iam-dir value if defined, run internal iam service within this directory [$VGW_IAM_DIR]
The iam-dir option will enable the internal IAM service with accounts stored in a file under the specified directory. This is provided to minimize dependencies on outside services for basic functionality. The local account files are plain text and only protected with file permissions. This IAM service is added for convenience, but is not considered as secure or scalable as a dedicated IAM service. See Multi-Tenant for more details.
--iam-ldap-url value ldap server url to store iam data [$VGW_IAM_LDAP_URL]
--iam-ldap-bind-dn value ldap server binding dn, example: 'cn=admin,dc=example,dc=com' [$VGW_IAM_LDAP_BIND_DN]
--iam-ldap-bind-pass value ldap server user password [$VGW_IAM_LDAP_BIND_PASS]
--iam-ldap-query-base value ldap server destination query, example: 'ou=iam,dc=example,dc=com' [$VGW_IAM_LDAP_QUERY_BASE]
--iam-ldap-object-classes value ldap server object classes used to store the data. provide it as comma separated string, example: 'top,person' [$VGW_IAM_LDAP_OBJECT_CLASSES]
--iam-ldap-access-atr value ldap server user access key id attribute name [$VGW_IAM_LDAP_ACCESS_ATR]
--iam-ldap-secret-atr value ldap server user secret access key attribute name [$VGW_IAM_LDAP_SECRET_ATR]
--iam-ldap-role-atr value ldap server user role attribute name [$VGW_IAM_LDAP_ROLE_ATR]
--iam-ldap-user-id-atr value ldap server user id attribute name [$VGW_IAM_LDAP_USER_ID_ATR]
--iam-ldap-group-id-atr value ldap server user group id attribute name [$VGW_IAM_LDAP_GROUP_ID_ATR]
--iam-ldap-project-id-atr value ldap server user project id attribute name [$VGW_IAM_LDAP_PROJECT_ID_ATR]
--iam-ldap-tls-skip-verify disable TLS certificate verification for LDAP connections (insecure, for self-signed certificates) (default: false) [$VGW_IAM_LDAP_TLS_SKIP_VERIFY]
The ldap options will enable the LDAP IAM service with accounts stored in an external LDAP service. The iam-ldap-access-atr, iam-ldap-secret-atr, and iam-ldap-role-atr define the LDAP attributes that map to access, secret credentials and role respectively. The iam-ldap-tls-skip-verify option disables TLS certificate verification, which is useful for development environments with self-signed certificates but should not be used in production. See Multi-Tenant for more details.
--iam-vault-endpoint-url value vault server url [$VGW_IAM_VAULT_ENDPOINT_URL]
--iam-vault-namespace value vault server namespace [$VGW_IAM_VAULT_NAMESPACE]
--iam-vault-secret-storage-path value vault server secret storage path [$VGW_IAM_VAULT_SECRET_STORAGE_PATH]
--iam-vault-secret-storage-namespace value vault server secret storage namespace [$VGW_IAM_VAULT_SECRET_STORAGE_NAMESPACE]
--iam-vault-auth-method value vault server auth method [$VGW_IAM_VAULT_AUTH_METHOD]
--iam-vault-auth-namespace value vault server auth namespace [$VGW_IAM_VAULT_AUTH_NAMESPACE]
--iam-vault-mount-path value vault server mount path [$VGW_IAM_VAULT_MOUNT_PATH]
--iam-vault-root-token value vault server root token [$VGW_IAM_VAULT_ROOT_TOKEN]
--iam-vault-role-id value vault server user role id [$VGW_IAM_VAULT_ROLE_ID]
--iam-vault-role-secret value vault server user role secret [$VGW_IAM_VAULT_ROLE_SECRET]
--iam-vault-server_cert value vault server TLS certificate [$VGW_IAM_VAULT_SERVER_CERT]
--iam-vault-client_cert value vault client TLS certificate [$VGW_IAM_VAULT_CLIENT_CERT]
--iam-vault-client_cert_key value vault client TLS certificate key [$VGW_IAM_VAULT_CLIENT_CERT_KEY]
The Vault IAM options enable the HashiCorp Vault IAM service with accounts stored in a Vault server. This service stores IAM credentials in the kv-v2 engine and supports root token authentication (not recommended for production) and role-based authentication. The gateway uses the access key as the key and stores the JSON serialized account data as the value. This IAM service is intended to be managed through the versitygw admin commands similar to the internal IAM service. See IAM-Vault for more details and configuration examples.
--s3-iam-access value s3 IAM access key [$VGW_S3_IAM_ACCESS_KEY]
--s3-iam-secret value s3 IAM secret key [$VGW_S3_IAM_SECRET_KEY]
--s3-iam-region value s3 IAM region (default: "us-east-1") [$VGW_S3_IAM_REGION]
--s3-iam-bucket value s3 IAM bucket [$VGW_S3_IAM_BUCKET]
--s3-iam-endpoint value s3 IAM endpoint [$VGW_S3_IAM_ENDPOINT]
--s3-iam-noverify s3 IAM disable ssl verification (default: false) [$VGW_S3_IAM_NO_VERIFY]
The S3 IAM service is similar to the internal IAM service, but instead stores the account information JSON encoded in an S3 object. This should use a bucket that is not accessible to general users when using s3 backend to prevent access to account credentials. This IAM service is added for convenience, but is not considered as secure or scalable as a dedicated IAM service. See Multi-Tenant for more details.
--ipa-host value FreeIPA server url e.g. https://ipa.example.test [$VGW_IPA_HOST]
--ipa-vault-name value A name of the user vault containing their secret [$VGW_IPA_VAULT_NAME]
--ipa-user value Username used to connect to FreeIPA. Needs permissions to read user vault contents [$VGW_IPA_USER]
--ipa-password value Password of the user used to connect to FreeIPA. [$VGW_IPA_PASSWORD]
--ipa-insecure Disable TLS certificate verification for the FreeIPA server (insecure, for self-signed certificates) (default: false) [$VGW_IPA_INSECURE]
The ipa options will enable the FreeIPA IAM service. This service does not allow user management through versitygw admin commands, and instead requires accounts be directly managed in the FreeIPA server. See Multi-Tenant for more details.
--iam-cache-disable disable local iam cache (default: false) [$VGW_IAM_CACHE_DISABLE]
--iam-cache-ttl value local iam cache entry ttl (seconds) (default: 120) [$VGW_IAM_CACHE_TTL]
--iam-cache-prune value local iam cache cleanup interval (seconds) (default: 3600) [$VGW_IAM_CACHE_PRUNE]
--iam-debug enable IAM debug output (default: false) [$VGW_IAM_DEBUG]
The IAM cache is intended to ease the load on the IAM service and increase the Gateway performance by caching accounts and credentials for the TTL time interval. Disabling this will cause a request to the configured IAM service for each incoming request to retrieve the corresponding account credentials. The cache is enabled by default. The TTL specifies how long to cache credentials, and the prune value determines the interval for expired entries to be removed from the cache. Increasing the TTL may lessen the load on the IAM service backend, but may have out of date account info until the next interval. Increasing the prune value may reduce memory use at the cost of added CPU to check cache expirations. See Multi-Tenant for more details.
--readonly allow only read operations across all the gateway (default: false) [$VGW_READ_ONLY]
The read only option disables all write actions through the gateway. This will only allow S3 API calls that do not change any data in the backend storage system. All API calls that attempt to create, upload, or delete objects through the gateway will get AccessDenied (HTTP Forbidden/403).
--disable-strict-bucket-names allow relaxed bucket naming (disables strict validation checks) (default: false) [$VGW_DISABLE_STRICT_BUCKET_NAMES]
The disable-strict-bucket-names option allows for more relaxed bucket naming conventions. By default, the gateway enforces strict bucket naming rules following AWS S3 standards (e.g., lowercase letters, numbers, hyphens, 3-63 characters). When this option is enabled, these strict validation checks are disabled to allow for more flexible bucket names that may not conform to AWS standards but are needed for compatibility with certain backends or legacy systems.
--mp-max-parts value maximum number of parts allowed in a multipart upload (default: 10000) [$VGW_MP_MAX_PARTS]
--copy-object-threshold value maximum allowed source object size in bytes for CopyObject; objects larger than this are rejected (default: 5368709120) [$VGW_COPY_OBJECT_THRESHOLD]
The --mp-max-parts option sets the maximum number of parts allowed in a multipart upload. The default of 10,000 matches the AWS S3 limit. The --copy-object-threshold option sets the maximum source object size in bytes for the CopyObject API; requests to copy objects larger than this threshold will be rejected. The default is 5 GiB (5,368,709,120 bytes), matching the AWS S3 limit for single-operation CopyObject.
--metrics-service-name value, --msn value service name tag for metrics, hostname if blank [$VGW_METRICS_SERVICE_NAME]
Optional when enabling a metrics endpoint, setting the metrics-service-name will override the default hostname for service name metrics tag. By default all metrics are tagged with "service"=$HOSTNAME. See Metrics for more details.
--metrics-statsd-servers value, --mss value StatsD server urls comma separated. e.g. 'statsd1.example.com:8125,statsd2.example.com:8125' [$VGW_METRICS_STATSD_SERVERS]
Setting metrics-statsd-servers enables sending StatsD metrics to the provided endpoints. The StatsD metrics are sent using InfluxDB flavor StatsD tags. The value for this option is a comma separated list of all endpoints that metrics should be sent to. See Metrics for more details.
--metrics-dogstatsd-servers value, --mds value DogStatsD server urls comma separated. e.g. '127.0.0.1:8125,dogstats.example.com:8125' [$VGW_METRICS_DOGSTATS_SERVERS]
Setting metrics-dogstatsd-servers enables sending DataDog DogStatsD StatsD metrics to the provided endpoints. The value for this option is a comma separated list of all endpoints that metrics should be sent to. The typical value for this would be the local DataDog agent listening on 127.0.0.1:8125. See Metrics for more details.
--debug enable debug output (default: false) [$VGW_DEBUG]
The debug option will print debug output such as request signing information.
--pprof value enable pprof debug on specified port [$VGW_PPROF]
The pprof option enables the pprof HTTP server for profiling the gateway while the process is running. See Profiling for more information.
--keep-alive enable keep-alive connections (for finicky clients) (default: false) [$VGW_KEEP_ALIVE]
The keep-alive option enables HTTP keep-alive connections. By default, the gateway disables keep-alive to ensure compatibility with a wide range of S3 clients. However, some clients may benefit from keep-alive being enabled. Use this option if you experience connection issues with specific S3 clients.
--help, -h show help
The help option prints the command usage and exits.
