Supabase Storage

Why it's ranked here

Apache 2.0 licensing puts the real production code in reach of anyone self-hosting the open-source stack, not just customers of the managed product, and what ships here is the literal service behind the paid tier rather than a thin client wrapper. Handling four upload protocols and two swappable backends from one codebase is unusual for infrastructure this size, and deciding read and write access with the same database rules used elsewhere in the stack, instead of a separate policy engine, is a coherent design choice rather than a bolted-on feature. Those fundamentals matter more than any usage count.

What's good

The protocol coverage is genuinely broad for a single service: plain HTTP, resumable chunked uploads for large or flaky connections, a bucket API that existing client tooling for a widely used cloud provider can talk to without changes, and a REST catalog for the table format analytics engines increasingly expect. The upload path supports two independent locking strategies for concurrent resumable transfers, one built on Postgres and one on the object backend itself, so operators can pick whichever fits their existing infrastructure. Authorization threads through as tenant-scoped feature flags rather than being hardcoded, letting individual protocols be switched off per tenant.

Tradeoffs

The bundled local development compose file wires literal placeholder secrets for the authentication token signing key and both access-key pairs directly into the file, normal for a local stack but a reminder that anyone copying it toward a real deployment must replace every one of them. The dependency list pulls in the full cloud provider SDK regardless of whether a deployment ever touches a cloud-compatible backend, since the code path that selects a backend imports both implementations unconditionally. The package's own declared license field does not match the license actually shipped with the repository, a paperwork inconsistency worth a maintainer's attention even though the broader license controls.

How to use it well

Reach for this when self-hosting the open-source stack and needing uploads that survive flaky mobile networks or handle files too large for a single HTTP request: the resumable protocol and configurable size limits are built in. It also suits teams migrating tooling that already speaks a widely used object-storage API, since that surface is implemented directly rather than emulated at the edge. It is not the layer to reach for when the goal is managed storage without operating Postgres and a Fastify service: that is what the hosted product in front of this code exists to provide.

Observed

License

Apache License 2.0 text in the repository root (LICENSE), while package.json's own license field is set to ISC.

Language

Written in TypeScript on top of the Fastify HTTP framework.

Packaging

Packaged both as an npm module with a CLI entry point and as a multi-stage Docker image built from a single Dockerfile.

Interfaces

Supports four protocols in one server: HTTP/REST, TUS resumable upload, an S3-compatible API, and an Iceberg REST catalog.

Structural

Storage backend is swappable between local filesystem and an S3-compatible object store via configuration rather than a build-time choice.

Structural

Bucket, object and authorization metadata are persisted in Postgres rather than a separate datastore.