Storage is now available in Supabase

Summary

Supabase launched Storage, adding a scalable object store to its existing Postgres, authentication, and API services. Existing open-source storage servers like Ceph, Swift, Minio, and Zenko were evaluated but rejected due to auth incompatibilities and external dependencies like etcd, MongoDB, and Kafka. Consequently, the team implemented a custom Storage API server built with Fastify and TypeScript behind the Kong gateway. Object metadata and access control reside directly in Postgres, leveraging Row Level Security policies written in SQL rather than a proprietary domain-specific language. Objects stream directly to managed backends like AWS S3 using Node streams with minimal in-memory buffering, accompanied by a default one-hour Cache-Control header.

Takeaways

1. 1

   Instead of introducing a custom policy DSL, Supabase Storage leverages Postgres Row Level Security on a dedicated storage schema to evaluate authorization.

2. 2

   Node streams upload objects directly to S3 with minimal in-memory buffering, reducing RAM consumption during large file transfers.

3. 3

   Supabase Storage applies a default Cache-Control header of one hour to retrieved objects to ensure browser caching, which can be overridden.