[Bug report] MinIO integration tests fail: minio/minio is no longer available on Docker Hub

[nevzheng]

Version

main branch

Describe what's wrong

Integration tests that start MinIOContainer fail because the image minio/minio:RELEASE.2025-09-07T16-13-09Z can no longer be pulled from Docker Hub. The minio/minio and minio/mc repositories return 404 from the Docker Hub API, while the minio organization still exists. The same release is available on quay.io. This fails Backend Integration Test (FilesetS3TokenConnectionIT) for every PR since 2026-09-12; IcebergRESTMinIOTokenAuthorizationIT uses the same container.

Error message and/or stacktrace

FilesetS3TokenConnectionIT > initializationError FAILED
    java.lang.RuntimeException: Failed to start MinIO container
        org.testcontainers.containers.ContainerFetchException: Can't get Docker image: RemoteDockerImage(imageName=minio/minio:RELEASE.2025-09-07T16-13-09Z, ...)
            com.github.dockerjava.api.exception.NotFoundException: Status 404: {"message":"pull access denied for minio/minio, repository does not exist or may require 'docker login'"}

How to reproduce

docker pull minio/minio:RELEASE.2025-09-07T16-13-09Z          # pull access denied
docker pull quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z  # succeeds

Additional context

The image is referenced only in integration-test-common/src/test/java/org/apache/gravitino/integration/test/container/MinIOContainer.java (DEFAULT_IMAGE). The last passing Backend Integration Test on main ran at 2026-09-12 02:28 UTC.

[nevzheng]

Proposed action

1. Short term: point MinIOContainer.DEFAULT_IMAGE at quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z, the same release from MinIO's own quay.io organization. This matches what other Apache projects merged this week: Build: Pull MinIO images from Quay iceberg#18071, ci: pull MinIO images from Quay iceberg-rust#3202, ci: use Quay and GitHub releases for MinIO iceberg-cpp#933 and [fix](ci) Pull the MinIO images from quay.io instead of Docker Hub doris#67897. The quay.io images are no longer maintained (MinIO's community edition is source-only since April 2026), so this is a temporary fix. PR to follow.
2. Longer term: follow the Iceberg community's discussion about moving off MinIO (dev@iceberg [DISCUSS] "Switching S3 test backend", https://lists.apache.org/thread/k5hjjtmj1z3gdwtrlf4v5ovz1wp1p14q; Replace MinIO with RustFS in Iceberg Quickstart due to maintenance and security concerns iceberg#14638; Replace MinIO with SeaweedFS in quickstart and docker-compose iceberg#15577). Polaris and PyIceberg reportedly use RustFS, and SeaweedFS was proposed for Iceberg. Any replacement has to enforce STS AssumeRole session policies, since our credential-vending tests check the read-only downgrade.
3. Option: mirror the pinned image into a namespace we control (Doris mentioned a similar option). MinIO is AGPLv3, so that would need a licensing check first.

@jerryshao @roryqi does this direction work for you?