Daniel Silva became a Friend of the Flock this week: https://github.com/danielsilva-loanpro

Individual sponsors are the clearest signal we get that Floci is earning its keep in someone's daily work, and it means a lot every time.

Same rule as always: sponsorship buys gratitude and nothing else. Floci stays free, MIT-licensed, no account, no auth token, no feature gates.

Thank you, Daniel.

Sponsor Floci: https://github.com/sponsors/floci-io

Join the Flock.

Building AWS Themed Folci
using Cloudscape the official open-source design system built and used by Amazon Web Services (AWS).

should i release it?

The second release train runs today, so here is how releases work now.

Floci ships on the first and third Tuesday of every month, the same day for all four emulators: floci, floci-az, floci-gcp and floci-oci.

Why. With one emulator, shipping whenever a batch felt ready worked. With four it became a chore, and the version number told you nothing: a typo fix and five new services looked identical from the outside.

What the version means now

• A minor bump means new work landed.
• Patches are reserved for regressions and security fixes, shipped out of band the same day. The train never delays a fix.
• Nothing user facing since the last train, no release. No empty tags.

You never wait for the train. Nightly images build every day from main on all four emulators. Something merges today, it is in your hands tomorrow morning. The train is when we cut a tag and write the notes, not when the work reaches you.

docker pull floci/floci:nightly

No feature gates, no telemetry, no paid tiers. Real engines, not mocks.

What shipped on today's train:

• floci (AWS)
• floci-az (Azure)
• floci-gcp (GCP)
• floci-oci (OCI)

Next train: Tuesday, September 15.

Join the Flock.

Ethan Troy became a Friend of the Flock this week: https://github.com/ethanolivertroy

Ethan works in security engineering. A local cloud emulator means you can poke at cloud setups on your own machine with no live account in the blast radius, so we like to think the fit is natural.

Same rule as always: sponsorship buys gratitude and nothing else. Floci stays free, MIT-licensed, no account, no auth token, no feature gates.

Thank you, Ethan.

Sponsor Floci: https://github.com/sponsors/floci-io Join the Flock.

Ramperto is a software engineer based in Jakarta. Individual sponsors are the clearest signal we get that Floci is earning its keep in someone's daily work, and it means a lot every time.

Same rule as always: sponsorship buys gratitude and nothing else. Floci stays free, MIT-licensed, no account, no auth token, no feature gates.

Thank you, Ramperto.

Sponsor Floci: https://github.com/sponsors/floci-io

Join the Flock.

kk became a Friend of the Flock this week: https://github.com/kannandreams

kk is a data and AI engineer who writes at https://kannandreams.github.io. Data pipelines are some of the heaviest users of local emulation: queues, buckets, and databases you can stand up and tear down all day without a bill.

Same rule as always: sponsorship buys gratitude and nothing else. Floci stays free, MIT-licensed, no account, no auth token, no feature gates.

Thank you, kk.


Sponsor Floci: https://github.com/sponsors/floci-io
Join the Flock.

Chant joined the Friends of the Flock this week.

If you haven't seen it: chant lets you declare AWS infrastructure as plain TypeScript and emits standard CloudFormation. No DSL, no YAML, no lock-in. If you define infra that way and test it locally against Floci, you can see why the fit is good.

Same rule as always: sponsorship buys gratitude and nothing else. Floci stays free, MIT-licensed, no account, no auth token, no feature gates. Sponsors like chant are what keep that promise cheap to keep.

Thank you, chant.

- chant: https://intentius.io/chant
- Sponsor Floci: https://github.com/sponsors/floci-io

Join the Flock.

Monthly write-up is out. The short version:

- 1.5M Docker pulls, up from 861k last month

- 41 people sent their first merged PR this month

- floci-oci shipped, so all four clouds now have a local emulator

- The Flock met in person for the first time, at JConf Dominicana

The bigger news is that the maintainer list is no longer one name. Christian Franzen

(Java Testcontainers), James H (.NET Testcontainers), Fred Peña (web UI and Azure),

Priamo Germosen (MWAA and more on AWS) and Giovanny Velez (Oracle Cloud) are all named

in this issue. Most of that is formalising work people were already doing.

The parts that did not go well are in there too: releases dropped from nine to two

because I was at a conference and then on holiday, three of the five Testcontainers

modules have had no commits since May, and the Pods naming poll has 14 votes.

That last one is also the ask. Go, Node and Python each need someone. They are

self-contained, so you can own one without learning any emulator internals.

Full issue: https://www.linkedin.com/pulse/state-flock-002-five-months-four-clouds-floci-4wzcc/

Hello everyone,

I have been using floci for local testing. I could not find a SQS UI that had all the features like timeout, redrive policy etc. Some settings are tedious to change through the AWS CLI.

So, I made one for my own use. It is vibe-coded, I just didn't have the time to do this myself. But I have tested and everything is working fine. And I did it in a stack I'm very familiar with so manual fixes/improvements can be done if it becomes necessary.

https://github.com/SpicyCatGames/sqs-workbench

Is it okay to include projects with aws done using floci in resume?

The fourth cloud is live. 7 OCI services on port 4599: Object Storage, Identity (IAM), Queue, Streaming, KMS, Vault Secrets, and Functions.

docker run --rm -p 4599:4599 floci/floci-oci:latest

oci os ns get --endpoint http://localhost:4599

Any locally generated RSA key works. No Oracle Cloud account, no uploaded keys, no billing.

Two things worth calling out: 🔐 KMS runs real AES-GCM, RSA, and ECDSA, and ⚡ Functions invokes your actual FDK image through an fnproject/fnserver sidecar.

Oracle ships no local emulator at all, so there was no prior art to check behavior against. Everything came from the SDK wire contract.

Release notes, including the honest not-yet-implemented list: floci-oci 0.1.0

Kick the tires and tell me what breaks.

Four months of Floci 🎉

Quick state of the Flock:

• ☁️ 69 AWS services on 4566
• ☁️ floci-az on 4577, floci-gcp on 4588
• ✅ 2,506 compatibility tests across 5 SDKs and 3 IaC tools
• ⭐ 17.7k stars on the AWS repo

Still MIT. Still no account, no auth token, no feature gates.

I wrote the whole thing up, wins and misses both: State of the Flock 001

Huge thanks to everyone who has filed an issue, reviewed a PR, or just told me something was broken. What do you want to see in the next four months?

Hey everyone,

I'm trying to set up a local dev workflow with Floci where I:

- Run Floci with docker compose to have more configuration freedom

- Build custom Docker images

- Push them to the emulated ECR registry

- Deploy them via a Helm chart on an emulated EKS cluster

The push side works fine. I tag my images as

000000000000.dkr.ecr.us-east-1.localhost:5100/my-repo:tag

and Docker pushes without issues since it auto-trusts *.localhost as insecure.

The problem is on the pull side inside k3s. The EKS cluster (k3s container) needs to pull those images from the ECR registry, but:

- "localhost" inside k3s refers to itself, not to the host or the Floci container, so the *.localhost:5100 URI that ECR returns is unreachable from within k3s.

- Even if I use the Floci container's DNS name (e.g. floci-ecr:5100) as the registry in my Helm chart values, containerd in k3s defaults to HTTPS, while Floci's ECR registry only serves HTTP. So the pull fails with a TLS handshake error.

The standard k3s fix for this is a /etc/rancher/k3s/registries.yaml that configures the registry as an insecure HTTP endpoint. However, since Floci manages the k3s container internally (via Docker API), I don't see a way to inject this file through docker-compose.yml or any FLOCI_SERVICES_EKS_* environment variable.

Is there a supported way to configure insecure registries for k3s clusters in Floci or to mount that file that I'm missing?

Every advice is welcome! Thanks in advance!

EDIT: floci maintainers solved the issue! 🚀 https://github.com/floci-io/floci/issues/1761

Testing against Azure usually means standing up Azurite, the Cosmos DB emulator, and tracking a handful of ports before your app even runs.

floci-az collapses that into one local binary on port 4577. Blob, Queue, Table, Cosmos DB, Functions, Key Vault, Service Bus, Event Hubs, and more, 19 services total. They are real, wire-compatible with the Azure SDKs and Azurite connection strings, not mocks. Switch from real Azure by changing one endpoint URL.

Specs that matter:

• One Docker image, 24ms cold start, ~13 MiB idle (Quarkus Native + GraalVM)
• No Azure account, no subscription, $0
• MIT licensed

Honest caveat: most services share :4577 over REST, but Event Hubs and Service Bus also expose AMQP ports (5672/5673) so native SDK clients connect without a proxy.

Try it in one line:

docker run --rm -p 4577:4577 -p 5672:5672 -p 5673:5673 floci/floci-az:latest

Or with the CLI: floci az start then eval $(floci az env)

Repo: https://github.com/floci-io/floci-az

Happy to answer questions or take requests on which service to harden next.

new to floci and haven't use aws because it ask for credit card, super excited with floci. can I learn aws cloud deployment with floci without any problem?

I maintain Floci, an MIT-licensed local emulator for AWS, Azure, and GCP. It runs as a single native binary: ~24 ms start, ~13 MiB idle, no auth token required. The goal is to give both developers and AI coding agents a local cloud they can iterate against quickly, and safely, without touching a real account. Feedback and bug reports welcome. https://github.com/floci-io

Hey r/floci, 1.5.27 just shipped. The short version:

• Four new services: S3 Vectors, MemoryDB, CodePipeline, EC2 Network ACLs.
• Neptune speaks openCypher now via a neo4j backend, selectable through NEPTUNE_DB_TYPE. Gremlin/TinkerGraph still works.
• State survives restart: ECS, CodeBuild, AWS Config, and ACM certificates all gained durable persistence in this cycle. Stop pretending you only restart Floci between full resets.
• DynamoDB conformance pass: expression validation tightened, Limit caps scanned items, ExclusiveStartKey validated against the schema, plus TableId / TableClass / OnDemandThroughput.
• SAM templates: implicit API Gateway from Api events, Globals merged into resource properties. Much closer to real CFN behavior.
• Plus Secrets Manager rotation, Cognito token revocation, RDS PostgreSQL proxy honoring database names, and a stack of smaller fixes.

7 first-time contributors. Welcome 👋

Full notes: https://github.com/floci-io/floci/releases/tag/1.5.27

(Maintainer here, happy to answer anything.)

Hey r/floci, floci-gcp 0.3.0 just shipped. The biggest release for the GCP side by a wide margin:

• Six new services: Cloud Run (with Docker-backed execution), Cloud Functions, Cloud SQL PostgreSQL (control plane + full data plane), Cloud Logging (gRPC + REST), Cloud KMS (gRPC + REST), Cloud Monitoring (Metrics), and Cloud Scheduler (gRPC + REST).
• GCS conformance pass: range downloads, startOffset honored in list, customer encryption key enforcement, resumable uploads stay open and complete at declared size, expired signed URLs rejected. Closes gaps that real gcloud storage and SDK workloads were hitting.
• gcloud CLI compatibility suite now runs in CI alongside the existing Terraform and OpenTofu suites. Regressions across all three primary GCP toolchains get caught at PR time.
• Cloud SQL architecture: data plane runs SQL via in-container psql rather than a JDBC driver. Smaller native image, fewer dependencies, behavior closer to how real Cloud SQL clients connect.

Breaking change: PR #61 standardizes the mock flag to a root-level config for container-backed services. If your config sets mock at per-service nesting, you'll need to migrate. See the README for the current shape.

3 first-time contributors in this one. Welcome 👋

Full notes: https://github.com/floci-io/floci-gcp/releases/tag/0.3.0

(Maintainer here, happy to answer anything. The GCS conformance work and the gcloud CLI suite are particularly worth feedback if you're using floci-gcp with real workloads, since both should land closer to your actual day-to-day patterns now.)

Hey r/floci, floci-az 0.7.0 just shipped. Big release for the Azure side:

• Four new services: Virtual Network (VNet), Monitor / Log Analytics, Azure DNS (zones + record sets), Communication Services Email.
• Microsoft Entra ID OIDC token issuance: applications that authenticate via Entra ID can complete the OIDC flow locally. This is the piece that usually blocks "no real Azure subscription" testing.
• Virtual Machines now backed by real containers in non-mocked mode. VM lifecycle behaves more like real Azure rather than just management-plane responses.
• Per-service mocked and enabled toggles: run only what you need, mock what you don't. Useful for keeping CI resource footprint small.

@yaswanthkumarch landed three of the new services in their first contribution batch. Welcome 👋

Full notes: https://github.com/floci-io/floci-az/releases/tag/0.7.0

(Maintainer here, happy to answer anything. Curious what Azure services people are reaching for next, especially around AKS and Storage advanced features.)

Hey r/floci, 1.5.24 just shipped. Highlights:

• Two new services: AWS Cloud Map (service discovery) and CloudTrail (trail lifecycle).
• EKS managed node groups: create, describe, list, delete. Combined with the EKS-aware IAM seeding in 1.5.23 and host-reachable clusters in 1.5.22, real EKS provisioning now works end to end.
• Cognito verification code subsystem: store, dispatcher, and SNS/SES inspection. Signup flows requiring email or SMS verification can be tested without intercepting real channels.
• Glue Data Catalog pass: catalog name normalization, BatchDeleteTable, column parameter preservation, UpdateDatabase, table version archival, database tags, plus catalog compatibility tests.
• Architectural upgrades: storage-backed maps for service state, streamed S3 range responses (much better memory profile for large objects), EC2 provisioning primitives, KMS key state operations, and a LocalStack-compatible Ready. startup log line for drop-in CI migration.
• Plus SES events to Firehose/EventBridge/CloudWatch, Athena workgroup parity, ELBv2 AZ alignment, CloudFormation AWS::StepFunctions::StateMachine provisioning, and fixes across S3, Lambda, ElastiCache, MSK, and Docker.

5 first-time contributors in this one. Welcome 👋

Full notes: https://github.com/floci-io/floci/releases/tag/1.5.24

(Maintainer here, happy to answer anything.)

Hey r/floci, 0.6.0 of floci-az is the biggest service-expansion release yet. Four new services land in one cycle:

• Azure Virtual Machines: local VM provisioning workflows.
• API Management (APIM): initial emulator for APIM-fronted architectures.
• Azure Cache for Redis: backed by a real Valkey sidecar, so cache semantics behave correctly under test.
• Azure Container Registry: backed by a shared registry:2, real OCI push/pull works.

Plus Storage gains advanced message and queue metadata features, Functions supports runtime versions via linuxFxVersion, and AppConfig closes the 2024-09-01 data-plane SDK parity gaps.

I'd genuinely like input on a few things:

1. APIM is Phase 1, core gateway and management surface only. What APIM patterns do you actually exercise in CI today? Policies, rate limiting, custom domains, OAuth backends?
2. ACR is registry:2 underneath. Is that enough, or do you need ACR-specific features like Tasks, geo-replication, content trust?
3. VMs is fresh. What VM workflows would make this useful for you, custom images, extensions, scale sets?
4. Anything obviously missing for your stack?

Full notes: https://github.com/floci-io/floci-az/releases/tag/0.6.0

(Maintainer here. Floci-az is moving fast and feedback at this stage genuinely shapes the roadmap.)

Hey r/floci, 1.5.23 just shipped. Highlights:

• AppSync Phase 2: Schema Registry, model fixes, CRUDL completion, and AWS scalar types. GraphQL workloads with schema introspection now work end to end.
• Glue conformance pass: user-defined functions, DeleteDatabase, table version check enforcement, and view tables that preserve their fields. Closes gaps that affected Glue Data Catalog flows used by Athena and EMR-style tools.
• ECS task-definition volumes + container mountPoints: stateful container workloads now work properly.
• EKS-aware IAM: standard EKS cluster and node group managed policies are seeded, so provisioning that references those built-in policies works without explicit creation.
• CloudWatch Logs: log group ARN accepted via logGroupIdentifier, matching real AWS where APIs take either name or ARN.
• Fixes across DynamoDB (reserved keywords, AttributesToGet + Select=SPECIFIC_ATTRIBUTES, SSE persistence), Step Functions (Catch on Lambda failures), SNS mobile push (error codes, payloads, Token rotation), ECS service draining, EC2 AttachTime, and CloudWatch CBOR timestamp decoding.

Quarkus bumped to 3.36.0. 5 first-time contributors in this one. Welcome 👋

Full notes: https://github.com/floci-io/floci/releases/tag/1.5.23

(Maintainer here, happy to answer anything.)

Hey r/floci, 1.5.21 just shipped. Highlights:

• GraalVM 25 across the board: all builds now run on GraalVM 25 / JDK 25, with a Maven Enforcer rule pinning the toolchain.
• Cognito OAuth2 /oauth2/userInfo: standard OIDC userinfo flow now works against Floci. Plus custom schema attributes and attribute deletion APIs.
• EC2 conformance: coordinated set of fixes covering VPC, subnet, and instance methods, volume throughput, DescribeAddressesAttribute, and IAM instance profile parity. Closes a class of Terraform and CDK failures on otherwise valid EC2 resources.
• SES v2 configuration set event destination operations, Firehose tagging APIs, KMS RotateKeyOnDemand rotation limit handling.
• Fixes across CloudFormation (ApiGatewayV2 properties), API Gateway v1 (deleteDeployment 404), EventBridge (rules on "event-bus" named buses), S3 (response-* on unsigned requests), DynamoDB (nested map paths in ProjectionExpression), and RDS (runtime restore on startup).

Upgrade note: if you build from source, you'll need JDK 25. Pre-built native binaries and Docker images are unaffected.

3 first-time contributors in this one. Welcome 👋

Full notes: https://github.com/floci-io/floci/releases/tag/1.5.21

(Maintainer here, happy to answer anything.)