floci Documentation

Light, fluffy, and always free - The AWS Local Emulator alternative

19,756 stars Java Java 1 file ยท ~12,847 tokens #aws#aws-emulation#devops#docker#ec2#ecs#localstack#s3
RAW Doc

Docker & Self-Hosted Deployment Verified OCI

Deploy floci on any server, homelab, or cloud container platform.

1-Click Terminal Command
bash (docker run)
docker run -d --name floci -p 4566:4566 --restart always floci-io/floci:latest
Configured Services & Ports
โš™๏ธ floci
image: build locally
๐Ÿ”Œ Ports: 4566:4566, 6379-6399:6379-6399, 7001-7099:7001-7099, 9200-9299:9200-9299
docker-compose.yml
yaml (docker-compose.yml)
services:
  floci:
    build:
      context: .
      dockerfile: docker/Dockerfile
    tty: true
    ports:
      - "4566:4566"
      - "6379-6399:6379-6399"
      - "7001-7099:7001-7099"
      - "9200-9299:9200-9299"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./data:/app/data
    environment:
      FLOCI_SERVICES_DOCKER_NETWORK: floci_default
      FLOCI_SERVICES_RDS_PROXY_BASE_PORT: "7001"
      # FLOCI_STORAGE_HOST_PERSISTENT_PATH is no longer needed.
      # Floci now uses named Docker volumes by default.
      # If you were using this env var for persistence, migrate: docker volume ls -f label=floci=true
      FLOCI_HOSTNAME: floci
      FLOCI_BASE_URL: http://floci:4566
      # localhost.floci.io resolves everywhere: public DNS -> 127.0.0.1 on the host
      # (reaching the published proxy ports), the network alias below inside Compose.
      FLOCI_SERVICES_ELASTICACHE_CLUSTER_ANNOUNCE_HOSTNAME: localhost.floci.io
      FLOCI_SERVICES_LAMBDA_HOT_RELOAD_ENABLED: "true"
      # Match the compatibility workflow (.github/workflows/compatibility.yml) so the
      # local Docker test run exercises the same Floci configuration as CI.
      # TLS proxy serves HTTP and HTTPS on the same port 4566 (first-byte sniffing),
      # so no extra port mapping is needed โ€” this is what makes the TLS/HTTPS suites pass.
      FLOCI_TLS_ENABLED: "true"
    networks:
      floci_default:
        aliases:
          - localhost.floci.io

networks:
  floci_default:
    name: floci_default

File: README.md


What is Floci?

Floci is a free, open-source local AWS emulator for development, testing, and CI.

It gives you AWS-shaped services on your machine without requiring a cloud account, an auth token, or paid feature gates. Point your AWS SDK, CLI, Terraform, CDK, OpenTofu, or test suite at http://localhost:4566 and keep your existing workflows.

Floci is named after floccus, the cloud formation that looks like popcorn.

Quick Start

The fastest way to run Floci is with the official CLI

bash
floci start

Export the AWS environment variables:

bash
eval $(floci env)

Use your existing AWS tools normally:

bash
aws s3 mb s3://my-bucket

aws dynamodb create-table \
  --table-name demo-table \
  --attribute-definitions AttributeName=pk,AttributeType=S \
  --key-schema AttributeName=pk,KeyType=HASH \
  --billing-mode PAY_PER_REQUEST

aws dynamodb list-tables

Watch it run

This short demo shows the CLI flow: start Floci, export the local AWS environment, run standard AWS CLI commands, and stop the emulator.

https://github.com/user-attachments/assets/b55714dc-ef36-40ae-a734-cd2cadc288a8

All AWS services are available at http://localhost:4566. Any region works. Credentials can be any non-empty values unless you explicitly enable stricter service-specific auth checks.

Prefer Docker Compose?

Create a compose.yaml file:

yaml
services:
  floci:
    image: floci/floci:latest
    ports:
      - "4566:4566"

Start Floci:

bash
docker compose up

Then configure your AWS environment manually:

bash
export AWS_ENDPOINT_URL=http://localhost:4566
export AWS_DEFAULT_REGION=us-east-1
export AWS_ACCESS_KEY_ID=test
export AWS_SECRET_ACCESS_KEY=test

Using the old hectorvent/floci image?

Update your image name:

yaml
# Before
image: hectorvent/floci:latest

# After
image: floci/floci:latest

The old hectorvent/floci repository no longer receives updates.

Features

Local AWS without the cloud account

Run AWS-compatible services locally without an AWS account, auth token, or paid feature gates.

Real Docker where fidelity matters

Lambda, RDS, Neptune, ElastiCache, MSK, ECS, EC2, EKS, OpenSearch, CodeBuild, and Managed Service for Apache Flink use real Docker-backed execution instead of shallow mocks.

Drop-in AWS compatibility

Point standard AWS clients at http://localhost:4566. Existing credentials, regions, SDKs, CLI commands, and IaC workflows stay familiar.

Fast enough for CI

The native image starts in milliseconds and keeps idle memory low, making it practical for local development and test pipelines.

Configurable persistence

Choose from in-memory, persistent, hybrid, and write-ahead log storage depending on the durability profile you need.

Why Floci?

LocalStack's community edition sunset in March 2026, requiring auth tokens and freezing security updates. Floci is the no-strings-attached alternative.

Capability Floci LocalStack Community
Auth token required No Yes
Security updates Yes Frozen
Startup time ~24 ms ~3.3 s
Idle memory ~13 MiB ~143 MiB
Docker image size ~90 MB ~1.0 GB
License MIT Restricted
API Gateway v2 / HTTP API Yes No
Cognito Yes No
RDS, ElastiCache, MSK Real Docker No
Neptune (graph DB + Gremlin WebSocket) Real Docker No
DocumentDB (MongoDB-compatible) Real Docker No
ECS, EC2, EKS Real Docker No
CodeBuild Real Docker execution No
Native binary ~40 MB No

69 AWS services. Broad coverage. Free forever.

Architecture Overview

mermaid
flowchart LR
    Client["AWS SDK / CLI"]

    subgraph Floci ["Floci, port 4566"]
        Router["HTTP Router\nJAX-RS / Vert.x"]

        subgraph Stateless ["Stateless Services"]
            A["SSM ยท SQS ยท SNS\nIAM ยท STS ยท KMS\nSecrets Manager ยท SES\nCognito ยท Kinesis\nEventBridge ยท Scheduler ยท AppConfig\nCloudWatch ยท Step Functions\nCloudFormation ยท ACM ยท Config ยท CloudTrail\nAPI Gateway ยท AppSync ยท ELB v2 ยท Auto Scaling\nElastic Beanstalk ยท CodeDeploy ยท CodePipeline ยท Backup ยท Bedrock Runtime ยท Route53 ยท Transfer"]
        end

        subgraph Stateful ["Stateful Services"]
            B["S3 ยท DynamoDB\nDynamoDB Streams"]
        end

        subgraph Containers ["Container Services"]
            C["Lambda\nElastiCache\nRDS\nNeptune\nECS\nEC2\nMSK\nEKS\nOpenSearch\nCodeBuild\nManaged Flink"]
            D["Athena -> floci-duck\nDuckDB sidecar"]
        end

        Router --> Stateless
        Router --> Stateful
        Router --> Containers
        Stateless & Stateful --> Store[("StorageBackend\nmemory ยท hybrid ยท persistent ยท wal")]
    end

    Docker["Docker Engine"]
    Client -->|"HTTP :4566\nAWS wire protocol"| Router
    Containers -->|"Docker API\nIAM / SigV4 auth"| Docker

Supported Services

Floci supports local emulation for application services, data services, eventing, identity, infrastructure, billing, and container-backed workloads.

Category Services
Core app services S3, SQS, SNS, DynamoDB, Lambda, IAM, KMS, Secrets Manager, SSM
Events and workflows EventBridge, EventBridge Pipes, EventBridge Scheduler, Step Functions, SWF, CloudWatch Logs, CloudWatch Metrics
API and identity API Gateway REST, API Gateway v2, AppSync, Cognito, ACM, Route53, Cloud Map
Containers and compute ECS, EC2, Lightsail, EKS, MWAA, ECR, CodeBuild, CodeDeploy, CodePipeline, AWS Batch, Auto Scaling, Application Auto Scaling, Elastic Beanstalk, ELB v2
Data, analytics, and AI Athena, Glue, EMR, Firehose, Managed Service for Apache Flink, OpenSearch, S3 Tables, S3 Vectors, Textract, Transcribe, Bedrock Runtime
Databases and caching RDS, RDS Data API, Neptune, DocumentDB, MemoryDB, ElastiCache
Messaging and transfer SES, Kinesis, MSK, Amazon MQ, Transfer Family, IoT Core
Security and governance WAF v2, CloudTrail, CloudFront, Resource Groups Tagging API, CloudHSM v2
Cost and billing Pricing, Cost Explorer, Cost and Usage Reports, BCM Data Exports
Backup and config AWS Backup, AWS Config, AppConfig, AppConfigData, CloudFormation, Cloud Control API

For operation-level compatibility, see the Services Overview.

Detailed service notes

Service How it works Notable features
SSM In-process + EC2 containers Parameter Store (version history, labels, SecureString, tagging); Run Command (SendCommand, GetCommandInvocation, direct EC2 container execution, agent polling)
SQS In-process Standard and FIFO queues, DLQ, visibility timeout, batch operations, tagging
SNS In-process Topics, subscriptions, SQS, Lambda and HTTP delivery, tagging
S3 In-process Versioning, multipart upload, pre-signed URLs, Object Lock, event notifications
S3 Vectors In-process Vector buckets, indexes, put / get / list / delete vectors, cosine similarity queries
DynamoDB In-process GSI, LSI, Query, Scan, TTL, transactions, batch operations; Streams with shard iterators and Lambda event source mapping
Lambda Real Docker Runtime environment, execution model, warm container pool, aliases, Function URLs
API Gateway REST In-process Resources, methods, stages, Lambda proxy, MOCK integrations, AWS integrations
API Gateway v2 In-process HTTP APIs, routes, integrations, JWT authorizers, stages
AppSync In-process GraphQL API management API, schema registry, AWS scalars, domain names, channel namespaces
IAM In-process Users, roles, groups, policies, instance profiles, access keys; STS AssumeRole, WebIdentity, SAML, GetFederationToken, GetSessionToken
Cognito In-process User pools, app clients, auth flows, JWKS and OpenID well-known endpoints
KMS In-process Encrypt, decrypt, sign, verify, data keys, aliases
Kinesis In-process Streams, shards, enhanced fan-out, split and merge
Secrets Manager In-process Versioning, resource policies, tagging
Step Functions In-process ASL execution, task tokens, execution history
SWF In-process Decision and activity tasks, timers, child workflows, timeouts, real Lambda invocation
CloudFormation In-process Stacks, change sets, resource provisioning, StackSets (cross-account instances)
EventBridge In-process Custom buses, rules, SQS, SNS and Lambda targets
EventBridge Pipes In-process Poller-based integration connecting SQS, Kinesis, DynamoDB, and MSK sources to targets with optional filtering
EventBridge Scheduler In-process Schedule groups, schedules, flexible time windows, retry policies, DLQs
CloudWatch Logs In-process Log groups, streams, ingestion, filtering
CloudWatch Metrics In-process Custom metrics, statistics, alarms
ElastiCache Real Docker Redis / Valkey protocol, IAM auth, SigV4 validation
MemoryDB Real Docker Redis / Valkey protocol via real containers; JSON 1.1 control plane; reuses ElastiCache RESP proxy
RDS Real Docker PostgreSQL, MySQL, MariaDB, IAM auth, JDBC-compatible engines
RDS Data API REST JSON over real RDS containers Raw SQL execution and transactions for local MySQL / MariaDB RDS resources
Neptune Real Docker Graph DB via TinkerPop Gremlin Server (default) or Neo4j for openCypher/Bolt (NEPTUNE_DB_TYPE); RDS-shaped control plane; SigV4 proxy on port 8182
DocumentDB Real Docker, mock mode available MongoDB-compatible cluster via real MongoDB containers; RDS-shaped control plane; MongoDB wire protocol on port 27017
MSK Real Docker Kafka-compatible broker via Redpanda
Amazon MQ Real Docker RabbitMQ broker via rabbitmq:3-management; AMQP + management console
Athena In-process with DuckDB sidecar Real SQL execution over S3 and Glue-backed views
Glue In-process Data Catalog, Schema Registry, tables consumed by Athena
EMR In-process Cluster (job flow) lifecycle, instance groups and fleets, steps, security configurations, tagging
Data Firehose In-process Streaming delivery, buffered flush to S3 with GZIP/ZIP/Snappy compression
Managed Service for Apache Flink Real Docker Kinesis Analytics V2 control plane; StartApplication runs a real Flink cluster (JobManager + TaskManager, image per RuntimeEnvironment), pulls the application JAR from local S3, and submits the job
ECS Real Docker Clusters, task definitions, tasks, services, capacity providers, task sets
EC2 Real Docker RunInstances launches containers, SSH key injection, UserData, IMDS, VPC resources
Lightsail In-process Instances, disks, static IPs, key pairs, ports, tags, regions, blueprints, bundles, operations
ACM In-process Certificate issuance and validation lifecycle
ECR In-process with real registry Repositories, docker push / pull, image-backed Lambda functions
Resource Groups Tagging API In-process GetResources, tag and untag resources, tag key and value discovery across services
SES In-process v1 and v2 APIs: send email, raw email, identity verification, DKIM, templates, configuration sets, account sending
OpenSearch Real Docker Domain CRUD, tags, versions, instance types, upgrade stubs
AppConfig In-process Applications, environments, profiles, hosted versions, deployments
AppConfigData In-process Configuration sessions and dynamic configuration retrieval
Bedrock Runtime In-process stub Dummy Converse and InvokeModel responses for local development
EKS Real Docker, mock mode available k3s clusters with live Kubernetes API server
MWAA Real Docker, mock mode available Real Apache Airflow (LocalExecutor) + Postgres metadata DB per environment; web/CLI proxy; S3-backed DAG sync
ELB v2 In-process ALB, NLB, target groups, listeners, routing rules, Lambda targets, tags
CodeBuild In-process with real Docker Real buildspec execution, CloudWatch logs, S3 artifacts
CodeDeploy In-process with Lambda traffic shifting Deployment groups, configs, lifecycle hooks, auto-rollback
CodePipeline In-process orchestration Pipelines, executions, S3 artifacts, approvals, local providers, custom workers
AWS Batch In-process Compute environments, job queues, job definitions, job submission and lifecycle
Auto Scaling In-process with reconciler Launch configs, ASGs, desired capacity reconciliation, lifecycle hooks
Application Auto Scaling In-process Scalable targets, target-tracking and step scaling policies, CloudWatch alarm creation, tagging (policies are stored but inert)
Elastic Beanstalk In-process Applications, application versions, environments, configuration templates, platform and solution stack metadata
AWS Backup In-process Vaults, backup plans, selections, simulated job lifecycle, recovery points
AWS Config In-process Config rules, configuration recorders, delivery channels, conformance packs, tagging
CloudTrail In-process Trails, event selectors (S3 data events with bucket/prefix matching), StartLogging/StopLogging, scheduled gzipped log file emission to the destination bucket at AWS-shaped key paths, IAM-deny path emits AccessDenied records
CloudFront In-process Distributions, origins, cache behaviors, invalidations, tagging
WAF v2 In-process Web ACLs, IP sets, regex pattern sets, rule groups, logging configs, resource associations, tagging (REGIONAL and CLOUDFRONT scopes)
Route53 In-process Hosted zones, SOA and NS records, resource record sets, change tracking, tagging
Cloud Map In-process HTTP and DNS namespaces, services, instance registration, discovery queries, operations, tagging
Transfer Family In-process Server lifecycle, user management, SSH key import, tagging
Textract In-process stub API-compatible stubs, dummy block data, async job simulation
Transcribe In-process stub Transcription jobs and custom vocabularies; jobs complete immediately, no real audio processing
Pricing In-process with static snapshot Product discovery, attributes, price list files, pagination
Cost Explorer In-process Cost synthesized from Floci resource state and pricing snapshots
Cost and Usage Reports In-process with floci-duck sidecar CUR 2.0 and FOCUS 1.2 columns, account-scoped storage, Parquet emission
BCM Data Exports In-process Export lifecycle, executions, update and delete operations

Real Docker Integration

Floci uses real Docker containers when in-process emulation would reduce fidelity. This applies to stateful databases, connection-heavy protocols, runtimes, and build systems.

Service Default image What is real
Lambda public.ecr.aws/lambda/<runtime> AWS runtime environment, execution model, warm container pool
ElastiCache valkey/valkey:8 Redis / Valkey protocol, ACL-based IAM auth, SigV4 validation
RDS PostgreSQL postgres:16-alpine PostgreSQL engine, IAM auth, JDBC-compatible access
RDS MySQL / Aurora mysql:8.0 MySQL engine, IAM auth, JDBC-compatible access
RDS MariaDB mariadb:11 MariaDB engine, IAM auth, JDBC-compatible access
Neptune tinkerpop/gremlin-server:3.7.3 TinkerPop Gremlin Server; Gremlin WebSocket on port 8182; SigV4 auth proxy
Neptune (openCypher) neo4j:5-community Neo4j backend when FLOCI_SERVICES_NEPTUNE_DB_TYPE=neo4j; openCypher over Bolt
DocumentDB mongo:7.0 MongoDB engine; MongoDB wire protocol on port 27017
MSK redpandadata/redpanda:latest Kafka-compatible broker via Redpanda
Amazon MQ rabbitmq:3-management RabbitMQ broker; AMQP on port 5672, management console on 15672
Managed Service for Apache Flink apache/flink:<version> Apache Flink JobManager; image chosen per RuntimeEnvironment (FLINK-1_15 โ€ฆ FLINK-1_20, FLINK-2_0 โ€ฆ FLINK-2_3)
EC2 AMI-mapped Linux images Linux containers, SSH key injection, UserData, IMDS, IAM credentials
ECS User-specified task image Container lifecycle, start, stop, health checks
EKS rancher/k3s:latest Kubernetes API server via k3s
MWAA apache/airflow:<version>-python3.12 + postgres:16-alpine Real Apache Airflow (LocalExecutor: scheduler + webserver) with its own Postgres metadata DB; webserver/CLI reachable via Floci's proxy
CodeBuild User-specified environment image Buildspec execution, log streaming, S3 artifact upload
OpenSearch opensearchproject/opensearch:2 Full OpenSearch engine with REST API
ECR registry:2 OCI-compatible registry for docker push and docker pull

Docker-backed services require the Docker socket:

bash
docker run -d --name floci \
  -p 4566:4566 \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -u root \
  floci/floci:latest

Overriding default images

Variable Default
FLOCI_SERVICES_ELASTICACHE_DEFAULT_IMAGE valkey/valkey:8
FLOCI_SERVICES_RDS_DEFAULT_POSTGRES_IMAGE postgres:16-alpine
FLOCI_SERVICES_RDS_DEFAULT_MYSQL_IMAGE mysql:8.0
FLOCI_SERVICES_RDS_DEFAULT_MARIADB_IMAGE mariadb:11
FLOCI_SERVICES_MSK_DEFAULT_IMAGE redpandadata/redpanda:latest
FLOCI_SERVICES_OPENSEARCH_DEFAULT_IMAGE opensearchproject/opensearch:2
FLOCI_SERVICES_KINESIS_ANALYTICS_DEFAULT_IMAGE (unset; chosen per RuntimeEnvironment)
FLOCI_SERVICES_NEPTUNE_DEFAULT_IMAGE tinkerpop/gremlin-server:3.7.3
FLOCI_SERVICES_NEPTUNE_DEFAULT_NEO4J_IMAGE neo4j:5-community
FLOCI_SERVICES_DOCDB_DEFAULT_IMAGE mongo:7.0
FLOCI_SERVICES_EKS_DEFAULT_IMAGE rancher/k3s:latest
FLOCI_SERVICES_MWAA_DEFAULT_POSTGRES_IMAGE postgres:16-alpine
FLOCI_SERVICES_ECR_REGISTRY_IMAGE registry:2
FLOCI_ECR_BASE_URI public.ecr.aws

Persistence and Storage Modes

Floci can trade speed for durability depending on the workflow. Configure the default mode with FLOCI_STORAGE_MODE, or override storage per service.

Mode Behavior Best for Durability
memory Entirely in RAM. Data is lost when the container stops. CI and ephemeral tests None
persistent Loaded at startup and flushed to disk immediately on every write operation. Simple local state preservation with immediate persistence Medium
hybrid In-memory performance with periodic async flushing every 5 seconds. Local development Good
wal Write-ahead log. Every mutation is logged before responding. Maximum durability Highest

Use memory for fast test runs. Use hybrid when you want state preserved across container restarts without much overhead.

For more detail, see the Storage Configuration documentation.

Multi-Account Isolation

Floci supports per-account resource isolation with no extra setup. If AWS_ACCESS_KEY_ID is exactly 12 digits, Floci uses it as the account ID. Resources created by one account are invisible to another.

bash
AWS_ACCESS_KEY_ID=111111111111 aws sqs create-queue --queue-name orders
AWS_ACCESS_KEY_ID=222222222222 aws sqs create-queue --queue-name orders

Any other key format, such as test or AKIA..., causes Floci to fall back to FLOCI_DEFAULT_ACCOUNT_ID, which defaults to 000000000000.

STS temporary credentials are routed too: credentials from AssumeRole resolve to the assumed role's account, so the cross-account assume-role-then-provision pattern works locally. Resolution precedence is 12-digit AKID โ†’ temporary-session lookup โ†’ FLOCI_DEFAULT_ACCOUNT_ID.

See the Multi-Account Isolation docs.

SDK Integration

Point your existing AWS SDK at http://localhost:4566.

Java, AWS SDK v2

java
var client = DynamoDbClient.builder()
    .endpointOverride(URI.create("http://localhost:4566"))
    .region(Region.US_EAST_1)
    .credentialsProvider(StaticCredentialsProvider.create(
        AwsBasicCredentials.create("test", "test")))
    .build();

client.createTable(b -> b
    .tableName("demo-table")
    .billingMode(BillingMode.PAY_PER_REQUEST)
    .attributeDefinitions(
        AttributeDefinition.builder().attributeName("pk").attributeType(ScalarAttributeType.S).build())
    .keySchema(
        KeySchemaElement.builder().attributeName("pk").keyType(KeyType.HASH).build()));

System.out.println(client.listTables().tableNames());

Python, boto3

python
import boto3

client = boto3.client(
    "ssm",
    endpoint_url="http://localhost:4566",
    region_name="us-east-1",
    aws_access_key_id="test",
    aws_secret_access_key="test",
)

client.put_parameter(
    Name="/demo/app/message",
    Value="hello from floci",
    Type="String",
    Overwrite=True,
)

response = client.get_parameter(Name="/demo/app/message")
print(response["Parameter"]["Value"])

Node.js, AWS SDK v3

javascript
import { SQSClient, SendMessageCommand } from "@aws-sdk/client-sqs";

const client = new SQSClient({
  endpoint: "http://localhost:4566",
  region: "us-east-1",
  credentials: { accessKeyId: "test", secretAccessKey: "test" },
});

await client.send(
  new SendMessageCommand({
    QueueUrl: "http://localhost:4566/000000000000/demo-queue",
    MessageBody: "hello from floci",
  }),
);

Go, AWS SDK v2

go
package main

import (
    "context"
    "fmt"
    "log"

    "github.com/aws/aws-sdk-go-v2/config"
    "github.com/aws/aws-sdk-go-v2/credentials"
    "github.com/aws/aws-sdk-go-v2/service/s3"
)

func main() {
    cfg, err := config.LoadDefaultConfig(context.TODO(),
        config.WithRegion("us-east-1"),
        config.WithCredentialsProvider(
            credentials.NewStaticCredentialsProvider("test", "test", ""),
        ),
        config.WithBaseEndpoint("http://localhost:4566"),
    )
    if err != nil {
        log.Fatal(err)
    }

    client := s3.NewFromConfig(cfg, func(o *s3.Options) {
        o.UsePathStyle = true
    })

    out, err := client.ListBuckets(context.TODO(), nil)
    if err != nil {
        log.Fatal(err)
    }

    fmt.Println(out.Buckets)
}

Rust, AWS SDK

rust
use aws_sdk_secretsmanager::config::{Credentials, Region};
use aws_sdk_secretsmanager::Client;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let config = aws_config::defaults(aws_config::BehaviorVersion::latest())
        .region(Region::new("us-east-1"))
        .credentials_provider(Credentials::new("test", "test", None, None, "floci"))
        .endpoint_url("http://localhost:4566")
        .load()
        .await;

    let client = Client::new(&config);

    client
        .create_secret()
        .name("demo/secret")
        .secret_string("hello from floci")
        .send()
        .await?;

    Ok(())
}

Bash, AWS CLI

bash
export AWS_ACCESS_KEY_ID=test
export AWS_SECRET_ACCESS_KEY=test
export AWS_DEFAULT_REGION=us-east-1

aws --endpoint-url http://localhost:4566 s3 mb s3://my-bucket
aws --endpoint-url http://localhost:4566 s3 ls

Testcontainers

Floci has Testcontainers modules for starting isolated Floci instances directly from tests. This avoids shared state, manual daemon setup, and port conflicts.

Language Package Latest Registry Source
Java io.floci:testcontainers-floci 1.4.0 Maven Central GitHub
Node.js @floci/testcontainers 0.1.0 npm GitHub
Python testcontainers-floci 0.1.1 PyPI GitHub
Go In progress In progress N/A GitHub

Java

xml
<dependency>
    <groupId>io.floci</groupId>
    <artifactId>testcontainers-floci</artifactId>
    <version>1.4.0</version>
    <scope>test</scope>
</dependency>
java
@Testcontainers
class S3IntegrationTest {

    @Container
    static FlociContainer floci = new FlociContainer();

    @Test
    void shouldCreateBucket() {
        S3Client s3 = S3Client.builder()
                .endpointOverride(URI.create(floci.getEndpoint()))
                .region(Region.of(floci.getRegion()))
                .credentialsProvider(StaticCredentialsProvider.create(
                        AwsBasicCredentials.create(floci.getAccessKey(), floci.getSecretKey())))
                .forcePathStyle(true)
                .build();

        s3.createBucket(b -> b.bucket("my-bucket"));
    }
}

For Testcontainers 2.x / Spring Boot 4.x, use version 2.5.0.

Node.js / TypeScript

sh
npm install --save-dev @floci/testcontainers
ts
import { FlociContainer } from "@floci/testcontainers";
import { S3Client, CreateBucketCommand } from "@aws-sdk/client-s3";

describe("S3", () => {
  let floci: FlociContainer;

  beforeAll(async () => {
    floci = await new FlociContainer().start();
  });

  afterAll(async () => {
    await floci.stop();
  });

  it("creates a bucket", async () => {
    const s3 = new S3Client({
      endpoint: floci.getEndpoint(),
      region: floci.getRegion(),
      credentials: {
        accessKeyId: floci.getAccessKey(),
        secretAccessKey: floci.getSecretKey(),
      },
      forcePathStyle: true,
    });

    await s3.send(new CreateBucketCommand({ Bucket: "my-bucket" }));
  });
});

Python

sh
pip install testcontainers-floci
python
import boto3
from testcontainers_floci import FlociContainer


def test_s3_create_bucket():
    with FlociContainer() as floci:
        s3 = boto3.client(
            "s3",
            endpoint_url=floci.get_endpoint(),
            region_name=floci.get_region(),
            aws_access_key_id=floci.get_access_key(),
            aws_secret_access_key=floci.get_secret_key(),
        )
        s3.create_bucket(Bucket="my-bucket")

Compatibility Testing

The compatibility-tests directory validates Floci across SDKs and tooling workflows.

Module Language / Tool SDK / Client Tests
sdk-test-java Java 17 AWS SDK for Java v2 1,326
sdk-test-node Node.js AWS SDK for JavaScript v3 449
sdk-test-python Python 3 boto3 311
sdk-test-go Go AWS SDK for Go v2 + RDS Data API SDK v1 157
sdk-test-awscli Bash AWS CLI v2 205
compat-terraform Terraform v1.10+ 22
compat-opentofu OpenTofu v1.9+ 16
compat-cdk AWS CDK v2+ 20

2,506 automated compatibility tests across 5 SDKs and 3 IaC tools.

Migrating from LocalStack

Floci is a drop-in replacement for LocalStack Community. The port, credentials, SDK configuration, and CLI endpoint pattern work the same way. Swap the image and keep going.

yaml
# Before
image: localstack/localstack

# After, standard image
image: floci/floci:latest

# After, if init scripts need AWS CLI or boto3
image: floci/floci:latest-compat

LocalStack environment variables are translated automatically:

LocalStack Floci equivalent
LOCALSTACK_HOST FLOCI_HOSTNAME
PERSISTENCE=1 FLOCI_STORAGE_MODE=persistent
LAMBDA_DOCKER_NETWORK FLOCI_SERVICES_LAMBDA_DOCKER_NETWORK
LAMBDA_REMOVE_CONTAINERS=1 FLOCI_SERVICES_LAMBDA_EPHEMERAL=true
DEBUG=1 QUARKUS_LOG_LEVEL=DEBUG

Init scripts mounted under /etc/localstack/init/ run unchanged. The /_localstack/init and /_localstack/health endpoints are still served. Once the emulator is up, the log also ends with a LocalStack-style Ready. line, so tooling that watches the log for it โ€” such as the default wait strategy of Testcontainers' LocalStackContainer โ€” works unchanged. Set LOCALSTACK_PARITY=false to opt out of automatic translation.

See the full migration guide.

Image Tags

Every tag combines a variant and a channel.

Channel Standard Compat with AWS CLI and boto3
Release, floating latest latest-compat
Release, pinned x.y.z x.y.z-compat
Nightly, floating nightly nightly-compat
Nightly, dated nightly-mmddyyyy nightly-mmddyyyy-compat

Use latest for stable releases, a pinned version for reproducible builds, and nightly to track main.

yaml
# Recommended
image: floci/floci:latest

# Includes AWS CLI and boto3
image: floci/floci:latest-compat

# Pinned release
image: floci/floci:1.5.11

# Track main
image: floci/floci:nightly

Configuration

All settings are overridable through environment variables with the FLOCI_ prefix.

Variable Default Description
FLOCI_PORT 4566 Port exposed by the Floci API
FLOCI_DEFAULT_REGION us-east-1 Default AWS region
FLOCI_DEFAULT_ACCOUNT_ID 000000000000 Default AWS account ID
FLOCI_BASE_URL http://localhost:4566 Base URL used when Floci returns service URLs
FLOCI_HOSTNAME Unset Hostname used in returned URLs when Floci runs inside Docker Compose
FLOCI_STORAGE_MODE memory Storage mode: memory, persistent, hybrid, or wal
FLOCI_STORAGE_PERSISTENT_PATH ./data Directory used for persisted state
FLOCI_ECR_BASE_URI public.ecr.aws ECR base URI used when pulling container images
FLOCI_SERVICES_S3_ENFORCE_AUTH false Enforce S3 public/private read access and reject unknown signed S3 access keys

Full reference: configuration docs

Multi-container Docker Compose

When your application runs in a different container, set FLOCI_HOSTNAME to the Floci service name so returned URLs, such as SQS QueueUrl values, resolve correctly.

yaml
services:
  floci:
    image: floci/floci:latest
    ports:
      - "4566:4566"
    environment:
      - FLOCI_HOSTNAME=floci

  my-app:
    environment:
      - AWS_ENDPOINT_URL=http://floci:4566
    depends_on:
      - floci

Without this, services may return URLs using localhost, which points to the wrong container from the application container.

Community

Join the Floci community on Slack or GitHub Discussions. Feature ideas, compatibility questions, design tradeoffs, and rough proposals are welcome.

Sponsors

Floci is independent open source, funded by its users. If Floci saves you time,
consider sponsoring the project โ€” every
tier keeps the emulators fast, light, and free.

๐Ÿฅ‡ Gold

Large logo with top placement, a dedicated support channel, input on roadmap
priorities, and custom integration help.

Your logo here โ€” become a Gold sponsor.

๐Ÿฅˆ Silver

Logo in this README and on floci.io, priority issue support, and a mention in
release notes.

Your logo here โ€” become a Silver sponsor.

๐Ÿฅ‰ Community

Name in this README, a sponsor badge on GitHub, and our sincere thanks.

Star History

Contributors

License

MIT. Use it however you want.


File: compatibility-tests/sdk-test-awscli/README.md

sdk-test-awscli

Compatibility tests for Floci using the AWS CLI v2 (2.22.35).

Tests are plain bash scripts that call aws CLI commands with --endpoint-url pointed at the emulator.

Services Covered

Group Description
ssm Parameter Store โ€” put, get, path, tags
sqs Queues, send/receive/delete, attributes
sns Topics, publish, attributes
s3 Buckets, objects, tagging, copy, delete
dynamodb Tables, put/get/update/query/delete items
iam Users, roles, create/get/delete
sts GetCallerIdentity
ses Identities, sending, quotas, notification attributes
secretsmanager Create/get/put/list/tag/delete secrets
kms Keys, aliases, encrypt/decrypt
cognito User pools, clients
s3-notifications S3 โ†’ SQS event notifications

Requirements

  • AWS CLI v2
  • bash
  • jq
  • bats-core (installed via just setup-awscli)

Running

bash
# All groups (from compatibility-tests/)
just test-awscli

# Run bats directly
./lib/run-bats-with-junit.sh sdk-test-awscli/test/ sdk-test-awscli/test-results/junit.xml

Configuration

Variable Default Description
FLOCI_ENDPOINT http://localhost:4566 Floci emulator endpoint

AWS credentials are always test / test / us-east-1.

Docker

bash
docker build -t floci-sdk-awscli .
docker run --rm --network host floci-sdk-awscli

# Custom endpoint (macOS/Windows)
docker run --rm -e FLOCI_ENDPOINT=http://host.docker.internal:4566 floci-sdk-awscli

File: compatibility-tests/sdk-test-go/README.md

sdk-test-go

Compatibility tests for Floci using the AWS SDK for Go v2 (1.41.4).

Services Covered

Group Description
ssm Parameter Store โ€” put, get, label, history, path, tags
sqs Queues, send/receive/delete, DLQ, visibility
sns Topics, subscriptions, publish, SQS delivery
s3 Buckets, objects, tagging, copy, batch delete
s3-cors CORS configuration
s3-notifications S3 โ†’ SQS event notifications
dynamodb Tables, CRUD, batch, TTL, tags
lambda Create/invoke/update/delete functions
iam Users, roles, policies, access keys
sts GetCallerIdentity, AssumeRole, GetSessionToken
secretsmanager Create/get/put/list/delete secrets, versioning, tags
kms Keys, aliases, encrypt/decrypt, data keys, sign/verify
kinesis Streams, shards, PutRecord/GetRecords
cloudwatch PutMetricData, ListMetrics, GetMetricStatistics, alarms
rds-data RDS Data API execute statements, transactions, result fields with SDK v1 and v2

Requirements

  • Go 1.24+

Running

bash
# All groups
gotestsum --junitfile test-results.xml ./tests/...

# Specific tests
go test ./tests/ -run TestSsm

# Via just (from compatibility-tests/)
just test-go

Configuration

Variable Default Description
FLOCI_ENDPOINT http://localhost:4566 Floci emulator endpoint

AWS credentials are always test / test / us-east-1.

Docker

bash
docker build -t floci-sdk-go .
docker run --rm --network host floci-sdk-go

# Custom endpoint (macOS/Windows)
docker run --rm -e FLOCI_ENDPOINT=http://host.docker.internal:4566 floci-sdk-go

File: compatibility-tests/sdk-test-java/README.md

sdk-test-java

Compatibility tests for Floci using the AWS SDK for Java v2 (2.31.8).

Runs 352 tests across 17 test classes against a live Floci instance โ€” no mocks.

Services Covered

Test class Description
SsmTest Parameter Store โ€” put, get, path, tags
SqsTest Queues, send/receive/delete, DLQ, visibility
SnsTest Topics, subscriptions, publish, SQS delivery
S3Test Buckets, objects, tagging, copy, multipart, batch delete
DynamoDbTest Tables, CRUD, batch, TTL, tags, streams
DynamoDbScanConditionTests Scan filter and condition expressions
LambdaTest Create/invoke/update/delete functions
IamTest Users, roles, policies, access keys
StsTest GetCallerIdentity, AssumeRole, GetSessionToken
SecretsManagerTest Create/get/put/list/delete secrets, versioning, tags
KmsTest Keys, aliases, encrypt/decrypt, data keys, sign/verify
CloudWatchTest PutMetricData, ListMetrics, GetMetricStatistics, alarms
CloudFormationVirtualHostTests Virtual host style S3 access via CloudFormation
ApigwSfnJsonataCrudlTests API Gateway + Step Functions JSONata CRUDL integration
ApiGatewayV2WebSocketAndExtendedOpsTest API GW v2 WebSocket APIs, Update ops, Route/Integration Responses, Models, Tagging
Ec2Tests EC2 instances, VPCs, security groups, subnets
AppSyncTest GraphQL API CRUDL, data sources, resolvers, functions, types, API keys, tags, schema validation
EcsTests ECS clusters, task definitions, services

Adding a New Test

Create a standard JUnit 5 test class in src/test/java/com/floci/test/. Tests run against a live Floci instance using real AWS SDK clients.

Requirements

  • Java 17+
  • Maven

Running

bash
# All tests
mvn test -q

# Specific test class
mvn test -Dtest=S3Test

# Via just (from compatibility-tests/)
just test-java

Configuration

Variable Default Description
FLOCI_ENDPOINT http://localhost:4566 Floci emulator endpoint

AWS credentials are always test / test / us-east-1.

Docker

bash
docker build -t floci-sdk-java .
docker run --rm --network host floci-sdk-java

# Custom endpoint (macOS/Windows)
docker run --rm -e FLOCI_ENDPOINT=http://host.docker.internal:4566 floci-sdk-java

File: compatibility-tests/sdk-test-node/README.md

sdk-test-node

Compatibility tests for Floci using the AWS SDK for JavaScript v3 (3.1003.0).

Services Covered

Group Description
ssm Parameter Store โ€” put, get, label, history, path, tags
sqs Queues, send/receive/delete, DLQ, visibility
sns Topics, subscriptions, publish, SQS delivery
s3 Buckets, objects, tagging, copy, batch delete
s3-cors CORS configuration
s3-notifications S3 โ†’ SQS and S3 โ†’ SNS event notifications
dynamodb Tables, CRUD, batch, TTL, tags
lambda Create/invoke/update/delete functions
iam Users, roles, policies, access keys
sts GetCallerIdentity, AssumeRole, GetSessionToken
secretsmanager Create/get/put/list/delete secrets, versioning, tags
kms Keys, aliases, encrypt/decrypt, data keys, sign/verify
kinesis Streams, shards, PutRecord/GetRecords
cloudwatch PutMetricData, ListMetrics, GetMetricStatistics, alarms
cloudformation-naming Auto physical name generation, explicit name precedence, cross-reference
cognito User pools, clients, AdminCreateUser, InitiateAuth, GetUser
cognito-oauth Resource server CRUD, confidential clients, /oauth2/token, OIDC discovery, JWKS/JWT verification
apigatewayv2 HTTP & WebSocket API lifecycle, routes, integrations, authorizers, stages, deployments, route responses, models, tagging

Requirements

  • Node.js 20+
  • npm

Running

bash
npm install

# All groups
npm test

# Via just (from compatibility-tests/)
just test-typescript

Configuration

Variable Default Description
FLOCI_ENDPOINT http://localhost:4566 Floci emulator endpoint

AWS credentials are always test / test / us-east-1.

Docker

bash
docker build -t floci-sdk-node .
docker run --rm --network host floci-sdk-node

# Custom endpoint (macOS/Windows)
docker run --rm -e FLOCI_ENDPOINT=http://host.docker.internal:4566 floci-sdk-node

TLS Tests

The tls.test.ts file tests HTTPS connectivity with AWS SDK v3 clients.
The apigatewayv2-websocket-tls.test.ts file tests WebSocket over TLS (WSS),
covering connect/disconnect, route selection, broadcast, authorization,
@connections API, binary frames, and payload limits.

These tests always run as part of the suite โ€” they derive the HTTPS/WSS endpoint
from the HTTP endpoint by swapping the scheme (http://floci:4566 โ†’ https://floci:4566,
ws:// โ†’ wss://).

Since Floci serves HTTP and HTTPS simultaneously when TLS is enabled, existing HTTP
tests are unaffected.

The Dockerfile sets NODE_TLS_REJECT_UNAUTHORIZED=0 so self-signed certs are accepted.
The CI workflow starts Floci with FLOCI_TLS_ENABLED=true.

To run locally:

bash
# 1. Start Floci with TLS enabled
FLOCI_TLS_ENABLED=true ./mvnw quarkus:dev

# 2. Run all tests (including TLS)
NODE_TLS_REJECT_UNAUTHORIZED=0 npm test

File: compatibility-tests/sdk-test-python/README.md

sdk-test-python

Compatibility tests for Floci using boto3 (1.37.1).

Services Covered

Group Description
ssm Parameter Store โ€” put, get, label, history, path, tags
sqs Queues, send/receive/delete, DLQ, visibility
sns Topics, subscriptions, publish, SQS delivery
s3 Buckets, objects, tagging, copy, batch delete
s3-cors CORS configuration
s3-notifications S3 โ†’ SQS event notifications
dynamodb Tables, CRUD, batch, TTL, tags
lambda Create/invoke/update/delete functions
iam Users, roles, policies, access keys
sts GetCallerIdentity, AssumeRole, GetSessionToken
secretsmanager Create/get/put/list/delete secrets, versioning, tags
kms Keys, aliases, encrypt/decrypt, data keys, sign/verify
kinesis Streams, shards, PutRecord/GetRecords
cloudwatch-metrics PutMetricData, ListMetrics, GetMetricStatistics, alarms
cloudformation-naming Auto physical name generation, explicit name precedence, cross-reference
cognito User pools, clients, AdminCreateUser, InitiateAuth, GetUser

Requirements

  • Python 3.9+
  • pip

Running

bash
pip install -r requirements.txt

# All groups
pytest tests/ --junit-xml=test-results/junit.xml

# Specific tests
pytest tests/test_s3.py

# Via just (from compatibility-tests/)
just test-python

Configuration

Variable Default Description
FLOCI_ENDPOINT http://localhost:4566 Floci emulator endpoint

AWS credentials are always test / test / us-east-1.

Docker

bash
docker build -t floci-sdk-python .
docker run --rm --network host floci-sdk-python

# Custom endpoint (macOS/Windows)
docker run --rm -e FLOCI_ENDPOINT=http://host.docker.internal:4566 floci-sdk-python

File: compatibility-tests/README.md

floci-compatibility-tests

Compatibility test suite for Floci โ€” a local AWS emulator.

Verifies that standard AWS tooling (SDKs, CDK, OpenTofu/Terraform) works correctly against the emulator without modification. Tests run against a live Floci instance and use real AWS SDK clients โ€” no mocks.

Quick Start

bash
# Install just (task runner)
# macOS: brew install just
# Linux: cargo install just

# Copy and configure environment
cp env.example .env

# Install dependencies
just setup

# Run all tests
just test-all

# Run specific SDK tests
just test-python
just test-typescript
just test-awscli

Test Runners

Module Language Test Framework Command
sdk-test-python Python 3 pytest just test-python
sdk-test-node TypeScript vitest just test-typescript
sdk-test-awscli Bash / AWS CLI bats-core just test-awscli
sdk-test-java Java 17 JUnit 5 just test-java
sdk-test-go Go 1.24 go test just test-go

IaC Compatibility

Module Tool Command
compat-cdk AWS CDK v2 ./run.sh
compat-opentofu OpenTofu ./run.sh
compat-terraform Terraform ./run.sh

Prerequisites

  • Floci running on http://localhost:4566 (or set FLOCI_ENDPOINT)
  • Docker โ€” required for Lambda invocation tests
  • just โ€” task runner for orchestration

Per-module requirements:

Module Requirements
sdk-test-python Python 3.9+, pip
sdk-test-node Node.js 20+, npm, vitest
sdk-test-awscli AWS CLI v2, bash, jq
sdk-test-java Java 17+, Maven
sdk-test-go Go 1.24+

Setup

bash
# Setup all SDKs
just setup

# Setup individual SDKs
just setup-python      # pip install -r requirements.txt
just setup-typescript  # npm install
just setup-awscli      # Clone bats-core, bats-support, bats-assert

Running Tests

All SDKs

bash
just test-all

Individual SDKs

bash
# Python (pytest)
just test-python

# TypeScript (vitest)
just test-typescript

# AWS CLI (bats-core)
just test-awscli

Bats-based suites keep their normal console output and also write JUnit XML reports:

  • sdk-test-awscli/test-results/junit.xml
  • compat-cdk/test-results/junit.xml
  • compat-terraform/test-results/junit.xml
  • compat-opentofu/test-results/junit.xml

Configuration

All modules read from environment variables (see .env.example):

bash
FLOCI_ENDPOINT=http://localhost:4566
AWS_ACCESS_KEY_ID=test
AWS_SECRET_ACCESS_KEY=test
AWS_DEFAULT_REGION=us-east-1

Running with Docker

Each module includes a Dockerfile for isolated execution:

bash
# Python
docker build -t floci-sdk-python sdk-test-python/
docker run --rm --network host floci-sdk-python pytest

# TypeScript
docker build -t floci-sdk-node sdk-test-node/
docker run --rm --network host floci-sdk-node npm test

On macOS/Windows, use host.docker.internal instead of localhost:

bash
docker run --rm -e FLOCI_ENDPOINT=http://host.docker.internal:4566 floci-sdk-python pytest

Exit Codes

All test runners exit 0 on full pass and non-zero if any test fails โ€” suitable for CI pipelines.


File: docs/configuration/application-yml.md

application.yml Reference

!!! note "Moved"
This page has moved to Advanced โ†’ application.yml Reference.

text
If you run the published Docker image, you don't need an `application.yml` โ€” all settings are configured through `FLOCI_*` environment variables. See the [Environment Variables Reference](./environment-variables.md).