File: README.md
What is Floci?
Floci is a free, open-source local AWS emulator for development, testing, and CI.
It gives you AWS-shaped services on your machine without requiring a cloud account, an auth token, or paid feature gates. Point your AWS SDK, CLI, Terraform, CDK, OpenTofu, or test suite at http://localhost:4566 and keep your existing workflows.
Floci is named after floccus, the cloud formation that looks like popcorn.
Quick Start
The fastest way to run Floci is with the official CLI
floci startExport the AWS environment variables:
eval $(floci env)Use your existing AWS tools normally:
aws s3 mb s3://my-bucket
aws dynamodb create-table \
--table-name demo-table \
--attribute-definitions AttributeName=pk,AttributeType=S \
--key-schema AttributeName=pk,KeyType=HASH \
--billing-mode PAY_PER_REQUEST
aws dynamodb list-tablesWatch it run
This short demo shows the CLI flow: start Floci, export the local AWS environment, run standard AWS CLI commands, and stop the emulator.
https://github.com/user-attachments/assets/b55714dc-ef36-40ae-a734-cd2cadc288a8
All AWS services are available at http://localhost:4566. Any region works. Credentials can be any non-empty values unless you explicitly enable stricter service-specific auth checks.
Prefer Docker Compose?
Create a compose.yaml file:
services:
floci:
image: floci/floci:latest
ports:
- "4566:4566"Start Floci:
docker compose upThen configure your AWS environment manually:
export AWS_ENDPOINT_URL=http://localhost:4566
export AWS_DEFAULT_REGION=us-east-1
export AWS_ACCESS_KEY_ID=test
export AWS_SECRET_ACCESS_KEY=testUsing the old hectorvent/floci image?
Update your image name:
# Before
image: hectorvent/floci:latest
# After
image: floci/floci:latestThe old hectorvent/floci repository no longer receives updates.
Features
Local AWS without the cloud account
Run AWS-compatible services locally without an AWS account, auth token, or paid feature gates.
Real Docker where fidelity matters
Lambda, RDS, Neptune, ElastiCache, MSK, ECS, EC2, EKS, OpenSearch, CodeBuild, and Managed Service for Apache Flink use real Docker-backed execution instead of shallow mocks.
Drop-in AWS compatibility
Point standard AWS clients at http://localhost:4566. Existing credentials, regions, SDKs, CLI commands, and IaC workflows stay familiar.
Fast enough for CI
The native image starts in milliseconds and keeps idle memory low, making it practical for local development and test pipelines.
Configurable persistence
Choose from in-memory, persistent, hybrid, and write-ahead log storage depending on the durability profile you need.
Why Floci?
LocalStack's community edition sunset in March 2026, requiring auth tokens and freezing security updates. Floci is the no-strings-attached alternative.
| Capability | Floci | LocalStack Community |
|---|---|---|
| Auth token required | No | Yes |
| Security updates | Yes | Frozen |
| Startup time | ~24 ms | ~3.3 s |
| Idle memory | ~13 MiB | ~143 MiB |
| Docker image size | ~90 MB | ~1.0 GB |
| License | MIT | Restricted |
| API Gateway v2 / HTTP API | Yes | No |
| Cognito | Yes | No |
| RDS, ElastiCache, MSK | Real Docker | No |
| Neptune (graph DB + Gremlin WebSocket) | Real Docker | No |
| DocumentDB (MongoDB-compatible) | Real Docker | No |
| ECS, EC2, EKS | Real Docker | No |
| CodeBuild | Real Docker execution | No |
| Native binary | ~40 MB | No |
69 AWS services. Broad coverage. Free forever.
Architecture Overview
flowchart LR
Client["AWS SDK / CLI"]
subgraph Floci ["Floci, port 4566"]
Router["HTTP Router\nJAX-RS / Vert.x"]
subgraph Stateless ["Stateless Services"]
A["SSM ยท SQS ยท SNS\nIAM ยท STS ยท KMS\nSecrets Manager ยท SES\nCognito ยท Kinesis\nEventBridge ยท Scheduler ยท AppConfig\nCloudWatch ยท Step Functions\nCloudFormation ยท ACM ยท Config ยท CloudTrail\nAPI Gateway ยท AppSync ยท ELB v2 ยท Auto Scaling\nElastic Beanstalk ยท CodeDeploy ยท CodePipeline ยท Backup ยท Bedrock Runtime ยท Route53 ยท Transfer"]
end
subgraph Stateful ["Stateful Services"]
B["S3 ยท DynamoDB\nDynamoDB Streams"]
end
subgraph Containers ["Container Services"]
C["Lambda\nElastiCache\nRDS\nNeptune\nECS\nEC2\nMSK\nEKS\nOpenSearch\nCodeBuild\nManaged Flink"]
D["Athena -> floci-duck\nDuckDB sidecar"]
end
Router --> Stateless
Router --> Stateful
Router --> Containers
Stateless & Stateful --> Store[("StorageBackend\nmemory ยท hybrid ยท persistent ยท wal")]
end
Docker["Docker Engine"]
Client -->|"HTTP :4566\nAWS wire protocol"| Router
Containers -->|"Docker API\nIAM / SigV4 auth"| DockerSupported Services
Floci supports local emulation for application services, data services, eventing, identity, infrastructure, billing, and container-backed workloads.
| Category | Services |
|---|---|
| Core app services | S3, SQS, SNS, DynamoDB, Lambda, IAM, KMS, Secrets Manager, SSM |
| Events and workflows | EventBridge, EventBridge Pipes, EventBridge Scheduler, Step Functions, SWF, CloudWatch Logs, CloudWatch Metrics |
| API and identity | API Gateway REST, API Gateway v2, AppSync, Cognito, ACM, Route53, Cloud Map |
| Containers and compute | ECS, EC2, Lightsail, EKS, MWAA, ECR, CodeBuild, CodeDeploy, CodePipeline, AWS Batch, Auto Scaling, Application Auto Scaling, Elastic Beanstalk, ELB v2 |
| Data, analytics, and AI | Athena, Glue, EMR, Firehose, Managed Service for Apache Flink, OpenSearch, S3 Tables, S3 Vectors, Textract, Transcribe, Bedrock Runtime |
| Databases and caching | RDS, RDS Data API, Neptune, DocumentDB, MemoryDB, ElastiCache |
| Messaging and transfer | SES, Kinesis, MSK, Amazon MQ, Transfer Family, IoT Core |
| Security and governance | WAF v2, CloudTrail, CloudFront, Resource Groups Tagging API, CloudHSM v2 |
| Cost and billing | Pricing, Cost Explorer, Cost and Usage Reports, BCM Data Exports |
| Backup and config | AWS Backup, AWS Config, AppConfig, AppConfigData, CloudFormation, Cloud Control API |
For operation-level compatibility, see the Services Overview.
Detailed service notes
| Service | How it works | Notable features |
|---|---|---|
| SSM | In-process + EC2 containers | Parameter Store (version history, labels, SecureString, tagging); Run Command (SendCommand, GetCommandInvocation, direct EC2 container execution, agent polling) |
| SQS | In-process | Standard and FIFO queues, DLQ, visibility timeout, batch operations, tagging |
| SNS | In-process | Topics, subscriptions, SQS, Lambda and HTTP delivery, tagging |
| S3 | In-process | Versioning, multipart upload, pre-signed URLs, Object Lock, event notifications |
| S3 Vectors | In-process | Vector buckets, indexes, put / get / list / delete vectors, cosine similarity queries |
| DynamoDB | In-process | GSI, LSI, Query, Scan, TTL, transactions, batch operations; Streams with shard iterators and Lambda event source mapping |
| Lambda | Real Docker | Runtime environment, execution model, warm container pool, aliases, Function URLs |
| API Gateway REST | In-process | Resources, methods, stages, Lambda proxy, MOCK integrations, AWS integrations |
| API Gateway v2 | In-process | HTTP APIs, routes, integrations, JWT authorizers, stages |
| AppSync | In-process | GraphQL API management API, schema registry, AWS scalars, domain names, channel namespaces |
| IAM | In-process | Users, roles, groups, policies, instance profiles, access keys; STS AssumeRole, WebIdentity, SAML, GetFederationToken, GetSessionToken |
| Cognito | In-process | User pools, app clients, auth flows, JWKS and OpenID well-known endpoints |
| KMS | In-process | Encrypt, decrypt, sign, verify, data keys, aliases |
| Kinesis | In-process | Streams, shards, enhanced fan-out, split and merge |
| Secrets Manager | In-process | Versioning, resource policies, tagging |
| Step Functions | In-process | ASL execution, task tokens, execution history |
| SWF | In-process | Decision and activity tasks, timers, child workflows, timeouts, real Lambda invocation |
| CloudFormation | In-process | Stacks, change sets, resource provisioning, StackSets (cross-account instances) |
| EventBridge | In-process | Custom buses, rules, SQS, SNS and Lambda targets |
| EventBridge Pipes | In-process | Poller-based integration connecting SQS, Kinesis, DynamoDB, and MSK sources to targets with optional filtering |
| EventBridge Scheduler | In-process | Schedule groups, schedules, flexible time windows, retry policies, DLQs |
| CloudWatch Logs | In-process | Log groups, streams, ingestion, filtering |
| CloudWatch Metrics | In-process | Custom metrics, statistics, alarms |
| ElastiCache | Real Docker | Redis / Valkey protocol, IAM auth, SigV4 validation |
| MemoryDB | Real Docker | Redis / Valkey protocol via real containers; JSON 1.1 control plane; reuses ElastiCache RESP proxy |
| RDS | Real Docker | PostgreSQL, MySQL, MariaDB, IAM auth, JDBC-compatible engines |
| RDS Data API | REST JSON over real RDS containers | Raw SQL execution and transactions for local MySQL / MariaDB RDS resources |
| Neptune | Real Docker | Graph DB via TinkerPop Gremlin Server (default) or Neo4j for openCypher/Bolt (NEPTUNE_DB_TYPE); RDS-shaped control plane; SigV4 proxy on port 8182 |
| DocumentDB | Real Docker, mock mode available | MongoDB-compatible cluster via real MongoDB containers; RDS-shaped control plane; MongoDB wire protocol on port 27017 |
| MSK | Real Docker | Kafka-compatible broker via Redpanda |
| Amazon MQ | Real Docker | RabbitMQ broker via rabbitmq:3-management; AMQP + management console |
| Athena | In-process with DuckDB sidecar | Real SQL execution over S3 and Glue-backed views |
| Glue | In-process | Data Catalog, Schema Registry, tables consumed by Athena |
| EMR | In-process | Cluster (job flow) lifecycle, instance groups and fleets, steps, security configurations, tagging |
| Data Firehose | In-process | Streaming delivery, buffered flush to S3 with GZIP/ZIP/Snappy compression |
| Managed Service for Apache Flink | Real Docker | Kinesis Analytics V2 control plane; StartApplication runs a real Flink cluster (JobManager + TaskManager, image per RuntimeEnvironment), pulls the application JAR from local S3, and submits the job |
| ECS | Real Docker | Clusters, task definitions, tasks, services, capacity providers, task sets |
| EC2 | Real Docker | RunInstances launches containers, SSH key injection, UserData, IMDS, VPC resources |
| Lightsail | In-process | Instances, disks, static IPs, key pairs, ports, tags, regions, blueprints, bundles, operations |
| ACM | In-process | Certificate issuance and validation lifecycle |
| ECR | In-process with real registry | Repositories, docker push / pull, image-backed Lambda functions |
| Resource Groups Tagging API | In-process | GetResources, tag and untag resources, tag key and value discovery across services |
| SES | In-process | v1 and v2 APIs: send email, raw email, identity verification, DKIM, templates, configuration sets, account sending |
| OpenSearch | Real Docker | Domain CRUD, tags, versions, instance types, upgrade stubs |
| AppConfig | In-process | Applications, environments, profiles, hosted versions, deployments |
| AppConfigData | In-process | Configuration sessions and dynamic configuration retrieval |
| Bedrock Runtime | In-process stub | Dummy Converse and InvokeModel responses for local development |
| EKS | Real Docker, mock mode available | k3s clusters with live Kubernetes API server |
| MWAA | Real Docker, mock mode available | Real Apache Airflow (LocalExecutor) + Postgres metadata DB per environment; web/CLI proxy; S3-backed DAG sync |
| ELB v2 | In-process | ALB, NLB, target groups, listeners, routing rules, Lambda targets, tags |
| CodeBuild | In-process with real Docker | Real buildspec execution, CloudWatch logs, S3 artifacts |
| CodeDeploy | In-process with Lambda traffic shifting | Deployment groups, configs, lifecycle hooks, auto-rollback |
| CodePipeline | In-process orchestration | Pipelines, executions, S3 artifacts, approvals, local providers, custom workers |
| AWS Batch | In-process | Compute environments, job queues, job definitions, job submission and lifecycle |
| Auto Scaling | In-process with reconciler | Launch configs, ASGs, desired capacity reconciliation, lifecycle hooks |
| Application Auto Scaling | In-process | Scalable targets, target-tracking and step scaling policies, CloudWatch alarm creation, tagging (policies are stored but inert) |
| Elastic Beanstalk | In-process | Applications, application versions, environments, configuration templates, platform and solution stack metadata |
| AWS Backup | In-process | Vaults, backup plans, selections, simulated job lifecycle, recovery points |
| AWS Config | In-process | Config rules, configuration recorders, delivery channels, conformance packs, tagging |
| CloudTrail | In-process | Trails, event selectors (S3 data events with bucket/prefix matching), StartLogging/StopLogging, scheduled gzipped log file emission to the destination bucket at AWS-shaped key paths, IAM-deny path emits AccessDenied records |
| CloudFront | In-process | Distributions, origins, cache behaviors, invalidations, tagging |
| WAF v2 | In-process | Web ACLs, IP sets, regex pattern sets, rule groups, logging configs, resource associations, tagging (REGIONAL and CLOUDFRONT scopes) |
| Route53 | In-process | Hosted zones, SOA and NS records, resource record sets, change tracking, tagging |
| Cloud Map | In-process | HTTP and DNS namespaces, services, instance registration, discovery queries, operations, tagging |
| Transfer Family | In-process | Server lifecycle, user management, SSH key import, tagging |
| Textract | In-process stub | API-compatible stubs, dummy block data, async job simulation |
| Transcribe | In-process stub | Transcription jobs and custom vocabularies; jobs complete immediately, no real audio processing |
| Pricing | In-process with static snapshot | Product discovery, attributes, price list files, pagination |
| Cost Explorer | In-process | Cost synthesized from Floci resource state and pricing snapshots |
| Cost and Usage Reports | In-process with floci-duck sidecar | CUR 2.0 and FOCUS 1.2 columns, account-scoped storage, Parquet emission |
| BCM Data Exports | In-process | Export lifecycle, executions, update and delete operations |
Real Docker Integration
Floci uses real Docker containers when in-process emulation would reduce fidelity. This applies to stateful databases, connection-heavy protocols, runtimes, and build systems.
| Service | Default image | What is real |
|---|---|---|
| Lambda | public.ecr.aws/lambda/<runtime> |
AWS runtime environment, execution model, warm container pool |
| ElastiCache | valkey/valkey:8 |
Redis / Valkey protocol, ACL-based IAM auth, SigV4 validation |
| RDS PostgreSQL | postgres:16-alpine |
PostgreSQL engine, IAM auth, JDBC-compatible access |
| RDS MySQL / Aurora | mysql:8.0 |
MySQL engine, IAM auth, JDBC-compatible access |
| RDS MariaDB | mariadb:11 |
MariaDB engine, IAM auth, JDBC-compatible access |
| Neptune | tinkerpop/gremlin-server:3.7.3 |
TinkerPop Gremlin Server; Gremlin WebSocket on port 8182; SigV4 auth proxy |
| Neptune (openCypher) | neo4j:5-community |
Neo4j backend when FLOCI_SERVICES_NEPTUNE_DB_TYPE=neo4j; openCypher over Bolt |
| DocumentDB | mongo:7.0 |
MongoDB engine; MongoDB wire protocol on port 27017 |
| MSK | redpandadata/redpanda:latest |
Kafka-compatible broker via Redpanda |
| Amazon MQ | rabbitmq:3-management |
RabbitMQ broker; AMQP on port 5672, management console on 15672 |
| Managed Service for Apache Flink | apache/flink:<version> |
Apache Flink JobManager; image chosen per RuntimeEnvironment (FLINK-1_15 โฆ FLINK-1_20, FLINK-2_0 โฆ FLINK-2_3) |
| EC2 | AMI-mapped Linux images | Linux containers, SSH key injection, UserData, IMDS, IAM credentials |
| ECS | User-specified task image | Container lifecycle, start, stop, health checks |
| EKS | rancher/k3s:latest |
Kubernetes API server via k3s |
| MWAA | apache/airflow:<version>-python3.12 + postgres:16-alpine |
Real Apache Airflow (LocalExecutor: scheduler + webserver) with its own Postgres metadata DB; webserver/CLI reachable via Floci's proxy |
| CodeBuild | User-specified environment image | Buildspec execution, log streaming, S3 artifact upload |
| OpenSearch | opensearchproject/opensearch:2 |
Full OpenSearch engine with REST API |
| ECR | registry:2 |
OCI-compatible registry for docker push and docker pull |
Docker-backed services require the Docker socket:
docker run -d --name floci \
-p 4566:4566 \
-v /var/run/docker.sock:/var/run/docker.sock \
-u root \
floci/floci:latestOverriding default images
| Variable | Default |
|---|---|
FLOCI_SERVICES_ELASTICACHE_DEFAULT_IMAGE |
valkey/valkey:8 |
FLOCI_SERVICES_RDS_DEFAULT_POSTGRES_IMAGE |
postgres:16-alpine |
FLOCI_SERVICES_RDS_DEFAULT_MYSQL_IMAGE |
mysql:8.0 |
FLOCI_SERVICES_RDS_DEFAULT_MARIADB_IMAGE |
mariadb:11 |
FLOCI_SERVICES_MSK_DEFAULT_IMAGE |
redpandadata/redpanda:latest |
FLOCI_SERVICES_OPENSEARCH_DEFAULT_IMAGE |
opensearchproject/opensearch:2 |
FLOCI_SERVICES_KINESIS_ANALYTICS_DEFAULT_IMAGE |
(unset; chosen per RuntimeEnvironment) |
FLOCI_SERVICES_NEPTUNE_DEFAULT_IMAGE |
tinkerpop/gremlin-server:3.7.3 |
FLOCI_SERVICES_NEPTUNE_DEFAULT_NEO4J_IMAGE |
neo4j:5-community |
FLOCI_SERVICES_DOCDB_DEFAULT_IMAGE |
mongo:7.0 |
FLOCI_SERVICES_EKS_DEFAULT_IMAGE |
rancher/k3s:latest |
FLOCI_SERVICES_MWAA_DEFAULT_POSTGRES_IMAGE |
postgres:16-alpine |
FLOCI_SERVICES_ECR_REGISTRY_IMAGE |
registry:2 |
FLOCI_ECR_BASE_URI |
public.ecr.aws |
Persistence and Storage Modes
Floci can trade speed for durability depending on the workflow. Configure the default mode with FLOCI_STORAGE_MODE, or override storage per service.
| Mode | Behavior | Best for | Durability |
|---|---|---|---|
memory |
Entirely in RAM. Data is lost when the container stops. | CI and ephemeral tests | None |
persistent |
Loaded at startup and flushed to disk immediately on every write operation. | Simple local state preservation with immediate persistence | Medium |
hybrid |
In-memory performance with periodic async flushing every 5 seconds. | Local development | Good |
wal |
Write-ahead log. Every mutation is logged before responding. | Maximum durability | Highest |
Use memory for fast test runs. Use hybrid when you want state preserved across container restarts without much overhead.
For more detail, see the Storage Configuration documentation.
Multi-Account Isolation
Floci supports per-account resource isolation with no extra setup. If AWS_ACCESS_KEY_ID is exactly 12 digits, Floci uses it as the account ID. Resources created by one account are invisible to another.
AWS_ACCESS_KEY_ID=111111111111 aws sqs create-queue --queue-name orders
AWS_ACCESS_KEY_ID=222222222222 aws sqs create-queue --queue-name ordersAny other key format, such as test or AKIA..., causes Floci to fall back to FLOCI_DEFAULT_ACCOUNT_ID, which defaults to 000000000000.
STS temporary credentials are routed too: credentials from AssumeRole resolve to the assumed role's account, so the cross-account assume-role-then-provision pattern works locally. Resolution precedence is 12-digit AKID โ temporary-session lookup โ FLOCI_DEFAULT_ACCOUNT_ID.
See the Multi-Account Isolation docs.
SDK Integration
Point your existing AWS SDK at http://localhost:4566.
Java, AWS SDK v2
var client = DynamoDbClient.builder()
.endpointOverride(URI.create("http://localhost:4566"))
.region(Region.US_EAST_1)
.credentialsProvider(StaticCredentialsProvider.create(
AwsBasicCredentials.create("test", "test")))
.build();
client.createTable(b -> b
.tableName("demo-table")
.billingMode(BillingMode.PAY_PER_REQUEST)
.attributeDefinitions(
AttributeDefinition.builder().attributeName("pk").attributeType(ScalarAttributeType.S).build())
.keySchema(
KeySchemaElement.builder().attributeName("pk").keyType(KeyType.HASH).build()));
System.out.println(client.listTables().tableNames());Python, boto3
import boto3
client = boto3.client(
"ssm",
endpoint_url="http://localhost:4566",
region_name="us-east-1",
aws_access_key_id="test",
aws_secret_access_key="test",
)
client.put_parameter(
Name="/demo/app/message",
Value="hello from floci",
Type="String",
Overwrite=True,
)
response = client.get_parameter(Name="/demo/app/message")
print(response["Parameter"]["Value"])Node.js, AWS SDK v3
import { SQSClient, SendMessageCommand } from "@aws-sdk/client-sqs";
const client = new SQSClient({
endpoint: "http://localhost:4566",
region: "us-east-1",
credentials: { accessKeyId: "test", secretAccessKey: "test" },
});
await client.send(
new SendMessageCommand({
QueueUrl: "http://localhost:4566/000000000000/demo-queue",
MessageBody: "hello from floci",
}),
);Go, AWS SDK v2
package main
import (
"context"
"fmt"
"log"
"github.com/aws/aws-sdk-go-v2/config"
"github.com/aws/aws-sdk-go-v2/credentials"
"github.com/aws/aws-sdk-go-v2/service/s3"
)
func main() {
cfg, err := config.LoadDefaultConfig(context.TODO(),
config.WithRegion("us-east-1"),
config.WithCredentialsProvider(
credentials.NewStaticCredentialsProvider("test", "test", ""),
),
config.WithBaseEndpoint("http://localhost:4566"),
)
if err != nil {
log.Fatal(err)
}
client := s3.NewFromConfig(cfg, func(o *s3.Options) {
o.UsePathStyle = true
})
out, err := client.ListBuckets(context.TODO(), nil)
if err != nil {
log.Fatal(err)
}
fmt.Println(out.Buckets)
}Rust, AWS SDK
use aws_sdk_secretsmanager::config::{Credentials, Region};
use aws_sdk_secretsmanager::Client;
#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
let config = aws_config::defaults(aws_config::BehaviorVersion::latest())
.region(Region::new("us-east-1"))
.credentials_provider(Credentials::new("test", "test", None, None, "floci"))
.endpoint_url("http://localhost:4566")
.load()
.await;
let client = Client::new(&config);
client
.create_secret()
.name("demo/secret")
.secret_string("hello from floci")
.send()
.await?;
Ok(())
}Bash, AWS CLI
export AWS_ACCESS_KEY_ID=test
export AWS_SECRET_ACCESS_KEY=test
export AWS_DEFAULT_REGION=us-east-1
aws --endpoint-url http://localhost:4566 s3 mb s3://my-bucket
aws --endpoint-url http://localhost:4566 s3 lsTestcontainers
Floci has Testcontainers modules for starting isolated Floci instances directly from tests. This avoids shared state, manual daemon setup, and port conflicts.
| Language | Package | Latest | Registry | Source |
|---|---|---|---|---|
| Java | io.floci:testcontainers-floci |
1.4.0 |
Maven Central | GitHub |
| Node.js | @floci/testcontainers |
0.1.0 |
npm | GitHub |
| Python | testcontainers-floci |
0.1.1 |
PyPI | GitHub |
| Go | In progress | In progress | N/A | GitHub |
Java
<dependency>
<groupId>io.floci</groupId>
<artifactId>testcontainers-floci</artifactId>
<version>1.4.0</version>
<scope>test</scope>
</dependency>@Testcontainers
class S3IntegrationTest {
@Container
static FlociContainer floci = new FlociContainer();
@Test
void shouldCreateBucket() {
S3Client s3 = S3Client.builder()
.endpointOverride(URI.create(floci.getEndpoint()))
.region(Region.of(floci.getRegion()))
.credentialsProvider(StaticCredentialsProvider.create(
AwsBasicCredentials.create(floci.getAccessKey(), floci.getSecretKey())))
.forcePathStyle(true)
.build();
s3.createBucket(b -> b.bucket("my-bucket"));
}
}For Testcontainers 2.x / Spring Boot 4.x, use version 2.5.0.
Node.js / TypeScript
npm install --save-dev @floci/testcontainersimport { FlociContainer } from "@floci/testcontainers";
import { S3Client, CreateBucketCommand } from "@aws-sdk/client-s3";
describe("S3", () => {
let floci: FlociContainer;
beforeAll(async () => {
floci = await new FlociContainer().start();
});
afterAll(async () => {
await floci.stop();
});
it("creates a bucket", async () => {
const s3 = new S3Client({
endpoint: floci.getEndpoint(),
region: floci.getRegion(),
credentials: {
accessKeyId: floci.getAccessKey(),
secretAccessKey: floci.getSecretKey(),
},
forcePathStyle: true,
});
await s3.send(new CreateBucketCommand({ Bucket: "my-bucket" }));
});
});Python
pip install testcontainers-flociimport boto3
from testcontainers_floci import FlociContainer
def test_s3_create_bucket():
with FlociContainer() as floci:
s3 = boto3.client(
"s3",
endpoint_url=floci.get_endpoint(),
region_name=floci.get_region(),
aws_access_key_id=floci.get_access_key(),
aws_secret_access_key=floci.get_secret_key(),
)
s3.create_bucket(Bucket="my-bucket")Compatibility Testing
The compatibility-tests directory validates Floci across SDKs and tooling workflows.
| Module | Language / Tool | SDK / Client | Tests |
|---|---|---|---|
sdk-test-java |
Java 17 | AWS SDK for Java v2 | 1,326 |
sdk-test-node |
Node.js | AWS SDK for JavaScript v3 | 449 |
sdk-test-python |
Python 3 | boto3 | 311 |
sdk-test-go |
Go | AWS SDK for Go v2 + RDS Data API SDK v1 | 157 |
sdk-test-awscli |
Bash | AWS CLI v2 | 205 |
compat-terraform |
Terraform | v1.10+ | 22 |
compat-opentofu |
OpenTofu | v1.9+ | 16 |
compat-cdk |
AWS CDK | v2+ | 20 |
2,506 automated compatibility tests across 5 SDKs and 3 IaC tools.
Migrating from LocalStack
Floci is a drop-in replacement for LocalStack Community. The port, credentials, SDK configuration, and CLI endpoint pattern work the same way. Swap the image and keep going.
# Before
image: localstack/localstack
# After, standard image
image: floci/floci:latest
# After, if init scripts need AWS CLI or boto3
image: floci/floci:latest-compatLocalStack environment variables are translated automatically:
| LocalStack | Floci equivalent |
|---|---|
LOCALSTACK_HOST |
FLOCI_HOSTNAME |
PERSISTENCE=1 |
FLOCI_STORAGE_MODE=persistent |
LAMBDA_DOCKER_NETWORK |
FLOCI_SERVICES_LAMBDA_DOCKER_NETWORK |
LAMBDA_REMOVE_CONTAINERS=1 |
FLOCI_SERVICES_LAMBDA_EPHEMERAL=true |
DEBUG=1 |
QUARKUS_LOG_LEVEL=DEBUG |
Init scripts mounted under /etc/localstack/init/ run unchanged. The /_localstack/init and /_localstack/health endpoints are still served. Once the emulator is up, the log also ends with a LocalStack-style Ready. line, so tooling that watches the log for it โ such as the default wait strategy of Testcontainers' LocalStackContainer โ works unchanged. Set LOCALSTACK_PARITY=false to opt out of automatic translation.
See the full migration guide.
Image Tags
Every tag combines a variant and a channel.
| Channel | Standard | Compat with AWS CLI and boto3 |
|---|---|---|
| Release, floating | latest |
latest-compat |
| Release, pinned | x.y.z |
x.y.z-compat |
| Nightly, floating | nightly |
nightly-compat |
| Nightly, dated | nightly-mmddyyyy |
nightly-mmddyyyy-compat |
Use latest for stable releases, a pinned version for reproducible builds, and nightly to track main.
# Recommended
image: floci/floci:latest
# Includes AWS CLI and boto3
image: floci/floci:latest-compat
# Pinned release
image: floci/floci:1.5.11
# Track main
image: floci/floci:nightlyConfiguration
All settings are overridable through environment variables with the FLOCI_ prefix.
| Variable | Default | Description |
|---|---|---|
FLOCI_PORT |
4566 |
Port exposed by the Floci API |
FLOCI_DEFAULT_REGION |
us-east-1 |
Default AWS region |
FLOCI_DEFAULT_ACCOUNT_ID |
000000000000 |
Default AWS account ID |
FLOCI_BASE_URL |
http://localhost:4566 |
Base URL used when Floci returns service URLs |
FLOCI_HOSTNAME |
Unset | Hostname used in returned URLs when Floci runs inside Docker Compose |
FLOCI_STORAGE_MODE |
memory |
Storage mode: memory, persistent, hybrid, or wal |
FLOCI_STORAGE_PERSISTENT_PATH |
./data |
Directory used for persisted state |
FLOCI_ECR_BASE_URI |
public.ecr.aws |
ECR base URI used when pulling container images |
FLOCI_SERVICES_S3_ENFORCE_AUTH |
false |
Enforce S3 public/private read access and reject unknown signed S3 access keys |
Full reference: configuration docs
Multi-container Docker Compose
When your application runs in a different container, set FLOCI_HOSTNAME to the Floci service name so returned URLs, such as SQS QueueUrl values, resolve correctly.
services:
floci:
image: floci/floci:latest
ports:
- "4566:4566"
environment:
- FLOCI_HOSTNAME=floci
my-app:
environment:
- AWS_ENDPOINT_URL=http://floci:4566
depends_on:
- flociWithout this, services may return URLs using localhost, which points to the wrong container from the application container.
Community
Join the Floci community on Slack or GitHub Discussions. Feature ideas, compatibility questions, design tradeoffs, and rough proposals are welcome.
Sponsors
Floci is independent open source, funded by its users. If Floci saves you time,
consider sponsoring the project โ every
tier keeps the emulators fast, light, and free.
๐ฅ Gold
Large logo with top placement, a dedicated support channel, input on roadmap
priorities, and custom integration help.
Your logo here โ become a Gold sponsor.
๐ฅ Silver
Logo in this README and on floci.io, priority issue support, and a mention in
release notes.
Your logo here โ become a Silver sponsor.
๐ฅ Community
Name in this README, a sponsor badge on GitHub, and our sincere thanks.
Star History
Contributors
License
MIT. Use it however you want.
File: compatibility-tests/sdk-test-awscli/README.md
sdk-test-awscli
Compatibility tests for Floci using the AWS CLI v2 (2.22.35).
Tests are plain bash scripts that call aws CLI commands with --endpoint-url pointed at the emulator.
Services Covered
| Group | Description |
|---|---|
ssm |
Parameter Store โ put, get, path, tags |
sqs |
Queues, send/receive/delete, attributes |
sns |
Topics, publish, attributes |
s3 |
Buckets, objects, tagging, copy, delete |
dynamodb |
Tables, put/get/update/query/delete items |
iam |
Users, roles, create/get/delete |
sts |
GetCallerIdentity |
ses |
Identities, sending, quotas, notification attributes |
secretsmanager |
Create/get/put/list/tag/delete secrets |
kms |
Keys, aliases, encrypt/decrypt |
cognito |
User pools, clients |
s3-notifications |
S3 โ SQS event notifications |
Requirements
- AWS CLI v2
- bash
- jq
- bats-core (installed via
just setup-awscli)
Running
# All groups (from compatibility-tests/)
just test-awscli
# Run bats directly
./lib/run-bats-with-junit.sh sdk-test-awscli/test/ sdk-test-awscli/test-results/junit.xmlConfiguration
| Variable | Default | Description |
|---|---|---|
FLOCI_ENDPOINT |
http://localhost:4566 |
Floci emulator endpoint |
AWS credentials are always test / test / us-east-1.
Docker
docker build -t floci-sdk-awscli .
docker run --rm --network host floci-sdk-awscli
# Custom endpoint (macOS/Windows)
docker run --rm -e FLOCI_ENDPOINT=http://host.docker.internal:4566 floci-sdk-awscliFile: compatibility-tests/sdk-test-go/README.md
sdk-test-go
Compatibility tests for Floci using the AWS SDK for Go v2 (1.41.4).
Services Covered
| Group | Description |
|---|---|
ssm |
Parameter Store โ put, get, label, history, path, tags |
sqs |
Queues, send/receive/delete, DLQ, visibility |
sns |
Topics, subscriptions, publish, SQS delivery |
s3 |
Buckets, objects, tagging, copy, batch delete |
s3-cors |
CORS configuration |
s3-notifications |
S3 โ SQS event notifications |
dynamodb |
Tables, CRUD, batch, TTL, tags |
lambda |
Create/invoke/update/delete functions |
iam |
Users, roles, policies, access keys |
sts |
GetCallerIdentity, AssumeRole, GetSessionToken |
secretsmanager |
Create/get/put/list/delete secrets, versioning, tags |
kms |
Keys, aliases, encrypt/decrypt, data keys, sign/verify |
kinesis |
Streams, shards, PutRecord/GetRecords |
cloudwatch |
PutMetricData, ListMetrics, GetMetricStatistics, alarms |
rds-data |
RDS Data API execute statements, transactions, result fields with SDK v1 and v2 |
Requirements
- Go 1.24+
Running
# All groups
gotestsum --junitfile test-results.xml ./tests/...
# Specific tests
go test ./tests/ -run TestSsm
# Via just (from compatibility-tests/)
just test-goConfiguration
| Variable | Default | Description |
|---|---|---|
FLOCI_ENDPOINT |
http://localhost:4566 |
Floci emulator endpoint |
AWS credentials are always test / test / us-east-1.
Docker
docker build -t floci-sdk-go .
docker run --rm --network host floci-sdk-go
# Custom endpoint (macOS/Windows)
docker run --rm -e FLOCI_ENDPOINT=http://host.docker.internal:4566 floci-sdk-goFile: compatibility-tests/sdk-test-java/README.md
sdk-test-java
Compatibility tests for Floci using the AWS SDK for Java v2 (2.31.8).
Runs 352 tests across 17 test classes against a live Floci instance โ no mocks.
Services Covered
| Test class | Description |
|---|---|
SsmTest |
Parameter Store โ put, get, path, tags |
SqsTest |
Queues, send/receive/delete, DLQ, visibility |
SnsTest |
Topics, subscriptions, publish, SQS delivery |
S3Test |
Buckets, objects, tagging, copy, multipart, batch delete |
DynamoDbTest |
Tables, CRUD, batch, TTL, tags, streams |
DynamoDbScanConditionTests |
Scan filter and condition expressions |
LambdaTest |
Create/invoke/update/delete functions |
IamTest |
Users, roles, policies, access keys |
StsTest |
GetCallerIdentity, AssumeRole, GetSessionToken |
SecretsManagerTest |
Create/get/put/list/delete secrets, versioning, tags |
KmsTest |
Keys, aliases, encrypt/decrypt, data keys, sign/verify |
CloudWatchTest |
PutMetricData, ListMetrics, GetMetricStatistics, alarms |
CloudFormationVirtualHostTests |
Virtual host style S3 access via CloudFormation |
ApigwSfnJsonataCrudlTests |
API Gateway + Step Functions JSONata CRUDL integration |
ApiGatewayV2WebSocketAndExtendedOpsTest |
API GW v2 WebSocket APIs, Update ops, Route/Integration Responses, Models, Tagging |
Ec2Tests |
EC2 instances, VPCs, security groups, subnets |
AppSyncTest |
GraphQL API CRUDL, data sources, resolvers, functions, types, API keys, tags, schema validation |
EcsTests |
ECS clusters, task definitions, services |
Adding a New Test
Create a standard JUnit 5 test class in src/test/java/com/floci/test/. Tests run against a live Floci instance using real AWS SDK clients.
Requirements
- Java 17+
- Maven
Running
# All tests
mvn test -q
# Specific test class
mvn test -Dtest=S3Test
# Via just (from compatibility-tests/)
just test-javaConfiguration
| Variable | Default | Description |
|---|---|---|
FLOCI_ENDPOINT |
http://localhost:4566 |
Floci emulator endpoint |
AWS credentials are always test / test / us-east-1.
Docker
docker build -t floci-sdk-java .
docker run --rm --network host floci-sdk-java
# Custom endpoint (macOS/Windows)
docker run --rm -e FLOCI_ENDPOINT=http://host.docker.internal:4566 floci-sdk-javaFile: compatibility-tests/sdk-test-node/README.md
sdk-test-node
Compatibility tests for Floci using the AWS SDK for JavaScript v3 (3.1003.0).
Services Covered
| Group | Description |
|---|---|
ssm |
Parameter Store โ put, get, label, history, path, tags |
sqs |
Queues, send/receive/delete, DLQ, visibility |
sns |
Topics, subscriptions, publish, SQS delivery |
s3 |
Buckets, objects, tagging, copy, batch delete |
s3-cors |
CORS configuration |
s3-notifications |
S3 โ SQS and S3 โ SNS event notifications |
dynamodb |
Tables, CRUD, batch, TTL, tags |
lambda |
Create/invoke/update/delete functions |
iam |
Users, roles, policies, access keys |
sts |
GetCallerIdentity, AssumeRole, GetSessionToken |
secretsmanager |
Create/get/put/list/delete secrets, versioning, tags |
kms |
Keys, aliases, encrypt/decrypt, data keys, sign/verify |
kinesis |
Streams, shards, PutRecord/GetRecords |
cloudwatch |
PutMetricData, ListMetrics, GetMetricStatistics, alarms |
cloudformation-naming |
Auto physical name generation, explicit name precedence, cross-reference |
cognito |
User pools, clients, AdminCreateUser, InitiateAuth, GetUser |
cognito-oauth |
Resource server CRUD, confidential clients, /oauth2/token, OIDC discovery, JWKS/JWT verification |
apigatewayv2 |
HTTP & WebSocket API lifecycle, routes, integrations, authorizers, stages, deployments, route responses, models, tagging |
Requirements
- Node.js 20+
- npm
Running
npm install
# All groups
npm test
# Via just (from compatibility-tests/)
just test-typescriptConfiguration
| Variable | Default | Description |
|---|---|---|
FLOCI_ENDPOINT |
http://localhost:4566 |
Floci emulator endpoint |
AWS credentials are always test / test / us-east-1.
Docker
docker build -t floci-sdk-node .
docker run --rm --network host floci-sdk-node
# Custom endpoint (macOS/Windows)
docker run --rm -e FLOCI_ENDPOINT=http://host.docker.internal:4566 floci-sdk-nodeTLS Tests
The tls.test.ts file tests HTTPS connectivity with AWS SDK v3 clients.
The apigatewayv2-websocket-tls.test.ts file tests WebSocket over TLS (WSS),
covering connect/disconnect, route selection, broadcast, authorization,@connections API, binary frames, and payload limits.
These tests always run as part of the suite โ they derive the HTTPS/WSS endpoint
from the HTTP endpoint by swapping the scheme (http://floci:4566 โ https://floci:4566,ws:// โ wss://).
Since Floci serves HTTP and HTTPS simultaneously when TLS is enabled, existing HTTP
tests are unaffected.
The Dockerfile sets NODE_TLS_REJECT_UNAUTHORIZED=0 so self-signed certs are accepted.
The CI workflow starts Floci with FLOCI_TLS_ENABLED=true.
To run locally:
# 1. Start Floci with TLS enabled
FLOCI_TLS_ENABLED=true ./mvnw quarkus:dev
# 2. Run all tests (including TLS)
NODE_TLS_REJECT_UNAUTHORIZED=0 npm testFile: compatibility-tests/sdk-test-python/README.md
sdk-test-python
Compatibility tests for Floci using boto3 (1.37.1).
Services Covered
| Group | Description |
|---|---|
ssm |
Parameter Store โ put, get, label, history, path, tags |
sqs |
Queues, send/receive/delete, DLQ, visibility |
sns |
Topics, subscriptions, publish, SQS delivery |
s3 |
Buckets, objects, tagging, copy, batch delete |
s3-cors |
CORS configuration |
s3-notifications |
S3 โ SQS event notifications |
dynamodb |
Tables, CRUD, batch, TTL, tags |
lambda |
Create/invoke/update/delete functions |
iam |
Users, roles, policies, access keys |
sts |
GetCallerIdentity, AssumeRole, GetSessionToken |
secretsmanager |
Create/get/put/list/delete secrets, versioning, tags |
kms |
Keys, aliases, encrypt/decrypt, data keys, sign/verify |
kinesis |
Streams, shards, PutRecord/GetRecords |
cloudwatch-metrics |
PutMetricData, ListMetrics, GetMetricStatistics, alarms |
cloudformation-naming |
Auto physical name generation, explicit name precedence, cross-reference |
cognito |
User pools, clients, AdminCreateUser, InitiateAuth, GetUser |
Requirements
- Python 3.9+
- pip
Running
pip install -r requirements.txt
# All groups
pytest tests/ --junit-xml=test-results/junit.xml
# Specific tests
pytest tests/test_s3.py
# Via just (from compatibility-tests/)
just test-pythonConfiguration
| Variable | Default | Description |
|---|---|---|
FLOCI_ENDPOINT |
http://localhost:4566 |
Floci emulator endpoint |
AWS credentials are always test / test / us-east-1.
Docker
docker build -t floci-sdk-python .
docker run --rm --network host floci-sdk-python
# Custom endpoint (macOS/Windows)
docker run --rm -e FLOCI_ENDPOINT=http://host.docker.internal:4566 floci-sdk-pythonFile: compatibility-tests/README.md
floci-compatibility-tests
Compatibility test suite for Floci โ a local AWS emulator.
Verifies that standard AWS tooling (SDKs, CDK, OpenTofu/Terraform) works correctly against the emulator without modification. Tests run against a live Floci instance and use real AWS SDK clients โ no mocks.
Quick Start
# Install just (task runner)
# macOS: brew install just
# Linux: cargo install just
# Copy and configure environment
cp env.example .env
# Install dependencies
just setup
# Run all tests
just test-all
# Run specific SDK tests
just test-python
just test-typescript
just test-awscliTest Runners
| Module | Language | Test Framework | Command |
|---|---|---|---|
sdk-test-python |
Python 3 | pytest | just test-python |
sdk-test-node |
TypeScript | vitest | just test-typescript |
sdk-test-awscli |
Bash / AWS CLI | bats-core | just test-awscli |
sdk-test-java |
Java 17 | JUnit 5 | just test-java |
sdk-test-go |
Go 1.24 | go test | just test-go |
IaC Compatibility
| Module | Tool | Command |
|---|---|---|
compat-cdk |
AWS CDK v2 | ./run.sh |
compat-opentofu |
OpenTofu | ./run.sh |
compat-terraform |
Terraform | ./run.sh |
Prerequisites
- Floci running on
http://localhost:4566(or setFLOCI_ENDPOINT) - Docker โ required for Lambda invocation tests
- just โ task runner for orchestration
Per-module requirements:
| Module | Requirements |
|---|---|
sdk-test-python |
Python 3.9+, pip |
sdk-test-node |
Node.js 20+, npm, vitest |
sdk-test-awscli |
AWS CLI v2, bash, jq |
sdk-test-java |
Java 17+, Maven |
sdk-test-go |
Go 1.24+ |
Setup
# Setup all SDKs
just setup
# Setup individual SDKs
just setup-python # pip install -r requirements.txt
just setup-typescript # npm install
just setup-awscli # Clone bats-core, bats-support, bats-assertRunning Tests
All SDKs
just test-allIndividual SDKs
# Python (pytest)
just test-python
# TypeScript (vitest)
just test-typescript
# AWS CLI (bats-core)
just test-awscliBats-based suites keep their normal console output and also write JUnit XML reports:
sdk-test-awscli/test-results/junit.xmlcompat-cdk/test-results/junit.xmlcompat-terraform/test-results/junit.xmlcompat-opentofu/test-results/junit.xml
Configuration
All modules read from environment variables (see .env.example):
FLOCI_ENDPOINT=http://localhost:4566
AWS_ACCESS_KEY_ID=test
AWS_SECRET_ACCESS_KEY=test
AWS_DEFAULT_REGION=us-east-1Running with Docker
Each module includes a Dockerfile for isolated execution:
# Python
docker build -t floci-sdk-python sdk-test-python/
docker run --rm --network host floci-sdk-python pytest
# TypeScript
docker build -t floci-sdk-node sdk-test-node/
docker run --rm --network host floci-sdk-node npm testOn macOS/Windows, use host.docker.internal instead of localhost:
docker run --rm -e FLOCI_ENDPOINT=http://host.docker.internal:4566 floci-sdk-python pytestExit Codes
All test runners exit 0 on full pass and non-zero if any test fails โ suitable for CI pipelines.
File: docs/configuration/application-yml.md
application.yml Reference
!!! note "Moved"
This page has moved to Advanced โ application.yml Reference.
If you run the published Docker image, you don't need an `application.yml` โ all settings are configured through `FLOCI_*` environment variables. See the [Environment Variables Reference](./environment-variables.md).