v1.3.14 — Unified container networking, private registries, and an official Testcontainers Java module

April 24, 2026 · v1.3.14

Four headline themes in this release: one env var that replaces three older networking knobs, LocalStack-parity for the most-asked-for Lambda feature, a clean path for air-gapped and private-registry setups, and an official Testcontainers Java module that stops leaking containers on Podman.

1. DOCKER_NETWORK — one knob for every sidecar

Before 1.3.14, connecting real-infrastructure sidecars (RDS Postgres, ElastiCache Redis, EKS k3s) to your Compose network meant fighting $HOSTNAME auto-detection — which silently failed whenever you set an explicit hostname: in your compose file.

Now there's one env var. Set it, and every nested container (RDS, EKS, ElastiCache, Lambda) joins the named network. Endpoint.Address on RDS and ElastiCache also flips from localhost to the routable container IP — so Lambda containers on the same network can actually reach them.

# docker-compose.yml
services:
  ministack:
    image: ministackorg/ministack:latest
    environment:
      DOCKER_NETWORK: ${COMPOSE_PROJECT_NAME}_default
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock

The legacy LAMBDA_DOCKER_NETWORK still works as a fallback. No breaking changes.

2. LAMBDA_DOCKER_FLAGS — LocalStack parity for Lambda containers

TLS proxies, custom CA certs, custom DNS, shared memory sizes, and capability tweaks — the things you need to debug Lambda behind a corporate proxy. LocalStack has this; now MiniStack does too.

docker run -e LAMBDA_DOCKER_FLAGS="\
  -v /etc/ssl/corp-ca:/opt/ca:ro \
  -e SSL_CERT_FILE=/opt/ca/ca.crt \
  -e NODE_EXTRA_CA_CERTS=/opt/ca/ca.crt \
  --dns 10.0.0.53 \
  --add-host internal-api:10.0.0.42" \
  ministackorg/ministack

Supported flags: -e, -v, --dns, --network, --cap-add, -m, --shm-size, --tmpfs, --add-host, --privileged, --read-only. Unknown flags are silently ignored. Default unset → behaviour identical to real AWS. Thanks @hzhou0.

3. MINISTACK_IMAGE_PREFIX — air-gapped and private-registry setups

If you run CI inside a network that can't reach docker.io or public.ecr.aws directly, every nested image MiniStack pulls (postgres, mysql, redis, k3s, Lambda runtimes) used to break your build. Set MINISTACK_IMAGE_PREFIX and every nested image is rewritten through your mirror.

docker run -e MINISTACK_IMAGE_PREFIX=proxy.corp.net ministackorg/ministack
# postgres:15-alpine            → proxy.corp.net/postgres:15-alpine
# redis:7-alpine                → proxy.corp.net/redis:7-alpine
# public.ecr.aws/lambda/python:3.12 → proxy.corp.net/public.ecr.aws/lambda/python:3.12

The rewrite is idempotent — already-prefixed images are left alone. Thanks @TJ-developer for surfacing this.

4. Testcontainers Java — private-registry aware, Podman-safe cleanup

The companion testcontainers-ministack Java module bumped to 0.1.4 alongside 1.3.14:

• Auto-forwards Testcontainers' hub.image.name.prefix into the MiniStack container as MINISTACK_IMAGE_PREFIX, so your whole test stack pulls through the same registry mirror.
• Reaps orphaned sidecars on stop() — RDS Postgres, ElastiCache Redis, EKS k3s, ECS task containers spawned on the host engine are cleaned up automatically. Closes a long-standing Podman-visible leak (containers kept running after test exit because Ryuk didn't see them). Best-effort, logged, never throws — so cleanup can't mask a test failure.

<dependency>
  <groupId>org.ministack</groupId>
  <artifactId>testcontainers-ministack</artifactId>
  <version>0.1.4</version>
  <scope>test</scope>
</dependency>

try (MiniStackContainer ms = new MiniStackContainer().withRealInfrastructure()) {
    ms.start();
    // CreateDBInstance spins up a real postgres container
    // stop() reaps it — no leaks, Docker or Podman
}

Also in this release

• Fixed: S3 zero-byte PutObject checksum mismatch with Java SDK v2 — aws-chunked decoder now handles the terminator-only chunk correctly (reported by @JoeHale).
• Fixed: SNS HTTP subscription confirmations no longer silently skipped — replaced aiohttp (never shipped in the image) with stdlib urllib wrapped in asyncio.to_thread. Basic-auth in URLs (http://user:pass@host/…) is promoted to Authorization: Basic per real AWS (reported by @anghel93).
• Fixed: Lambda RIE log isolation — container.logs(since=invoke_time) now returns only the current invocation's logs, not every prior warm-container invocation (thanks @ksjoberg).
• Fixed: Lambda RIE retry loop no longer costs 100ms on the first attempt — sleep moved to the retry path only (thanks @ksjoberg).
• Fixed: container.stats(stream=False, one_shot=True) halves the per-probe cost for memory sampling (thanks @ksjoberg).
• Fixed: Lambda slash-form Python handler paths (pkg/sub/mod.fn) now resolve like AWS's awslambdaric bootstrap (thanks @ksjoberg).
• Fixed: RDS DescribeDBInstances now speaks both SigV4 Query and JSON; Aurora cluster membership populated correctly for instances created inside a cluster.
• Added: Secrets Manager ListSecrets honours IncludePlannedDeletion with DeletedDate per the AWS spec (thanks @weeco).
• Changed: Server bumps the asyncio default executor to 64 threads on startup, preventing concurrent Lambda cold-starts from queueing behind blocking work on CPU-constrained CI runners. Override with MINISTACK_WORKER_THREADS.

Upgrade

docker pull ministackorg/ministack:1.3.14
# or
docker pull ministackorg/ministack:latest

Full changelog: CHANGELOG.md.