EKS pulls from local ECR, Aurora MySQL 8.4, Python 3.13 images, and Lambda/S3/Cognito fixes

July 9, 2026 · v1.4.1

v1.4.1 is the first patch release on top of 1.4.0 “Areson”. EKS clusters now pull container images from local ECR with zero manual wiring, Aurora MySQL gains 8.4 support with version-mapped container images, EventBridge Pipes joins the region-isolated services, both Docker images move to Python 3.13, and a batch of community-reported 1.4.0 regressions and long-standing bugs are fixed.

EKS — clusters pull images from local ECR

• Every k3s cluster boots with an ECR registry mirror. MiniStack now injects /etc/rancher/k3s/registries.yaml into each cluster's k3s container before it starts, mapping the cluster's ECR registry hostname (<account>.dkr.ecr.<region>.amazonaws.com) to the MiniStack gateway. Push an image to local ECR, then kubectl run --image <account>.dkr.ecr.<region>.amazonaws.com/repo:tag — containerd pulls it through the mirror and the pod runs. The mirror endpoint is MiniStack's own address on the shared Docker network when one is detected, and host.docker.internal (wired via host-gateway) when MiniStack runs on the host. Verified end-to-end: image pushed to local ECR, pod pulled it and reached Running. Reported by @L3337.

RDS — Aurora MySQL 8.4 and version-mapped images

• Aurora MySQL containers boot the MySQL version you asked for. The engine-version track (5.7 / 8.0 / 8.4) now selects the matching MySQL image instead of the floating mysql:8 tag, which had started silently booting MySQL 8.4 for Aurora MySQL 8.0 test cases. DescribeDBEngineVersions returns the full creatable Aurora MySQL catalog with correct per-family parameter groups — including the new 8.4.mysql_aurora.8.4.7 / aurora-mysql8.4 (GA May 2026) — an explicit EngineVersion outside the catalog is rejected with the AWS error shape, and aurora-mysql8.4 parameter-group defaults omit skip-character-set-client-handshake (removed in MySQL 8.4). Contributed by @Areson.

EventBridge Pipes — region-isolated state

• Pipes joins the multi-region services. Pipe records and stream positions move to account+region scope, continuing the 1.4.0 multi-region work: same-name pipes in different regions no longer collide, and the background poller processes each pipe under its own account and region. Legacy persisted state migrates by recovering each pipe's region from its ARN. Contributed by @Areson.

Docker images — Python 3.13 base

• Both images move from python:3.12 to python:3.13, clearing the CPython 3.12 interpreter CVEs flagged by image scanners; CI now runs the suite on 3.13 to match the shipped interpreter. The full image also runs apt-get upgrade so Debian base packages pick up security patches on every rebuild, as the Alpine image already did. Contributed by @scottschreckengaust.

Lambda

• Concurrent provided.* invocations no longer fail with ETXTBSY (“Text file busy”). Each invocation extracted the function zip into its own temp directory and exec'd the bootstrap binary from it; while one thread still held the extraction's write descriptor, another thread's process spawn let the child inherit it, and executing the binary failed — a classic fork/exec race. Extraction is now content-addressed (one shared read-only directory per code sha256, matching real Lambda's read-only /var/task) and spawns are serialized against extraction so the race cannot occur. Reported by @crestonbunch.
• provided.* runtimes get AWS_LAMBDA_FUNCTION_MEMORY_SIZE back. A 1.4.0 regression: reserved-name filtering stripped it (plus AWS_LAMBDA_FUNCTION_VERSION and AWS_LAMBDA_LOG_STREAM_NAME) from the user environment, and the provided-runtime executor — unlike the container, local, and warm-worker paths — never re-injected them, so the Rust lambda_runtime crate crashed on startup. All three are now set from the function configuration, matching the other executors and real AWS. Reported by @crestonbunch.
• SQS event source mappings deliver messageAttributes in camelCase. Records forwarded to functions carried the PascalCase inner keys SQS uses on the wire (StringValue/DataType), but real Lambda re-serializes them to camelCase before invoking. Typed handler bindings — e.g. Java's SQSEvent.MessageAttribute — saw all-null attributes and failed on correctly-sent messages. The ESM now applies the same transformation as AWS at the delivery boundary. Reported by @w-zx.

S3

• versionId survives payload persistence to a volume. With S3_PERSIST=1, the on-disk metadata sidecar never recorded the object's version id, and every write path persisted the sidecar before the id was assigned — so after a restart, GET/HEAD returned no x-amz-version-id for objects on the volume. The sidecar now stores the version id and is written after version assignment. Reported by @adzcodemi.

Cognito

• ListUsers parses quoted attribute names in Filter. The parser only matched unquoted attribute names, but AWS's documented syntax also accepts the quoted form ("email" = "value" — used in AWS's own API-reference sample), and on any parse failure MiniStack silently returned all users. Both forms now parse, and an unparseable filter logs a warning. Contributed by @kjdev.

Upgrade

docker pull ministackorg/ministack:1.4.1
docker run -d -p 4566:4566 ministackorg/ministack:1.4.1

Or pin in compose.yaml:

services:
  ministack:
    image: ministackorg/ministack:1.4.1
    ports:
      - "4566:4566"