Lambda MicroVMs in Docker, CloudFront key groups, and in-place CloudFormation updates

September 25, 2026 · v1.5.17

v1.5.17 makes Lambda MicroVMs run: with Docker available, an image is built from the Dockerfile in its codeArtifact and RunMicrovm starts it. It also adds CloudFront public keys and key groups, pages Step Functions execution history, and lets more CloudFormation types keep their id on an update.

New

• Lambda MicroVMs — images build and run in Docker. With Docker available, CreateMicrovmImage / UpdateMicrovmImage build the codeArtifact Dockerfile (CREATING → CREATED / CREATE_FAILED), call the /ready and /validate hooks, and RunMicrovm runs the image. Only the disk is snapshotted. Contributed by @edersonbrilhante.
• CloudFront — public keys and key groups. CreatePublicKey, GetPublicKey, GetPublicKeyConfig, UpdatePublicKey, DeletePublicKey, ListPublicKeys and the same six for key groups, with PublicKeyInUse / ResourceInUse on delete. Contributed by @fabio-andre-rodrigues.
• Step Functions — execution history pagination. GetExecutionHistory pages with nextToken, and includeExecutionData=false drops input and output. Contributed by @jayjanssen.
• CloudFormation — more types update in place. AppConfig, AppSync GraphQL APIs and API keys, Auto Scaling groups, policies and scheduled actions, VPCs, subnets, security groups, launch templates, internet gateways, route tables and routes keep their id on a No interruption change instead of being recreated. Contributed by @iot-rocket.

Fixes

• CloudFormation — import change sets are validated and refused. IMPORT change sets are validated and listed as Import changes; executing one is refused. Every change carries Type: Resource. Contributed by @iot-rocket.
• SSM — GetParameter reads name:version and name:label. They answered ParameterNotFound; a missing version or label is ParameterVersionNotFound. Reported by @lobodpav.
• Lambda — ReservedConcurrentExecutions=0 throttles every invoke. Zero was treated as unset. Contributed by @AdrianAcala.
• Step Functions — Secrets Manager SecretBinary. The SDK integration passes literal text instead of base64. Contributed by @jayjanssen.
• Auto Scaling — scaling policies and scheduled actions keep their members. Target tracking, step and predictive settings, StartTime, EndTime and TimeZone were dropped. Contributed by @iot-rocket.
• EC2 — subnets, launch templates and route tables answer their attributes. Subnet DNS and IPv6 attributes, launch template tagSet and newest-first versions, and every route destination and target. Contributed by @iot-rocket.
• CloudFormation — a failed update rolls back its in-place changes. Changed resources are reverted, and a failed revert lands in UPDATE_ROLLBACK_FAILED. Contributed by @iot-rocket.
• CloudFormation — ECS cluster settings and stack tags. ClusterSettings, DefaultCapacityProviderStrategy and Configuration read back, and EC2 network resources carry the stack's tags. Contributed by @iot-rocket.

Upgrade

docker pull ministackorg/ministack:1.5.17
docker run -d -p 4566:4566 ministackorg/ministack:1.5.17

Or pin in compose.yaml:

services:
  ministack:
    image: ministackorg/ministack:1.5.17
    ports:
      - "4566:4566"