Build1 publisher3 min readPublished
LocalStack's March image ties every CI run to a registered account's auth token
The 2026.03.0 image will not boot without LOCALSTACK_AUTH_TOKEN, and the acknowledgement bypass expired on April 6. Teams pinning the archived Community build get no further security updates, and a free MIT-licensed emulator has moved into the gap.
The Engineer · Build desk

What happened
- LocalStack shipped version 2026.03.0 on March 23, 2026, archived its GitHub repositories, and merged everything into one Docker image that refuses to start without a LOCALSTACK_AUTH_TOKEN tied to a registered account.
- A free Hobby plan covers non-commercial use with unlimited CI after an initial credit cap was walked back, while commercial use starts at $39 a month under the February 2026 pricing revision.
- Floci, an MIT-licensed emulator that runs S3, DynamoDB, Lambda and SQS in Docker with no account or token, is being pitched as the drop-in replacement.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- decision Teams choose between carrying a LocalStack token as a CI secret and re-pointing their compose files at another emulator, and the pinned archived build is a wasting third option now that its security fixes have stopped.
- exposure Any runner that does not receive the token gets a container that never boots, so ephemeral agents and builds triggered from forks are the first places local emulation fails.
- cost For commercial teams the emulator stops being free tooling and becomes a subscription line that a budget owner has to approve and renew.
- capability Tests that need API Gateway v2, Cognito, S3 Object Lock or IAM-authenticated databases can run without paying for a tier, if the free emulator's coverage of those services holds on your API surface.
The gate is at boot. The unified LocalStack image checks for LOCALSTACK_AUTH_TOKEN and refuses to start when it is absent [2]. In a pipeline that shows up as a container that never comes up, one step before the tests that would have told you something useful. The token is tied to a registered account [2], so it is a secret that has to reach every runner, ephemeral agents included. The variable that let you acknowledge the account requirement and carry on, LOCALSTACK_ACKNOWLEDGE_ACCOUNT_REQUIREMENT=1, stopped working on April 6, 2026 [3]. LocalStack set out the direction in a December 2025 post titled "The Road Ahead for LocalStack" [16].
Pinning the last free build is the obvious workaround, and it gets less safe the longer you hold it. Source for the old Community image is archived through v4.14.0, and LocalStack has stopped patching that line [5].
Floci's design choices produce the footprint difference the dev.to writeup reports. It is built on Quarkus and compiled to a GraalVM native binary, so there is no JVM or Python runtime to boot [8]. It answers on http://localhost:4566, so the AWS CLI, the official SDKs, Terraform and Testcontainers all work against it with dummy credentials [7]. Lambda runs in a real container: Floci pulls the genuine AWS Lambda runtime image, starts a container, runs the function and tears it down, and RDS and ElastiCache come up as real containers on demand [9]. (The name comes from cirrocumulus floccus, the cloud formation that looks like popcorn [17].)
Now the numbers. Both sets come from the projects' own READMEs. Floci advertises about 24 ms startup and 13 MiB idle; LocalStack's own README claims about 3.3 s and 143 MiB [11]. That is roughly 137 times on startup and 11 times on idle memory [18][19]. One hands-on check put Floci nearer 130 ms and LocalStack at several seconds [14]. Even measured Floci against claimed LocalStack, the ratio is about 25 [20]. For that to matter to you, emulator startup has to be a real share of your job time. The dev.to piece assumes CI spins the emulator up hundreds of times a day [24]; at 300 starts, saving 3.17 s each is about 16 minutes of wall time a day [21]. That is worth having when every test job boots its own emulator and the jobs are short, and it is noise when one long-lived container serves the whole suite.
The compatibility figure needs the same treatment. floci.io reports a 100 percent pass rate across 1,925 SDK tests as of August 2026 [13]. A project's own suite passing completely means the suite covers what the project implemented. It transfers to your stack only if your tests touch nothing outside that surface, and the same writeup concedes that LocalStack still wins on breadth and maturity [15]. The services Floci lists as free where LocalStack gates them, API Gateway v2, Cognito, S3 Object Lock and IAM-authenticated databases [10], are where I would look for the gap first.
Commercial use of LocalStack starts at $39 a month under the February 2026 pricing revision [6], which is $468 a year [22]. Against that, migration is described as a one-line image swap in an existing Docker Compose file [12]. One line is cheap to revert. Running both images against the same test suite would show which AWS APIs your tests actually depend on.
What to watch
- Whether LocalStack's Hobby plan keeps unlimited CI or reinstates a credit cap on free runs.
- Whether anyone publishes cold-start and idle-memory numbers for both images on the same CI runner.
- Whether Floci closes the breadth gap the dev.to comparison concedes to LocalStack.