0.4.0

0.4.0 (2026-09-01)

Features

• batchDeleteObjects in ObjectStorage (#18) (516b1e5), closes #17
• compat: add official OCI CLI compatibility suite (#19) (8a51f27)

0.3.0

🎉 Highlights

This release adds Container Engine for Kubernetes (OKE) and hardens prefix PAR authorization. Focused release on adding OCI's managed Kubernetes service and closing a subtle Object Storage authorization gap.

☸️ New: Container Engine for Kubernetes (OKE)

OCI's OKE service is now supported (#12), with compatibility suites. This is OCI's managed Kubernetes offering, and it joins the growing family of managed-Kubernetes emulations across the multi-cloud family: EKS on floci (AWS), GKE on floci-gcp (with real k3s), and now OKE on floci-oci. Real Kubernetes workflows across all four clouds can now be tested locally.

🔒 Prefix PAR authorization fix

Prefix PARs (AnyObjectWrite / AnyObjectRead) were always rejecting access (#10), even when the request should have been authorized. This is a correctness fix rather than a hardening — the previous behavior was effectively "prefix PARs don't work" — and it enables the real OCI Object Storage prefix-based PAR pattern to function against floci-oci.

✨ New Features

• feat(oke): Container Engine for Kubernetes (OKE) emulator service and compatibility suites by @gvelez in #12

🐛 Bug Fixes

• fix(objectstorage): prefix PARs (AnyObjectWrite / AnyObjectRead) no longer always reject access by @hectorvent in #10

Full Changelog: 0.2.0...0.3.0

0.2.0

0.2.0 (2026-08-05)

Bug Fixes

• tls: register BouncyCastle before the persisted-cert reuse check (#6) (6c12a14)

Features

• docker: compat image with the OCI CLI and Python SDK preconfigured (91f0535)
• docker: label all containers/volumes, own the floci-oci- prefix (#5) (a7f6ecf)
• release: one-button release cut from main (#8) (a4a8a2a)

Performance Improvements

• docker: stop duplicating the native binary into a second image layer (#7) (72e4920)

0.1.0

🎉 Highlights

Initial release of floci-oci, a local Oracle Cloud Infrastructure emulator and the fourth member of the Floci family. It emulates 7 OCI services on a single port (4599) over real OCI wire protocols, so the OCI SDKs, the OCI CLI, Terraform and OpenTofu work unchanged against http://localhost:4599.

Validated by 414 unit and REST integration tests that run without Docker, plus four compatibility suites exercised against a live emulator: oci-java-sdk (18 tests), the OCI Python SDK (20 tests), Terraform (6) and OpenTofu (6).

Oracle Cloud has no official local emulator. Testing OCI integrations has meant a real tenancy, real credentials and real network round trips, even in CI. floci-oci fills that gap the same way its siblings do for AWS, Azure and GCP: one container, one port, real wire protocols, MIT licensed, free forever.

Emulator	Cloud	Port
floci	AWS	4566
floci-az	Azure	4577
floci-gcp	GCP	4588
floci-oci	OCI	4599

🔐 Real cryptography in KMS

Key Management is not a stub that hands back base64. Encrypt and decrypt run AES-GCM through an envelope that embeds the key-version id, so ciphertext survives key rotation. Sign and verify run RSA and ECDSA through JCA. CRC32 plaintextChecksum is computed on decrypt and on generated data keys, so SDK-side checksum validation passes rather than being skipped.

⚡ Functions invokes your real image

Applications and functions carry deterministic image digests, sha256: values that change when the image changes, which is what the Terraform provider's diff contract requires. Invocation is proxied to a shared fnproject/fnserver sidecar that runs your real FDK image as a sibling container, honouring fn-invoke-type: detached and is-dry-run. Setting FLOCI_OCI_SERVICES_FUNCTIONS_MOCK=true removes Docker from the picture entirely while keeping the management plane fully usable, which is the mode most CI pipelines will want. This service is the reference implementation for container sidecars in the codebase.

🧭 Work requests as a shared plane

OCI's async model is first class here, not bolted on per service. Async operations return 202 with an opc-work-request-id, and the work-request store is partitioned by owning service so each one exposes work requests under its own API version prefix. Object Storage copies, compartment deletes and Queue mutations all flow through it.

🧱 Services register themselves

ServiceRegistry and ServiceDescriptor let each service declare its own enablement flag, storage key and JAX-RS resources at startup. Adding a service never means editing a switch statement in core. ServiceEnabledFilter answers 503 for anything disabled.

🧪 Zero-drift IaC, verified continuously

The Terraform and OpenTofu suites take 11 resources through the full apply → zero-drift plan → destroy cycle. That cycle is what surfaced all three bug fixes below. make compat-docker runs the entire matrix on a shared Docker network.

✨ Added

Core platform

• Error contract: OCI-shaped {"code": "...", "message": "..."} bodies with correct HTTP status, including NotAuthorizedOrNotFound on 404, exactly as real OCI conflates missing and unauthorized
• Protocol primitives: opc-request-id on every response (echoing the caller's when supplied), opc-client-request-id echo, limit/page pagination with the opc-next-page header, OCID minting (ocid1.<type>.<realm>.<region>.<unique>), and etag generation for if-match / if-none-match concurrency
• Service registry: self-registering ServiceRegistry / ServiceDescriptor, with ServiceEnabledFilter returning 503 for disabled services
• Work requests: shared async plane returning 202 + opc-work-request-id, partitioned per owning service
• Auth: OCI request-signature parsing (draft-cavage HTTP Signatures). Tenancy, user and region are derived from the Authorization: Signature …