v0.8.0

New: Virtual Machines (Microsoft.Compute/virtualMachines)

Full VM lifecycle backed by real Docker containers, plus multi-service deployment, log streaming, run-command, interactive SSH and managed-identity attestation. miniblue now emulates 28 Azure services.

Virtual Machines

• Create, list, start, stop, restart and delete VMs via the ARM API and azlocal vm, each backed by a Docker container on a per-VM network (ACI-style stub mode when Docker is absent)
• Deploy multiple named services per VM (azlocal vm deploy), each in its own container with host-published ports and port-conflict detection
• Read per-service or combined labelled logs with tail and follow (azlocal vm logs)
• Run one-off commands (azlocal vm run-command, mirrors Azure runCommand) or open an interactive shell (azlocal vm ssh)
• A VM whose container fails to start fails fast with ContainerStartFailed and persists nothing

Managed identities

• User-assigned managed identities (Microsoft.ManagedIdentity/userAssignedIdentities) with azlocal identity CRUD
• Assign identities to VMs (azlocal vm identity-assign); workloads inside a VM obtain attestation tokens with no code changes via the standard IDENTITY_ENDPOINT / IDENTITY_HEADER protocol
• Tokens carry xms_mirid and VM claims, verifiable via POST /metadata/identity/introspect

Other

• Java SDK example covering Resource Groups, Key Vault, Blob Storage and Cosmos DB (#122)
• Website docs page for Virtual Machines, wired into the nav, services overview and the API parity matrix
• Dependency updates: go-chi/chi v5.3.0, testcontainers-go v0.43.0, alpine 3.24, actions/checkout v7

Full changelog: https://github.com/moabukar/miniblue/blob/main/CHANGELOG.md

v0.7.0

New: Microsoft.Resources/deployments Phase 1 (#118)

az deployment group create --template-file main.bicep now works end to end against miniblue.

What's in Phase 1

• PUT/GET/DELETE/List on Microsoft.Resources/deployments
• Walks template.resources in declaration order
• Resolves [parameters('x')] and [variables('x')] (with defaultValue fallback)
• Dispatches each resource through the embedded chi router so existing service handlers apply it
• Per-resource error surfaced as a Failed deployment with details

Not yet supported (deferred)

• Other template functions: [concat()], [resourceId()], [reference()], [copyIndex()], etc.
• copy loops
• condition on resources
• Nested templates and module references
• dependsOn ordering (resources are applied in declaration order)
• outputs evaluation
• Subscription, management-group, or tenant-scope deployments
• What-If and Validate operations

See examples/bicep/ for a working sample plus the deferred list.

Helm / Kubernetes deployment guide (#117, closes #86)

New page at https://miniblue.io/guides/helm covering helm install, persistence, PostgreSQL backend via secret, exposing the service, and the in-cluster real-backend limitations.

SHA256SUMS for release binaries (#115, closes #94)

The release workflow now publishes a single SHA256SUMS asset alongside the binaries:

sha256sum -c SHA256SUMS --ignore-missing

Other

• New AKS CI job that exercises the :full Docker image with a mounted docker socket (#114)
• CHANGELOG backfilled for v0.4.2 through v0.6.0 from each release's notes (#116)
• README comparison table service count corrected 26 → 27

Upgrading

docker pull moabukar/miniblue:0.7.0
brew upgrade miniblue

Try Bicep:

azlocal group create --name bicep-rg --location eastus
az deployment group create --resource-group bicep-rg \
  --template-file examples/bicep/main.bicep \
  --parameters saName=mystorage clusterName=mycluster

v0.6.0

New: Azure Kubernetes Service (AKS) emulation (#111, closes #50)

Microsoft.ContainerService/managedClusters ARM management plane with two backends:

Backend	When	What works
stub (default)	always	terraform apply, az aks list, azlocal aks ..., mock kubeconfig (kubectl will not connect)
real (k3s in Docker)	AKS_BACKEND=k3s + Docker daemon	everything above + a real rancher/k3s cluster per AKS resource; kubectl apply actually deploys pods

Mirrors the ACI Docker pattern, so users do not need to install k3d / kind / minikube.

CLI

azlocal aks create --resource-group RG --name N [--node-count 1] [--kubernetes-version 1.30.0]
azlocal aks list   --resource-group RG
azlocal aks show   --resource-group RG --name N
azlocal aks delete --resource-group RG --name N
azlocal aks get-credentials --resource-group RG --name N [--file PATH|-] [--overwrite-existing]

get-credentials defaults to merging into ~/.kube/config like real az aks does.

Lifecycle coverage

Trigger	Cleanup behavior
terraform destroy / azlocal aks delete / direct DELETE	container removed immediately
Resource group cascade delete	every cluster's container in that RG removed
miniblue SIGTERM / SIGINT / docker stop	every running k3s container torn down before miniblue exits
miniblue SIGKILL / OOM / crash	next start with AKS_BACKEND=k3s reaps orphans
PERSISTENCE=1 restart	matching containers preserved; same kubeconfig still works

New full Docker image variant

Default moabukar/miniblue:latest stays scratch (~9MB). Real-backend users (ACI, AKS) can build the full target which adds the docker CLI:

docker build --target=full -t miniblue:full .
docker run -v /var/run/docker.sock:/var/run/docker.sock \
  -p 4566:4566 -p 4567:4567 -e AKS_BACKEND=k3s miniblue:full

Other changes

• New dedicated CI pipeline .github/workflows/aks-e2e.yml that runs Terraform apply against the AKS example and a real-backend k3s smoke (DinD on the runner) on AKS-touching PRs and push to main
• Resource group cascade delete now cleans up child AKS resources properly
• cmd/miniblue graceful shutdown propagates to AKS so k3s containers do not leak past miniblue's lifetime
• 27 services total (was 26); see azlocal health

Upgrading

docker pull moabukar/miniblue:0.6.0
brew upgrade miniblue

Try it:

azlocal group create --name myRG --location eastus
azlocal aks create --resource-group myRG --name dev --node-count 1
azlocal aks list --resource-group myRG

Known limitation

The real backend always runs k3s v1.30.14. If you PUT a cluster with a different kubernetesVersion the ARM response will echo it back but kubectl version will report the actual k3s version (a WARNING log fires when this happens). Per-version k3s images is on the roadmap for v0.7.

v0.5.1

Bug fixes

• Fix container startup crash on fresh Docker runs. The scratch-based image runs as USER 65534 but had no writable home directory, so miniblue tried to mkdir /.miniblue and failed with permission denied. The image now ships with /home/nonroot owned by 65534 and HOME set so the cert dir can be created cleanly. (#110)
• Fix cert load when existing certs are unusable. When the cert directory existed but cert.pem/key.pem were missing, corrupted, or expired, miniblue would log.Fatal instead of regenerating. All those branches now fall through to generate a new cert. Thanks @KarasAlison. (#109)
• Bump github.com/go-sql-driver/mysql to v1.10.0. (#108)

CI

• E2E now builds the image from the PR's Dockerfile instead of pulling :latest from Docker Hub, so regressions are actually caught on the PR that introduces them. Failed startups also dump docker logs miniblue for diagnostics. (#110)
• Bump mislav/bump-homebrew-formula-action to v4. (#107)

Upgrading

docker pull moabukar/miniblue:0.5.1
# or
brew upgrade miniblue

v0.5.0

New Azure Services

App Service & Web Apps (#103)

Full emulation of Azure App Service resources, contributed by @abusarah-tech:

• Web Apps (Microsoft.Web/sites) — CRUD, slots, publishing credentials, config sub-resources (app settings, auth settings v1/v2, connection strings, backup, logs, metadata, push settings, slot config names, storage accounts)
• App Service Plans (Microsoft.Web/serverFarms) — CRUD with SKU tier detection
• Container Apps (Microsoft.App/containerApps) — CRUD, start/stop, revisions, secrets, auth tokens, custom domain analysis, subscription-level listing
• Managed Environments (Microsoft.App/managedEnvironments) — CRUD with app logs configuration
• Container App Jobs (Microsoft.App/jobs) — CRUD, start/stop, executions, detectors, secrets
• Name Availability — CheckNameAvailability endpoint for sites
• azlocal CLI — New containerapp and containerapp env commands
• Terraform examples — New containerapps and webapps scenarios

The existing Azure Functions emulation has been refactored into the broader sites package.

Bug Fixes

Cert/key loading error handling (#105)

Improved error handling when loading existing TLS certificates and keys, giving clearer error messages when files are corrupted or unreadable. Fixes #104.

Full Changelog: v0.4.4...v0.5.0

v0.4.4

Helm Chart Improvements

Persistent volume support (#83)

The Helm chart now supports persistent storage. Enable it in values.yaml to survive pod restarts:

persistence:
  enabled: true
  storageClass: "standard"
  size: 1Gi

Also supports PostgreSQL backend via Kubernetes secrets:

databaseUrlSecret:
  name: pg-credentials
  key: connection-string

Security context (#88)

Secure defaults are now set on the container, matching the Dockerfile's non-root user:

securityContext:
  runAsNonRoot: true
  runAsUser: 65534
  readOnlyRootFilesystem: true
  allowPrivilegeEscalation: false

Helm chart version bumped to 0.3.0.

Documentation

Scope and philosophy (#76)

New docs page explaining the control plane vs data plane distinction, when to use miniblue vs real Azure, and the design principles behind the project. See architecture/scope.

Full Changelog: v0.4.3...v0.4.4

v0.4.3

Bug Fixes

Store backend data race (#84, #89)

FileBackend.Save() had a race condition where the auto-save goroutine could read inconsistent state while handlers were writing. Fixed by adding an atomic Snapshot() that copies all data under a single lock.

PostgresBackend.List() and ListByPrefix() returned nil on error instead of empty slices, causing inconsistent behavior with the memory backend. Now returns initialized empty slices.

E2E tests now run on PRs (#82)

The E2E workflow was workflow_dispatch only, meaning breaking changes could slip through PRs undetected. Now runs on every push to main and every PR. Also updated the CI example to actions/checkout@v6 (#91).

azlocal CLI error handling (#85)

doPut, doPost and printResponse silently swallowed json.Marshal and io.ReadAll errors, sending empty bodies or printing nothing on failure. Now prints clear error messages to stderr.

Full Changelog: v0.4.2...v0.4.3

v0.4.2

Fix

• miniblue --version now shows the correct version instead of dev
• Version is injected via ldflags in all build targets: release binaries, Docker images and Homebrew formula

Full Changelog: v0.4.1...v0.4.2

v0.4.1

Bug Fixes

This release fixes several issues that caused Terraform drift and orphaned resources.

Fixed

• Resource tags preserved on all ARM services - tags were silently dropped on VNets, NSGs, Public IPs, Load Balancers, App Gateways, DNS Zones and Storage Accounts causing constant Terraform plan drift
• Resource group cascade delete now covers all services - deleting an RG was leaving orphaned NSGs, Public IPs, Load Balancers, App Gateways, Storage Accounts, Cosmos DB, Service Bus and App Config resources
• Subscription-level list endpoints for VNets, NSGs, Public IPs, Load Balancers, App Gateways and DNS Zones - fixes 404s on Terraform data sources that list across resource groups
• 34 ARM tests were silently skipped due to _arm_test.go filename suffix matching GOARCH=arm - now run on all platforms
• 3 missing provider registrations added (PostgreSQL, Redis, Container Instances)
• 10 missing service doc pages added to website

Other

• PR template updated with all 26 services
• @abusarah-tech added to CODEOWNERS
• Public ROADMAP.md added
• CoderCo added as sponsor

Full Changelog: v0.4.0...v0.4.1

v0.4.0

fix: add missing endpoints and logic for load balancer, queue and net…