fix(dataplane): make container workloads and load balancers reach each other

[vieiralucas]

Summary

Container data-plane reachability fixes (bug audit 2026-10-01, Tier 0.10/0.11 + 1g). AWS-visible addresses stay in every API response; fakecloud now resolves them to sockets it can actually open.

• ALB -> awsvpc ECS (HIGH). The ENI private IP is allocated from the task's subnet CIDR (new Ec2NetworkLookup hook on the delivery bus; AWS-reserved addresses and IPs held by live tasks are skipped; 10.0.0.0/16 fallback), with subnetId, networkInterfaceId, privateDnsName. RunTask precreates the ENI attachment (PRECREATED). awsvpc container ports are published on ephemeral host ports and registered in a new fakecloud_core::dataplane resolver (<ENI IP>:<containerPort> -> sibling_host:<hostPort>). The ELBv2 data plane and health prober resolve through it; access logs keep the ENI IP. k8s backend: ENI attaches at Running and targets route to the Pod IP.
• ALB -> EC2 i-* (MEDIUM-HIGH). The EC2 runtime installs an instance resolver: the first time a target group routes to i-...:<port>, it starts a socat forwarder (default bridge + subnet network, ephemeral published port). Forwarders are removed on stop/reboot/terminate/reset.
• ECS ECR pulls (MEDIUM-HIGH). ECS (and Batch through ECS) now uses the same registry host as Lambda via the shared container_net::ecr_registry_host: loopback, host.containers.internal for podman machine (macOS/Windows), and FAKECLOUD_ECR_REGISTRY_HOST overrides. It no longer uses sibling_host.
• EC2 IMDS (MEDIUM). Each instance container gets a sidecar in its netns (Docker: --network container:; k8s: a second Pod container). The sidecar adds an nft/iptables redirect of 169.254.169.254:80 to a loopback nginx, which forwards to the new server route /_fakecloud/ec2/imds/<instance-id>/latest/*. That route answers with the instance's own id, AMI, type, local-ipv4, AZ, identity document, and its instance-profile role credentials (404 under iam/ when there's no profile). User-data waits (up to 60s) for /run/fakecloud/imds-ready. If the helper image can't be had, the instance gets AWS_EC2_METADATA_SERVICE_ENDPOINT instead. The helper image is built locally (alpine + nftables + nginx + socat); override it with FAKECLOUD_EC2_HELPER_IMAGE.
• MSK / RDS / ElastiCache endpoints in container env (MEDIUM). The broker gets a third CONTAINER listener advertised as host_alias:P2. Env rewriting is now one shared helper, container_net::rewrite_loopback_value, used by Lambda, ECS and CodeBuild. It covers URLs, bare 127.0.0.1 / localhost, host:port lists and DSNs, and swaps the registered container-listener port into 127.0.0.1:P. Prose like EHLO localhost and look-alikes like 127.0.0.10 are left alone.
• Unconfirmed items, also fixed:
  • MSK retries with fresh port pairs when the daemon host already has a pre-allocated port taken (the containerized-fakecloud case).
  • KDA publishes the Flink REST port ephemerally and reads it back.
  • RDS sqlserver/db2 pass --platform linux/amd64.

Non-code surfaces:

• Updated: docs for EC2 (IMDS inside instances, LB targets), ECS (awsvpc ENI, ECR registry host), MSK (container listener, env rewriting), configuration reference (FAKECLOUD_EC2_HELPER_IMAGE, FAKECLOUD_ECR_REGISTRY_HOST), the instance-credentials guide, and AGENTS.md.
• SDKs are unchanged: no new /_fakecloud/* introspection endpoint for SDK users. /_fakecloud/ec2/imds/... is internal plumbing for the in-instance proxy.

Test plan

• Unit tests: dataplane resolver (registered endpoint vs. fallback vs. instance resolver, account scoping), rewrite_loopback_value cases, ecr_registry_host resolution, parse_published_port, ENI IP allocation (subnet bounds, reserved addresses, in-use skip, exhaustion), awsvpc ephemeral publish argv (task and holder), ECS env rewrite of bare endpoints, ELBv2 upstream resolution plus a prober test against a published awsvpc target (HTTP and TCP), EC2 sidecar/forwarder argv, the IMDS setup script run under sh with fake tools (proxy starts before the redirect, readiness file is written), k8s instance Pod sidecar plus shared volume, Kafka listener env/args, port-conflict detection, and the container-port registration round trip. KDA publish spec and RDS platform.

• cargo test --lib --bins passes for core, elbv2, ecs, ec2, kafka, kinesisanalyticsv2, rds, lambda, codebuild and fakecloud.

• cargo test -p fakecloud-conformance ecs_: 78/78 pass. Workspace cargo clippy --all-targets -D warnings and cargo fmt are clean.

• New Docker-backed E2E crates/fakecloud-e2e/tests/container_dataplane_reachability.rs:

  • ALB -> awsvpc ECS service returns 200, the ENI IP is inside the subnet, and the target id is the ENI IP;
  • ALB -> EC2 instance port opened by user-data returns 200, and the forwarder is reaped on terminate;
  • an EC2 instance reads its instance id, role credentials and identity document from 169.254.169.254, including from user-data;
  • an ECS task pulls an ECR image with FAKECLOUD_IN_CONTAINER=1.

  The local Docker daemon hangs (docker info times out), so these E2E tests ran only in CI (general partitions). They compile locally (--no-run).

---

Summary by cubic

Makes container workloads and the load balancers in front of them reachable through the data plane: an ALB can route to awsvpc ECS tasks and EC2 instance ports, and EC2 instances reach the real IMDS inside their container.

Reachability fixes

• awsvpc ECS tasks get a real requester-managed ENI created by EC2 in the task's subnet (visible in DescribeNetworkInterfaces, using the service's security groups) — PRECREATED at task creation, attached on start, deleted when the task stops; subnets EC2 doesn't know keep a synthetic ENI. Container ports publish to ephemeral host ports registered in a new shared dataplane resolver the ALB data plane and health prober consult, keeping the ENI IP in every API response.
• EC2 instance ports are forwarded on demand through a socat forwarder per (instance, port); forwarders are serialized, swept on stop/reboot/terminate, never point at a stopped instance, and count as members of the load balancer's security groups so instance SGs admitting only the ALB's group admit its traffic.
• Each instance container gets a sidecar that redirects 169.254.169.254:80 to a per-instance IMDS route serving the instance's own identity and instance-profile credentials; user-data waits for a tmpfs readiness marker that resets on stop/start/reboot. The helper-image build and sidecar setup run as a detached task outside the lifecycle lock, so a reset right after run/start no longer stalls on them.
• MSK brokers advertise a second container-facing listener, and container env rewriting (Lambda, ECS, CodeBuild) now swaps loopback host:port/DSN endpoints to it.

Other fixes

• ECS ECR pulls use the registry host shared with Lambda instead of the sibling alias; the FAKECLOUD_ECR_REGISTRY_HOST override is authorized in the registry auth map.
• MSK retries with fresh port pairs when a pre-allocated port is taken, KDA publishes the Flink REST port ephemerally, and RDS sqlserver/db2 request linux/amd64.
• FAKECLOUD_EC2_HELPER_IMAGE and FAKECLOUD_ECR_REGISTRY_HOST overrides documented; ELBv2 targets are now health-checked. No SDK changes.

^{Written for commit 62cfdcf. Summary will update on new commits.}