[FEAT] ECS awsvpc tasks: publish container ports on the host (or another runner-reachable endpoint)

Service

ECS

API Action / Feature

Fargate / awsvpc tasks should expose a stable way for a process on the host (Terraform runner, SDK clients) to reach container ports (for example RabbitMQ management 15672, Redis 6379), analogous to how operators reach services in a VPC (ENI private IP + security group, or a published mapping in local emulators).

Today Floci:

• Ignores literal hostPort for awsvpc (correct AWS semantics for Fargate: hostPort carries no binding).
• In native mode may assign dynamic host ports; in Floci-in-Docker often expose-only (no host publish).
• Cloud Map names, when present, only help peers on the Docker network — not the host runner.

So Terraform providers that must dial a broker (rabbitmq, redisacl, etc.) cannot use the Cloud Map hostname from Secrets Manager and need a Docker-IP lookup every apply.

AWS Documentation

• Task networking (awsvpc)
• Amazon ECS service discovery

Why is this needed?

Local stacks create broker users through Terraform providers after the broker ECS service exists. On AWS the runner uses a bastion or SSM tunnel into the VPC. On Floci there is no VPC tunnel and often no published host port; the workaround is to inspect floci-ecs-* containers and pass ip:port as a variable.

Possible fixes (any one helps):

1. Optional host port publish for awsvpc when Floci runs in Docker (config flag).
2. Cloud Map DNS that answers on the host plus a fixed published port map.
3. Documented Floci “runner endpoint” API that returns host:port for a service name.

Are you willing to contribute a PR?

• Yes
• No