This guide rebuilds the lab from an empty Floci environment to a running Mendix application. It incorporates the corrections verified during the deployment: fixed Docker addresses, Kubernetes EndpointSlices, GitHub Container Registry authentication, a free ngrok Cloud Endpoint, and a restart automation that returned exit code 0.

Scope: This is a learning and demonstration environment. Floci emulates AWS services locally; it does not reproduce production AWS security, resilience, backups, networking, or service-level guarantees.

Successful final state

Contents

1. Architecture and fixed addressing

2. Prerequisites and security rules

3. Create the persistent Floci foundation

4. Create and connect the K3s cluster

5. Configure PostgreSQL and S3

6. Register the namespace and install the Mendix components

7. Install ingress nginx and connect ngrok

8. Configure database storage ingress and registry plans

9. Create a package and a development environment

10. Fix the free ngrok hostname

11. Troubleshoot GHCR image pulls

12. Restore the lab automatically after restart

13. Final validation and operating notes

Architecture and fixed addressing

The public ngrok Cloud Endpoint forwards traffic to the local ngrok agent at default.internal. The agent sends traffic to localhost port 8080, where kubectl forwards it to ingress-nginx. Kubernetes routes the request to the Mendix runtime. The runtime reaches PostgreSQL and S3 through stable Kubernetes services backed by external EndpointSlices.

Internet HTTPS
-> ngrok Cloud Endpoint
-> ngrok agent default.internal
-> localhost:8080
-> ingress-nginx service port 80
-> Mendix Ingress and runtime
-> floci-rds:5432 and floci-s3:4566

Prerequisites and security rules

• Docker Desktop with WSL2 enabled.

• AWS CLI, kubectl, Helm 3, mxpc-cli, and ngrok v3 available on Windows.

• A GitHub account and a private GHCR package path.

• A reserved ngrok free domain and an authenticated ngrok agent.

• Do not publish Namespace Secrets, GitHub tokens, ngrok authtokens, database passwords, subscription secrets, signed package URLs, or generated YAML containing credentials.

• Never run docker system prune --volumes or docker volume prune against this lab.

Create the persistent Floci foundation

Create the external Docker network

The Compose file uses an external network. A first-time reader must create it before running docker compose.

docker network create `
--driver bridge `
--subnet 172.20.0.0/16 `
--gateway 172.20.0.1 `
floci_default

Verify the network configuration:

docker network inspect floci_default

Create persistent storage

New-Item -ItemType Directory -Force -Path "D:\Floci\data"

Create the Compose file

Save this as D:\Developer-Knowledge-Hub\01-Inbox\Floci\compose.yml. The fixed address prevents the S3 endpoint from changing after a restart.

services:
floci:
image: floci/floci:latest
ports:

• "4566:4566"
  environment:
  FLOCI_STORAGE_MODE: persistent
  FLOCI_STORAGE_PERSISTENT_PATH: /app/data
  volumes:

• D:/Floci/data:/app/data

• /var/run/docker.sock:/var/run/docker.sock
  networks:
  default:
  ipv4_address: 172.20.0.6

networks:
default:
external: true
name: floci_default

docker compose -f "D:\Developer-Knowledge-Hub\01-Inbox\Floci\compose.yml" up -d
docker inspect floci-floci-1 --format "Status={{.State.Status}} Health={{.State.Health.Status}}"

Expected result: Status=running and Health=healthy.

Verify Floci services

Invoke-RestMethod "http://localhost:4566/\_localstack/health" | ConvertTo-Json -Depth 10

Create and connect the K3s cluster

Create the emulated IAM role

$trustPolicy = '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"eks.amazonaws.com"},"Action":"sts:AssumeRole"}]}'

aws iam create-role `
--role-name FlociEksClusterRole `
--assume-role-policy-document $trustPolicy `
--endpoint-url http://localhost:4566 `
--region us-east-1 `
--no-cli-pager

Create the EKS-compatible cluster

aws eks create-cluster `
--name mendix-floci-cluster `
--role-arn arn:aws:iam::000000000000:role/FlociEksClusterRole `
--resources-vpc-config "subnetIds=subnet-default-a,subnet-default-b,subnet-default-c,securityGroupIds=sg-default,endpointPublicAccess=true,endpointPrivateAccess=false" `
--endpoint-url http://localhost:4566 `
--region us-east-1 `
--no-cli-pager

aws eks describe-cluster `
--name mendix-floci-cluster `
--endpoint-url http://localhost:4566 `
--region us-east-1 `
--query "cluster.{Status:status,Endpoint:endpoint}" `
--no-cli-pager

Continue when the status is ACTIVE and the endpoint is https://localhost:6500.

Attach the K3s container to the fixed network

docker network connect `
--ip 172.20.0.4 `
floci_default `
floci-eks-mendix-floci-cluster

If Docker reports that the endpoint already exists, inspect the existing address instead of reconnecting it.

Create the kubeconfig context

aws eks update-kubeconfig `
--name mendix-floci-cluster `
--alias floci-mendix `
--endpoint-url http://localhost:4566 `
--region us-east-1

kubectl config use-context floci-mendix
kubectl get nodes -o wide
kubectl get storageclass

Expected result: one K3s control-plane node is Ready and local-path is the default StorageClass.

Configure PostgreSQL and S3

Create PostgreSQL

aws rds create-db-subnet-group `
--db-subnet-group-name mendix-rds-subnet-group `
--db-subnet-group-description "Subnet group for Mendix PostgreSQL" `
--subnet-ids subnet-default-a subnet-default-b subnet-default-c `
--endpoint-url http://localhost:4566 `
--region us-east-1 `
--no-cli-pager

Prompt securely for the database password so it is not stored in PowerShell history:

$dbSecurePassword = Read-Host "Enter the PostgreSQL password" -AsSecureString
$dbPassword = [Runtime.InteropServices.Marshal]::PtrToStringAuto(
[Runtime.InteropServices.Marshal]::SecureStringToBSTR($dbSecurePassword)
)

aws rds create-db-instance `
--db-instance-identifier mendix-postgres `
--db-instance-class db.t3.micro `
--engine postgres `
--allocated-storage 20 `
--master-username mendixadmin `
--master-user-password $dbPassword `
--db-name mendixdb `
--db-subnet-group-name mendix-rds-subnet-group `
--vpc-security-group-ids sg-default `
--no-publicly-accessible `
--endpoint-url http://localhost:4566 `
--region us-east-1 `
--no-cli-pager

\(dbPassword = \)null
\(dbSecurePassword = \)null

Important: Floci API metadata may advertise 172.20.0.6:7001, but Kubernetes must connect to the actual PostgreSQL container on port 5432. Inspect the generated container and attach it to the fixed network.

$RdsContainer = docker ps -a --format "{{.Names}}" |
Where-Object { $_ -like "floci-rds-*" } |
Select-Object -First 1

docker network connect --ip 172.20.0.3 floci_default $RdsContainer

Create the PostgreSQL Kubernetes service

kubectl create namespace mendix-floci
kubectl create service clusterip floci-rds --tcp=5432:5432 -n mendix-floci
kubectl patch service floci-rds -n mendix-floci --type=merge --patch '{\spec\:{\selector\:null}}'

@"
apiVersion: discovery.k8s.io/v1
kind: EndpointSlice
metadata:
name: floci-rds-external
namespace: mendix-floci
labels:
kubernetes.io/service-name: floci-rds
addressType: IPv4
ports:

• name: 5432-5432
  protocol: TCP
  port: 5432
  endpoints:

• addresses: ["172.20.0.3"]
  conditions:
  ready: true
  "@ | kubectl apply -f -

The EndpointSlice port name must exactly match the generated Service port name 5432-5432. A different name can cause the Service DNS test to fail even when the direct IP succeeds.

kubectl run rds-service-test -n mendix-floci `
--image=busybox:1.36 --restart=Never --rm -i `
--command -- nc -zvw5 floci-rds.mendix-floci.svc.cluster.local 5432

Create S3 storage

aws s3api create-bucket `
--bucket mendix-floci-files `
--endpoint-url http://localhost:4566 `
--region us-east-1 `
--no-cli-pager

kubectl create service clusterip floci-s3 --tcp=4566:4566 -n mendix-floci
kubectl patch service floci-s3 -n mendix-floci --type=merge --patch '{\spec\:{\selector\:null}}'

@"
apiVersion: discovery.k8s.io/v1
kind: EndpointSlice
metadata:
name: floci-s3-external
namespace: mendix-floci
labels:
kubernetes.io/service-name: floci-s3
addressType: IPv4
ports:

• name: 4566-4566
  protocol: TCP
  port: 4566
  endpoints:

• addresses: ["172.20.0.6"]
  conditions:
  ready: true
  "@ | kubectl apply -f -

Register the namespace and install Mendix

Keep the existing Portal cluster registration if it represents this lab. Create or reuse the Kubernetes namespace mendix-floci, then add that namespace in Mendix on Kubernetes Cluster Manager. Use the cluster type Kubernetes because the actual node is K3s.

Mendix namespace installation page. Namespace identifiers and secrets must remain redacted.

Run the namespace installer

.\mxpc-cli.exe installer -n mendix-floci -i <NAMESPACE_ID> -s <NAMESPACE_SECRET>

In the installer, complete Base Installation. Verify that the Agent and Operator become healthy.

kubectl get pods -n mendix-floci -o wide

The namespace is connected after the Mendix Agent and Operator are running.

Install ingress nginx and connect ngrok

Install ingress nginx

helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
helm repo update

helm install ingress-nginx ingress-nginx/ingress-nginx `
--namespace ingress-nginx `
--create-namespace `
--set controller.service.type=NodePort `
--set controller.service.nodePorts.http=30080 `
--set controller.service.nodePorts.https=30443 `
--set controller.ingressClassResource.default=true

kubectl get pods -n ingress-nginx -o wide
kubectl get ingressclass

Expected result: ingress-nginx-controller is 1/1 Running and the nginx IngressClass exists.

Reserve and connect the ngrok domain

Reserve the free domain completable-noncommemorational-terica.ngrok-free.dev in ngrok. Configure the Cloud Endpoint to forward to https://default.internal. The public ngrok endpoint terminates TLS; Kubernetes ingress TLS remains disabled in this lab.

Reserved ngrok public Cloud Endpoint.

Start a local port-forward and keep the process running:

kubectl port-forward -n ingress-nginx service/ingress-nginx-controller 8080:80

In a second PowerShell window, start the ngrok agent from its installation directory:

.\ngrok.exe http 8080 --url https://default.internal

If ERR_NGROK_334 appears, an older ngrok process already owns the endpoint. Inspect and stop only that stale process, then run the correct command again.

Get-CimInstance Win32_Process |
Where-Object { $_.Name -eq "ngrok.exe" } |
Select-Object ProcessId, CommandLine

Configure Mendix plans and registry

Database plan

The PostgreSQL database plan validates successfully with the configured master username.

S3 storage plan

The Floci S3 storage plan validates through the Kubernetes service.

Ingress configuration

Ingress uses the reserved ngrok hostname and nginx class.

GitHub Container Registry

Create a GitHub personal access token with read:packages and write:packages. Never put the token directly in a published command or screenshot.

Use only owner/repository in Registry Name. Do not enter a tag template in that field; Mendix creates the environment-specific tag.

Corrected GHCR configuration. The token remains masked.

Evaluate and apply the configuration

Evaluate Configuration should report Valid configuration for Storage Plan, Database Plan, Ingress, and Registry. Then select Write YAML and Apply Configuration. Treat the generated YAML as sensitive because it can contain credentials.

All four namespace resources pass configuration evaluation.

The installer successfully applies all namespace configuration.

Create a package and development environment

Build a deployment package

1. Open the app in Mendix Portal and go to Deployment, Environments, Deployment Packages.

2. Select Create Deployment Package.

3. Choose the main branch and the required revision.

4. Enter the semantic version and select Build this revision.

5. Wait for the package to show a green completed indicator.

Select the main branch for the deployment package.

Select the required main-branch revision.

Review the version and build the selected revision.

Create the Development environment

1. Select Create Environment and choose the newly completed package.

2. Keep the generated lowercase environment ID. The verified ID was a0y77t7f.

3. Set Environment Name and Purpose to Development.

4. Select namespace mendix-floci on floci-mendix-cluster.

5. Use the genuine Mendix subscription secret only when a licensed runtime is available. Never use a GitHub token in this field.

6. Choose XS resources, floci-rds-postgres, and floci-s3-storage.

7. Create the environment and wait for Build and Runtime to become green.

Development environment identity and namespace selection. The subscription secret is masked.

XS runtime resources with the verified database and storage plans.

Fix the free ngrok hostname

Mendix normally prefixes the namespace domain with the environment ID. A free ngrok reserved domain covers the exact hostname, not an arbitrary environment subdomain. Set spec.appURL to the hostname only. Do not include http://, https://, or a trailing slash; Kubernetes rejects a scheme as an invalid Ingress host.

Use the generated environment ID shown by MendixApp:

kubectl get mendixapp -n mendix-floci

Apply the hostname-only override:

kubectl patch mendixapp a0y77t7f `
-n mendix-floci `
--type=merge `
--patch '{\spec\:{\appURL\:\completable-noncommemorational-terica.ngrok-free.dev\}}'

The Operator should reconcile the Ingress and status. If it repeatedly restores the environment prefix, use the controlled sequence below.

kubectl scale deployment mendix-operator -n mendix-floci --replicas=0

kubectl patch ingress a0y77t7f -n mendix-floci --type=json `
--patch '[{\op\:\replace\,\path\:\/spec/rules/0/host\,\value\:\completable-noncommemorational-terica.ngrok-free.dev\}]'

kubectl patch mendixapp a0y77t7f -n mendix-floci --subresource=status `
--type=merge `
--patch '{\status\:{\appURL\:\http://completable-noncommemorational-terica.ngrok-free.dev/\\}}'

kubectl patch mendixapp a0y77t7f -n mendix-floci --type=merge `
--patch '{\spec\:{\appURL\:\completable-noncommemorational-terica.ngrok-free.dev\}}'

kubectl scale deployment mendix-operator -n mendix-floci --replicas=1

Wait for the Operator to become ready, refresh Mendix Portal, and confirm the Network, Storage, Database, Service Account, Build, and Runtime indicators are green.

Invoke-WebRequest `
-Uri "https://completable-noncommemorational-terica.ngrok-free.dev/" `
-UseBasicParsing

Expected result: StatusCode 200 and StatusDescription OK.

Verified final environment: infrastructure, build, and runtime checks are green and the fixed URL is displayed.

The optional Licensed Runtime counter can remain 0 of 1 when no commercial runtime subscription is activated. It does not invalidate this local demonstration when the runtime is healthy and the application returns HTTP 200.

Troubleshoot GHCR image pulls

Symptom

The runtime pod reports ErrImagePull or ImagePullBackOff. Pod events contain failed to authorize and 401 Unauthorized for ghcr.io. If imagePullSecrets is empty, Kubernetes attempted an anonymous pull from a private package.

Diagnosis

kubectl describe pod <RUNTIME_POD> -n mendix-floci
kubectl get pod <RUNTIME_POD> -n mendix-floci -o jsonpath="{.spec.imagePullSecrets}"
kubectl get secrets -n mendix-floci
kubectl get pod <RUNTIME_POD> -n mendix-floci -o jsonpath="{.spec.serviceAccountName}"

Expected secret: mendix-registry-generic-secret. The verified runtime used the default service account.

Attach the pull secret

This Windows-compatible command preserves the JSON quotes passed to kubectl:

kubectl patch serviceaccount default -n mendix-floci --type=merge `
--patch '{\imagePullSecrets\:[{\name\:\mendix-registry-generic-secret\}]}'

Delete only the failed runtime pod. Its Deployment recreates it with the pull secret.

kubectl delete pod <RUNTIME_POD> -n mendix-floci

Expected progression: ErrImagePull, ContainerCreating, then 2/2 Running. Temporary readiness HTTP 500 responses can occur while the Mendix runtime initializes.

Rotate the GHCR credential securely

$ghcrSecureToken = Read-Host "Enter the new GitHub token" -AsSecureString
$ghcrToken = [Runtime.InteropServices.Marshal]::PtrToStringAuto(
[Runtime.InteropServices.Marshal]::SecureStringToBSTR($ghcrSecureToken)
)

kubectl create secret docker-registry mendix-registry-generic-secret `
-n mendix-floci `
--docker-server=ghcr.io `
--docker-username=sukhvindra-singh `
--docker-password="$ghcrToken" `
--dry-run=client -o yaml | kubectl apply -f -

\(ghcrToken = \)null
\(ghcrSecureToken = \)null

Restore the lab automatically after restart

Docker containers and Kubernetes volumes persist, but ngrok and kubectl port-forward are host processes and do not reliably resume after Windows restarts. The verified startup script checks Docker Desktop, recreates the fixed network when absent, starts Floci/K3s/RDS, repairs fixed addresses, waits for Kubernetes and ingress, starts forwarding processes, and validates the public URL.

Create the script

Save the following as D:\Floci\scripts\Start-FlociLab.ps1. Adjust only ComposeFile or NgrokExe if the local paths differ.

$ErrorActionPreference = "Stop"

$ComposeFile = "D:\Developer-Knowledge-Hub\01-Inbox\Floci\compose.yml"
$NgrokExe = "C:\Users\sukhv\Downloads\ngrok-v3-stable-windows-amd64\ngrok.exe"
$DockerNetwork = "floci_default"
$K3sContainer = "floci-eks-mendix-floci-cluster"
$KubeContext = "floci-mendix"
$Namespace = "mendix-floci"
$PublicDomain = "completable-noncommemorational-terica.ngrok-free.dev"
\(PublicURL = "https://\)PublicDomain/"
$LogDirectory = "D:\Floci\scripts\logs"
New-Item -ItemType Directory -Force -Path $LogDirectory | Out-Null

function Test-Docker {
docker info *> $null
return ($LASTEXITCODE -eq 0)
}

function Start-ContainerIfStopped([string]$Name) {
\(exists = docker ps -a --filter "name=^/\){Name}$" --format "{{.Names}}"
if (\(exists -eq \)Name) {
\(running = docker ps --filter "name=^/\){Name}$" --format "{{.Names}}"
if (\(running -ne \)Name) { docker start $Name | Out-Null }
}
}

function Set-FixedNetworkIP([string]$Name, [string]$RequiredIP) {
\(exists = docker ps -a --filter "name=^/\){Name}$" --format "{{.Names}}"
if (\(exists -ne \)Name) { Write-Warning "Container not found: $Name"; return }
\(inspect = docker inspect \)Name | ConvertFrom-Json
\(property = \)inspect[0].NetworkSettings.Networks.PSObject.Properties[$DockerNetwork]
\(currentIP = if (\)null -ne \(property) { \)property.Value.IPAddress } else { $null }
if (\(currentIP -eq \)RequiredIP) { return }
\(wasRunning = (docker inspect \)Name --format "{{.State.Running}}") -eq "true"
if (\(wasRunning) { docker stop \)Name | Out-Null }
# Disconnect only when the container is already attached to the network.
# This prevents Task Scheduler result 1 after a Windows restart.
if (\(null -ne \)property) {
docker network disconnect -f $DockerNetwork $Name | Out-Null
if ($LASTEXITCODE -ne 0) {
throw "Failed to disconnect $Name from $DockerNetwork."
}
}
docker network connect --ip $RequiredIP $DockerNetwork $Name
if ($LASTEXITCODE -ne 0) {
throw "Failed to connect $Name to $DockerNetwork using $RequiredIP."
}
if (\(wasRunning) { docker start \)Name | Out-Null }
}

if (-not (Test-Docker)) {
Start-Process "C:\Program Files\Docker\Docker\Docker Desktop.exe"
\(ready = \)false
foreach ($attempt in 1..60) {
Start-Sleep -Seconds 2
if (Test-Docker) { \(ready = \)true; break }
}
if (-not $ready) { throw "Docker Desktop did not become ready." }
}

docker network inspect \(DockerNetwork *> \)null
if ($LASTEXITCODE -ne 0) {
docker network create --driver bridge --subnet 172.20.0.0/16 `
--gateway 172.20.0.1 $DockerNetwork | Out-Null
}

\(previousErrorActionPreference = \)ErrorActionPreference
$ErrorActionPreference = "Continue"
\(composeOutput = docker compose -f \)ComposeFile up -d 2>&1
\(composeExitCode = \)LASTEXITCODE
\(ErrorActionPreference = \)previousErrorActionPreference
\(composeOutput | ForEach-Object { Write-Host \)_ }
if ($composeExitCode -ne 0) {
throw "Docker Compose failed with exit code $composeExitCode."
}
Set-FixedNetworkIP "floci-floci-1" "172.20.0.6"

foreach ($attempt in 1..60) {
$health = docker inspect floci-floci-1 `
--format "{{if .State.Health}}{{.State.Health.Status}}{{else}}{{.State.Status}}{{end}}" 2>$null
if ($health -eq "healthy") { break }
Start-Sleep -Seconds 2
}

Start-ContainerIfStopped $K3sContainer
Set-FixedNetworkIP $K3sContainer "172.20.0.4"

$RdsContainer = docker ps -a --format "{{.Names}}" |
Where-Object { $_ -like "floci-rds-*" } | Select-Object -First 1
if ($RdsContainer) {
Start-ContainerIfStopped $RdsContainer
Set-FixedNetworkIP $RdsContainer "172.20.0.3"
}

kubectl config use-context $KubeContext | Out-Null
\(nodeReady = \)false
\(previousErrorActionPreference = \)ErrorActionPreference
$ErrorActionPreference = "Continue"
try {
foreach ($attempt in 1..150) {
kubectl get nodes *> $null
if ($LASTEXITCODE -eq 0) {
kubectl wait --for=condition=Ready node --all --timeout=10s *> $null
if (\(LASTEXITCODE -eq 0) { \)nodeReady = $true; break }
}
Start-Sleep -Seconds 2
}
}
finally {
\(ErrorActionPreference = \)previousErrorActionPreference
}
if (-not $nodeReady) {
throw "The Kubernetes node did not become ready within five minutes."
}

kubectl rollout status deployment/ingress-nginx-controller `
-n ingress-nginx --timeout=180s

$portForward = Get-CimInstance Win32_Process | Where-Object {
\(_.Name -match "kubectl" -and \)_.CommandLine -match "port-forward" -and
$_.CommandLine -match "8080:80"
}
if (-not $portForward) {
Start-Process (Get-Command kubectl).Source `
-ArgumentList @("port-forward","--address","127.0.0.1",
"-n","ingress-nginx",
"service/ingress-nginx-controller","8080:80") `
-RedirectStandardOutput "$LogDirectory\ingress-port-forward.log" `
-RedirectStandardError "$LogDirectory\ingress-port-forward.error.log" `
-WindowStyle Hidden
Start-Sleep -Seconds 5
}

$ngrok = Get-CimInstance Win32_Process | Where-Object {
\(_.Name -eq "ngrok.exe" -and \)_.CommandLine -match "127.0.0.1:8080" -and
$_.CommandLine -match "default.internal"
}
if (-not $ngrok) {
Get-Process ngrok -ErrorAction SilentlyContinue | Stop-Process -Force
Start-Process $NgrokExe `
-ArgumentList @("http","http://127.0.0.1:8080",
"--url","https://default.internal",
"--log","$LogDirectory\ngrok.log","--log-format","json") `
-RedirectStandardOutput "$LogDirectory\ngrok-output.log" `
-RedirectStandardError "$LogDirectory\ngrok-error.log" `
-WindowStyle Hidden
Start-Sleep -Seconds 8
}

\(runtimeReady = \)false
foreach ($attempt in 1..60) {
\(pods = kubectl get pods -n \)Namespace -o json | ConvertFrom-Json
\(runtimePods = @(\)pods.items | Where-Object {
\(_.metadata.name -match "-master-" -and \)_.status.phase -eq "Running"
})
foreach ($pod in $runtimePods) {
\(statuses = @(\)pod.status.containerStatuses)
if ($statuses.Count -gt 0 -and
@(\(statuses | Where-Object { -not \)_.ready }).Count -eq 0) {
\(runtimeReady = \)true
Write-Host "Mendix runtime is ready: $($pod.metadata.name)"
break
}
}
if ($runtimeReady) { break }
Start-Sleep -Seconds 10
}

\(available = \)false
if ($runtimeReady) {
foreach ($attempt in 1..12) {
try {
\(response = Invoke-WebRequest -Uri \)PublicURL -UseBasicParsing -TimeoutSec 20
if (\(response.StatusCode -eq 200) { \)available = $true; break }
} catch { }
Start-Sleep -Seconds 10
}
}

if (-not $available) { throw "Public Mendix URL did not return HTTP 200." }
Write-Host "Floci Mendix lab is ready: $PublicURL" -ForegroundColor Green
kubectl get pods -n $Namespace

Validate the final script

The final restart-safe version contains three important corrections. Set-FixedNetworkIP disconnects only when a container is already attached. Docker Compose and the Kubernetes readiness loop temporarily tolerate expected native stderr while retaining explicit exit-code checks. The port-forward binds to 127.0.0.1 and ngrok targets http://127.0.0.1:8080, avoiding the IPv6 localhost failure at ::1. The script waits up to 10 minutes for the runtime before validating the public URL.

\(syntaxErrors = \)null
[System.Management.Automation.Language.Parser]::ParseFile(
"D:\Floci\scripts\Start-FlociLab.ps1",
[ref]$null,
[ref]$syntaxErrors
) | Out-Null
$syntaxErrors

No output means the PowerShell syntax is valid. Run the script once before registering it.

powershell.exe -NoProfile -ExecutionPolicy Bypass `
-File "D:\Floci\scripts\Start-FlociLab.ps1"

Create the hidden VBS launcher

Save this file as D:\Floci\scripts\Start-FlociLab.vbs. WScript launches the PowerShell recovery script with window style 0, waits for its exit code, and records all startup output without leaving a visible terminal open.

Set shell = CreateObject("WScript.Shell")

command = "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command ""& 'D:\Floci\scripts\Start-FlociLab.ps1' *> 'D:\Floci\scripts\logs\scheduled-task.log'"""

exitCode = shell.Run(command, 0, True)

WScript.Quit exitCode

Run automatically at Windows sign in

$taskAction = New-ScheduledTaskAction `
-Execute "wscript.exe" `
-Argument '"D:\Floci\scripts\Start-FlociLab.vbs"'

$taskTrigger = New-ScheduledTaskTrigger `
-AtLogOn `
-User $env:USERNAME
$taskTrigger.Delay = "PT2M"

$taskSettings = New-ScheduledTaskSettingsSet `
-StartWhenAvailable `
-ExecutionTimeLimit ([TimeSpan]::Zero) `
-MultipleInstances IgnoreNew `
-Hidden

$taskPrincipal = New-ScheduledTaskPrincipal `
-UserId "$env:USERDOMAIN\env:USERNAME" `
-LogonType Interactive `
-RunLevel Highest

Register-ScheduledTask `
-TaskName "Start Floci Mendix Lab" `
-Action $taskAction `
-Trigger $taskTrigger `
-Settings $taskSettings `
-Principal $taskPrincipal `
-Description "Restores the Floci Mendix lab two minutes after Windows sign-in" `
-Force

# Disable the obsolete task that opened a visible PowerShell window.
Disable-ScheduledTask -TaskName "Mendix Local Startup"

Start-ScheduledTask -TaskName "Start Floci Mendix Lab"
Start-Sleep -Seconds 30
Get-ScheduledTaskInfo -TaskName "Start Floci Mendix Lab" |
Select-Object LastRunTime, LastTaskResult, NextRunTime

Verified final result on 13 September 2026: LastTaskResult was 0 after an actual Windows restart. Docker starts at sign-in, the recovery task begins after a two-minute delay, the VBS launcher keeps PowerShell hidden, and the IPv4 port-forward and ngrok tunnel run without visible windows. The Mendix runtime reached 2/2 Running, Agent and Operator reached 1/1 Running, and the public URL returned HTTP 200.

Final validation and operating notes

Normal startup behavior

• The Kubernetes API and containers can take several minutes to become ready after Docker Desktop starts.

• A runtime pod can temporarily report readiness HTTP 500 while Mendix initializes.

• The public URL is unavailable until both kubectl port-forward and the ngrok agent are running.

• Use 127.0.0.1 explicitly for both port-forward and ngrok; localhost can resolve to IPv6 ::1 and cause a refused private-leg connection.

• The exact free ngrok hostname supports one environment at a time. Multiple environment subdomains require a wildcard-capable domain or separate endpoints.

• The startup script writes host-process logs under D:\Floci\scripts\logs. Task Scheduler may remain Running while the script waits; LastTaskResult becomes 0 after completion.

• Keep Mendix Local Startup disabled. It is the obsolete duplicate task that opened a visible Administrator PowerShell window.

Safe recovery order

1. Run D:\Floci\scripts\Start-FlociLab.ps1.

2. Confirm the three fixed Docker addresses.

3. Confirm the floci-mendix context and Ready node.

4. Confirm ingress-nginx, Agent, Operator, and runtime pods.

5. Inspect only the failing component logs; never publish full secrets or unredacted custom resource YAML.

6. Validate the public URL with Invoke-WebRequest.