Read auth token from env vars

env.example

@@ -0,0 +1 @@
+export LOCALSTACK_AUTH_TOKEN=ls-...

internal/auth/auth.go

@@ -0,0 +1,16 @@
+package auth
+
+import (
+	"errors"
+	"os"
+)
+
+// GetToken returns the auth token from keyring or environment variable.
+func GetToken() (string, error) {
+	// TODO: try keyring first
+
+	if token := os.Getenv("LOCALSTACK_AUTH_TOKEN"); token != "" {
+		return token, nil
+	}
+	return "", errors.New("auth token not found, please set LOCALSTACK_AUTH_TOKEN")
+}

internal/container/start.go

@@ -6,17 +6,25 @@ import (
 	"net/http"
 	"time"
 
+	"github.com/localstack/lstk/internal/auth"
 	"github.com/localstack/lstk/internal/runtime"
 )
 
 func Start(ctx context.Context, rt runtime.Runtime, onProgress func(string)) error {
+	token, err := auth.GetToken()
+	if err != nil {
+		return err
+	}
+	env := []string{"LOCALSTACK_AUTH_TOKEN=" + token}
+
 	// TODO: hardcoded for now, later should be configurable
 	containers := []runtime.ContainerConfig{
 		{
 			Image:      "localstack/localstack-pro:latest",
 			Name:       "localstack-aws",
 			Port:       "4566",
 			HealthPath: "/_localstack/health",
+			Env:        env,
 		},
 	}
 

internal/runtime/docker.go

@@ -73,6 +73,7 @@ func (d *DockerRuntime) Start(ctx context.Context, config ContainerConfig) (stri
 		&container.Config{
 			Image:        config.Image,
 			ExposedPorts: exposedPorts,
+			Env:          config.Env,
 		},
 		&container.HostConfig{
 			PortBindings: portBindings,

internal/runtime/runtime.go

@@ -7,6 +7,7 @@ type ContainerConfig struct {
 	Name       string
 	Port       string
 	HealthPath string
+	Env        []string // e.g., ["KEY=value", "FOO=bar"]
 }
 
 type PullProgress struct {

test/integration/start_test.go

@@ -2,6 +2,7 @@ package integration_test
 
 import (
 	"context"
+	"os"
 	"os/exec"
 	"testing"
 	"time"
@@ -13,17 +14,51 @@ import (
 
 const containerName = "localstack-aws"
 
-func TestStartCommandFailsWithoutAuth(t *testing.T) {
+func TestStartCommandSucceedsWithValidToken(t *testing.T) {
+	authToken := os.Getenv("LOCALSTACK_AUTH_TOKEN")
+	require.NotEmpty(t, authToken, "LOCALSTACK_AUTH_TOKEN must be set to run this test")
+
+	cleanup()
+	t.Cleanup(cleanup)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
+	defer cancel()
+
+	cmd := exec.CommandContext(ctx, "../../bin/lstk", "start")
+	cmd.Env = append(os.Environ(), "LOCALSTACK_AUTH_TOKEN="+authToken)
+	output, err := cmd.CombinedOutput()
+
+	require.NoError(t, err, "lstk start failed: %s", output)
+
+	inspect, err := dockerClient.ContainerInspect(ctx, containerName)
+	require.NoError(t, err, "failed to inspect container")
+	assert.True(t, inspect.State.Running, "container should be running")
+}
+
+func TestStartCommandFailsWithoutToken(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
+	defer cancel()
+
+	cmd := exec.CommandContext(ctx, "../../bin/lstk", "start")
+	cmd.Env = []string{} // Clear environment to ensure no token
+	output, err := cmd.CombinedOutput()
+
+	require.Error(t, err, "expected lstk start to fail without token")
+	assert.Contains(t, string(output), "auth token not found")
+}
+
+func TestStartCommandFailsWithInvalidToken(t *testing.T) {
 	cleanup()
 	t.Cleanup(cleanup)
 
 	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
 	defer cancel()
 
 	cmd := exec.CommandContext(ctx, "../../bin/lstk", "start")
+	cmd.Env = append(os.Environ(), "LOCALSTACK_AUTH_TOKEN=invalid-token")
 	output, err := cmd.CombinedOutput()
 
-	require.Error(t, err, "expected lstk start to fail without auth")
+	require.Error(t, err, "expected lstk start to fail with invalid token")
 	assert.Contains(t, string(output), "License activation failed")
 }