Overcast is alpha — behaviour and APIs may change between releases. Pin your version and read the changelog before upgrading.

overcast

What host and port a URL carries

Overcast mints every URL on the configured hostname and the port you reached it on, so the same resource shows different ports to the host and to a container. What follows from that.

Every URL Overcast hands out follows one rule: the configured OVERCAST_HOSTNAME (when set), on the port you reached Overcast on. Your request is the only proof of a dialable port — Overcast cannot see its own Docker port mapping — so under a remapped port (docker run -p 4652:4566) host-side callers get URLs on :4652 and containers Overcast starts get :4566. Each party receives a URL that works for them, and values that cross the container boundary mechanically (queue URLs baked into a function’s environment by a deploy, invoke payloads) are rewritten at the boundary.

ConsequenceWhy
The same resource shows different ports to different callersA stack output read from the host says :4652; the same output inside a Lambda says :4566. Both dial correctly
SQS queue URLs echo your exact origin, with no hostname substitutionSDKs dial the QueueUrl itself, so Overcast returns precisely what you just proved reachable
The Cognito issuer carries your portOIDC discovery requires issuer to match the URL the configuration was fetched from, and jwks_uri must be dialable by whoever validates the token
ECR’s repositoryUri is the exception: it names the registry container’s own address, never your originThe docker daemon dials it, not your API client

A remapped port splits the Cognito issuer. A token minted from the host carries :4652 in its iss, and a validator inside a container comparing that string against its own :4566 issuer reports a mismatch. No single port can be dialable from both sides of a remap, so publish the API 1:1 (-p 4566:4566) and the issuer becomes identical everywhere. Overcast’s own token validation is unaffected either way.

Important

All of this presumes OVERCAST_HOSTNAME, if set, resolves to Overcast for every party. The split-horizon names do; OVERCAST_HOSTNAME=localhost does not — inside a container localhost is the container — and it is the one setting that silently breaks container callers. See Hostnames that resolve for every caller.