Envoyvs
Asana
Asana: Manage your team's work, projects, & tasks online
Envoy
A high-performance L7 proxy written in C++ that is configured by an API rather than a config file, and is usually deployed under a control plane.
As of 30 August 2026, Envoy is free to use. Envoy is the data plane inside Istio, Consul, Gloo, Contour and most modern service meshes and API gateways. Softwr lists it under Technology.
Overview
What Envoy does
Envoy is an L4 and L7 proxy written in C++, originally built at Lyft by Matt Klein and donated to the Cloud Native Computing Foundation, where it became a graduated project. It is licensed under Apache 2.0. It runs as an edge proxy, a per-node gateway or a per-pod sidecar, and it speaks HTTP/1.1, HTTP/2, HTTP/3, gRPC, TCP and a set of application protocols including Redis, MongoDB, Kafka and Postgres through dedicated filters. It emits detailed statistics, distributed tracing spans and structured access logs as a matter of course rather than as an add-on. The thing that distinguishes it is that its real interface is not a configuration file, it is xDS, a set of gRPC APIs through which a control plane pushes listeners, routes, clusters and endpoints to a running proxy and updates them without a restart. That design is the reason Envoy became the shared substrate of the cloud-native networking market: Istio, Consul, Gloo, Emissary, Contour and Envoy Gateway are all control planes that generate xDS, and each of them chose Envoy rather than writing a proxy. Commercially it means the proxy layer is a commodity and the competition happens above it, and it means skills and observability transfer between those products in a way they do not between Nginx and HAProxy. The organisations that adopt it directly are those with dedicated platform or traffic engineering teams and a scale where request-level control, per-route retries, outlier detection and consistent telemetry across hundreds of services actually pay for themselves. The trade-off is the size of the surface. The configuration model is far larger than the alternatives, extending it properly means writing C++ and building your own binary, and there is no single vendor whose support contract covers Envoy itself, so a production bug in the proxy is your engineers reading C++ unless you have bought a control plane from Solo.io, Tetrate or a cloud provider.
What people use it for
- Acting as the data plane under a service mesh or Gateway API implementation, which is how the overwhelming majority of deployments use it
- An edge or API gateway that needs per-route retry budgets, circuit breaking and outlier detection rather than round-robin proxying
- Migrating traffic between service versions or between a monolith and its replacement, using weighted splits and shadow traffic
- Standardising observability across a polyglot estate, so that latency, error rates and tracing look the same regardless of the language a service is written in
The honest half
Where it falls short
Concrete and checkable, so you can decide whether any of them matter to you. This is the half of a review a vendor will not write about Envoy.
- The configuration surface is very large and hand-written bootstrap YAML runs to hundreds of lines for routing that Nginx expresses in twenty, which is why nearly every production deployment sits under a control plane and inherits that control plane's constraints as well.
- xDS is the real API and it is not stable in the comfortable sense; the v2 API set was removed outright, resource types continue to be deprecated, and your control plane and Envoy binaries have to be upgraded roughly in step or the proxies stop accepting configuration.
- Extending it properly means writing a C++ filter and building and maintaining your own Envoy binary; the alternatives are Lua, which adds per-request overhead, and proxy-wasm, whose ABI has remained effectively experimental for years with a real performance cost.
- At sidecar density the per-proxy memory and CPU footprint is a measurable share of cluster capacity, since thousands of workloads each carry a full proxy, and this is precisely the cost that has pushed mesh projects towards node-level or ambient architectures.
- There is no single vendor selling support for Envoy itself; you get the community plus control-plane vendors such as Solo.io and Tetrate, so an Envoy-level production bug is your own engineers in a C++ codebase unless a support contract happens to cover it.
- Diagnosing why a request got a particular response involves reading config dumps, the stats endpoint and the RESPONSE_FLAGS codes in access logs rather than a readable error, which is a specific skill you must hire or spend months growing.
Cross-shopped
What people choose instead of Envoy
Each pairing was judged by two reviewers asking whether a buyer would genuinely weigh the two against each other. The ones that failed were deleted rather than published.
- EnvoyvsClickUp
ClickUp: One app to replace them all
- EnvoyvsLinear
Linear: The issue tracking tool you'll enjoy using
- EnvoyvsFigma
Figma: The collaborative interface design tool
Capabilities
Features
xDS dynamic configuration
Listeners, routes, clusters and endpoints are pushed over gRPC and applied without restarting the proxy
Protocol breadth
Handles HTTP/1.1, HTTP/2, HTTP/3, gRPC and raw TCP, with protocol-aware filters for Redis, Kafka, MongoDB and Postgres
Filter chain architecture
Request handling is a chain of network and HTTP filters you compose, including authorisation, rate limiting and transformation
Observability by default
Emits thousands of counters and histograms, distributed tracing spans and configurable structured access logs
Outlier detection
Ejects unhealthy upstream hosts from the load balancing pool based on observed error rates rather than only health checks
Traffic shaping
Per-route retries with budgets, timeouts, circuit breakers, fault injection and weighted traffic splitting
mTLS termination and origination
Terminates and originates mutual TLS, which is what makes it the data plane for service mesh identity
Hot restart
Replaces the running binary while draining connections, so upgrades do not drop in-flight requests
Answered, with sources
Questions people ask
Each answer names the page it came from, so you can check it rather than take our word for it.
Should I run Envoy on its own, or under a control plane?
Almost always under one. Directly authoring xDS or static bootstrap configuration is viable for a handful of routes and becomes unmanageable beyond that. Envoy Gateway, Istio, Contour, Gloo and Consul all exist to generate that configuration for you.
How does it compare with Nginx or HAProxy?
Envoy is dynamically configured over an API and instrumented far more heavily; Nginx and HAProxy are faster to configure and lighter for straightforward reverse proxying. If you never need to change routing without a reload, Envoy is more machinery than the problem requires.
What does it cost?
Nothing to licence; it is Apache 2.0 and there is no paid edition. The cost is engineering time and, for most organisations, a commercial control plane or cloud service that packages it.
Can I write extensions without C++?
You can write Lua filters or proxy-wasm modules in Rust, Go, C++ or AssemblyScript. Both carry per-request overhead compared with a native filter, and the Wasm path has been slower to stabilise than the project originally projected.
Is it a CNCF project?
Yes, it is a graduated CNCF project licensed under Apache 2.0, which means the trademark and governance sit with the foundation rather than with Lyft or any vendor.
Keep looking
Where to go from Envoy
- Envoy alternativesEvery product people weigh against it
- Envoy pricingPlans, floors and what the tiers exclude
- Envoy badgesWhich rules it meets, and the figure behind each
- All Technology softwareThe full category
- Best Technology softwareThe shortlist, and how it was cut
Best Technology software for
Compare Envoy with
- ClickUp
- Linear
- Asana
- Figma
- Istio
- Finxact
- Jenkins
- Mozilla Firefox
- Thought Machine
- Alkami
- Heap
- Personetics
- Lovable
- Miro
- Plane
- Postman
- Jenkins
- Personetics
Other Technology software
A Kubernetes service mesh that adds mutual TLS, traffic control and telemetry between services without changing application code.
Free plan15 researched notesCloud native core banking, sold as Finxact from Fiserv since the 2022 acquisition
Pricing on request11 researched notesA self-hosted automation server that can build almost anything, through a plugin ecosystem that is also its main liability.
Free plan15 researched notesAn independent web browser with its own rendering engine, funded almost entirely by search placement deals.
Free plan15 researched notesCloud native core banking where products are written as smart contracts
Pricing on request11 researched notesDigital banking platform for United States banks and credit unions
Pricing on request11 researched notesData driven personalisation and money insights inside a bank's existing app
Pricing on request11 researched notesA self-hosted automation server that can build almost anything, through a plugin ecosystem that is also its main liability.
Free plan15 researched notesData driven personalisation and money insights inside a bank's existing app
Pricing on request11 researched notes
Softwr does not host reviews and shows no star rating for Envoy, because a rating we did not collect is not ours to publish. What is here is the pricing and platform detail from the vendor’s own pages, limitations we could state concretely, and alternatives a reviewer confirmed people weigh against it. Tell us if any of it is wrong.
More on Envoy
Envoy alternatives
What people switch to, and what they give up
Envoy pricing
Every tier, and where the cost actually lands
Compare Envoy
Put it head to head with anything we hold
Envoy badge
Its rating, and an embed for your own site
Best Technology software alternatives
Secure access for everyone
The digital analytics platform to understand your users
Apple's WebKit browser, available only on Apple operating systems and updated only with them.
free