Envoy Proxy

Overview

Envoy Proxy is a free, self-hosted proxy for edge traffic and communication between services. It suits operators building large cloud-native or AI-native architectures who need consistent proxy behavior across applications written in different languages. Its breadth of traffic controls and security features is compelling, but operators must configure resilience protections themselves, and HTTP/3 remains alpha.

Envoy runs out of process from the applications it serves, reducing the need to embed proxy logic in each service. It supports HTTP/1.1, HTTP/2, gRPC and HTTP/3; the alpha status of HTTP/3 makes the other protocols the safer basis for production decisions. Envoy is a graduated Cloud Native Computing Foundation project.

Compare options in Reverse Proxy Software.

Key features

Traffic control and resilience

Routing, retries, circuit breaking, rate limiting, request shadowing and outlier detection give operators substantial control over how requests move through services and how failures are handled. Envoy also supports TLS termination, WebSockets and response caching. That range is useful in complex service architectures, but it brings configuration responsibility rather than a managed service that handles deployment for you.

Visibility and security

Subsystem statistics are exposed through an administration interface, and distributed tracing works through third-party providers. Security capabilities include TLS, JWT, role-based access control, and OAuth-related authentication and authorization features. These tools can support layered traffic protection and diagnosis, though trace collection depends on a third-party provider.

Envoy's threat model places responsibility for availability protections on operators. Watermarks, overload management and circuit breakers need appropriate configuration; relying on defaults without resource safeguards is not a sound resilience plan.

Deployment and integration

Docker images are provided for amd64 and arm64, with native macOS installation documented through Homebrew; static binaries are also an installation option. Envoy Gateway and Istio are named as compatible control planes for Envoy's API, useful for teams adopting either to manage Envoy configuration.

Pricing

Envoy Proxy — free. The open-source proxy can be installed using Docker, macOS Homebrew or a static binary. There is no paid tier or usage quota described here, so the tradeoff is operational: teams run and configure the proxy themselves rather than buying a managed deployment.

Platforms

Envoy is available for API, Linux, macOS, self-hosted and Windows environments. Its self-hosted deployment model makes it a better fit for teams prepared to operate proxy infrastructure than for readers seeking a turnkey hosted endpoint.

Who it's for

Envoy is strongest for platform and infrastructure teams routing edge traffic or service-to-service communication across large, modern service-oriented architectures. Its out-of-process design and control-plane compatibility help when services use different languages or need centralized traffic management. It is less suitable for small deployments that want minimal configuration, hosted operations or mature HTTP/3 support.

Pros and cons

Pros

• Broad traffic management: routing, retries, rate limiting, shadowing and outlier detection cover a range of operational needs in one proxy.
• Cross-language architecture: running out of process lets applications in different languages use the same proxy approach.
• Useful security and visibility controls: TLS, JWT, role-based access control, OAuth-related features, statistics and third-party tracing support traffic protection and diagnosis.
• Free and flexible deployment: Docker, Homebrew and static binary installation options support self-hosted use across listed platforms.

Cons

• Operational safeguards are the operator's job: resource protections must be configured to support availability under load.
• HTTP/3 is alpha: teams needing a mature HTTP/3 option should look elsewhere or rely on Envoy's other supported protocols.
• Self-hosted only: teams wanting a managed proxy service must choose a different deployment model.

Alternatives

• Traefik Proxy is a free open-source ingress controller, reverse proxy and load balancer with service auto-discovery; consider it when those roles and automatic discovery are the priority.
• NGINX is a free option combining a web server, reverse proxy, content cache, load balancer, TCP/UDP proxy and mail proxy; choose it when that mix better matches the workload.
• ngrok has a free plan with up to 3 online endpoints and up to 1GB data transfer; choose it when those endpoint and transfer allowances suit the need.
• Caddy is an alternative.
• HAProxy Community Edition is a free load balancer for TCP and HTTP proxying; consider it when those functions are the requirement.
• Pomerium offers a free personal plan capped at 10 users, 10 routes, 5 policies and 2 service accounts; choose it when those limits fit the deployment.
• freenginx is a free alternative distributed with source and documentation under a 2-clause BSD-like license.
• Reproxy is another free alternative.

Verdict

Choose Envoy Proxy if your team needs a capable, self-hosted edge or service-to-service proxy with broad traffic controls, security features and integration with Envoy-compatible control planes. Its strongest case is the combination of out-of-process flexibility and deep traffic management at no software cost. Look elsewhere if you need managed operations, do not want to configure resource protections, or require HTTP/3 beyond alpha status.