Zuul
Zuul is Netflix’s free, open-source, self-hosted Layer 7 application gateway for Linux.
What Zuul is
Zuul is Netflix’s free, open-source, self-hosted Layer 7 application gateway for Linux. It handles traffic between clients and application backends, with filters for authentication, security, monitoring, dynamic routing, stress testing, load shedding, static responses, and multiregion routing. Supported protocols are HTTP, HTTP/2, WebSocket, and Server-Sent Events. Zuul can work with Eureka for service discovery, static server lists, or another discovery service. Its documented default load balancer uses Ribbon with round-robin selection and availability-zone success tracking. Retry handling covers read timeouts, reset connections, connection errors, HTTP 503 responses, and configurable idempotent status codes. Additional listed capabilities include rate limiting, request transformation, Kubernetes support, cloud fault injection, experiment scheduling, and blast-radius controls; network fault injection is not supported. Request Passport records timestamped lifecycle events, while Request Attempts records proxy attempts and statuses. The project is licensed under Apache-2.0, with Maven and Gradle examples for Zuul Core 4.0.0.
Good
- Dynamic routing and multiregion traffic controls
- Filter-based authentication and mutual TLS
- Retries for several connection failure conditions
- HTTP, HTTP/2, WebSocket, and SSE support
- Kubernetes and cloud fault-injection support
Watch out
- Self-hosted deployment is required
- Network fault injection is not supported
- Per-host pools can raise backend connection minimums
- Repository has no published security advisories
Who it suits
Zuul suits teams that need a self-managed gateway whose behavior can adapt to changing API traffic and production conditions. It requires Linux hosting and operational responsibility for deployment.
Verdict
Zuul provides a broad gateway filter model with routing, resilience, security, and controlled experimentation features. Its self-hosted architecture and documented connection-pool behavior should be considered during capacity planning.
The facts
Each one read from Zuul's own pages, with the date it was checked.
What it does
- Authentication
- Zuul filters can identify authentication requirements for resources and reject requests that do not satisfy them.checked 9 Oct 2026
- Configuration limit
- The documented connection pool uses a pool per host and event loop, which can make the minimum number of backend connections high when many Zuul instances and event loops run.checked 9 Oct 2026
- Deployment consideration
- The Core Features guide cautions that Zuul's per-host, per-event-loop connection pools can result in a high minimum number of backend connections when many instances and event loops are running.checked 9 Oct 2026
- Distribution
- The Getting Started guide provides Maven and Gradle dependency examples for Zuul Core version 4.0.0 and instructions to build and run a sample app.checked 9 Oct 2026
- Filters
- Zuul filters can handle authentication, security, monitoring, dynamic routing, stress testing, load shedding, static responses, and multiregion routing.checked 9 Oct 2026
- Installation
- The getting-started guide lists Maven coordinates for zuul-core version 4.0.0 and shows how to build and run the sample app with Gradle.checked 9 Oct 2026
- Integrations
- Zuul is designed to work with Eureka for service discovery and can also use static server lists or another discovery service.checked 9 Oct 2026
- Intended users
- The Netflix TechBlog describes self-service routing use cases including staging traffic, onboarding services, load testing, gradual migrations, canary testing, and rejecting requests by path or header.checked 9 Oct 2026
- License
- The repository is licensed under Apache-2.0.checked 9 Oct 2026
- Load balancing
- The documented default load balancer uses Ribbon and round robin selection, with availability zone success tracking.checked 9 Oct 2026
- Monitoring and debugging
- Request Passport records timestamped request lifecycle events, while Request Attempts tracks proxy attempts and their status.checked 9 Oct 2026
- Netflix components
- Netflix's usage page describes using Hystrix, Ribbon, Turbine, and Archaius with Zuul in its deployment.checked 9 Oct 2026
- Product
- Zuul is an L7 application gateway for dynamic routing, monitoring, resiliency, and security.checked 9 Oct 2026
- Protocols and security
- The Netflix TechBlog lists inbound HTTP/2 support and mutual TLS among Zuul 2's features.checked 9 Oct 2026
- Resiliency
- Zuul 2 includes adaptive retries and configurable concurrency limits intended to protect origin services from overload.checked 9 Oct 2026
- Routing and traffic controls
- Its filters support dynamic routing, load shedding, stress testing, static responses, and multiregion routing.checked 9 Oct 2026
- Security features
- The Zuul 4 feature list includes mutual TLS.checked 9 Oct 2026
- Security policy
- GitHub reports that the repository has no SECURITY.md file and no published security advisories.checked 9 Oct 2026
- Support
- The repository directs users to its wiki for usage information and how-to guidance.checked 9 Oct 2026
- Use case
- The project describes Zuul as an edge service that handles requests from devices and websites to Netflix’s streaming application backend.checked 9 Oct 2026
- What it does
- Zuul is an L7 application gateway for dynamic routing, monitoring, resiliency, and security.checked 9 Oct 2026
Alternatives to Zuul
- 1
Amazon API Gateway
Free planAndroidiOSWebAPI8.2From $1 a month - 2
Higress
Free planOpen sourceWebAPILinuxmacOS7.7Free plan - 3
Tyk Gateway
Free planOpen sourceWebAPILinuxSelf-hosted7.3Free plan - 4
Google Cloud Endpoints
Free planWebAPILinuxmacOS7.1$1.50 usage-based - 5
Gravitee API Gateway
Free planWebAPILinuxSelf-hosted7.1From $2,500 a month - 6
Kong Gateway
Free planWebAPILinuxSelf-hosted6.7Free plan