Terway
github.com
What it is
Terway is a free, self-hosted CNI plugin for Alibaba Cloud Kubernetes (ACK), built on Alibaba Cloud ENI technology and running on Linux. Each Pod receives its own network stack and IP address. Pods on one ECS instance communicate directly, while traffic between ECS instances uses VPC ENIs without VxLAN encapsulation. ENI mode allocates interfaces to Pods, and trunking can provide independent ENIs for flexible security-group and switch settings. Node pools can be configured for exclusive ENI use. Terway supports Kubernetes NetworkPolicy, traditional security groups, egress control, dual-stack IPv4 and IPv6, and multi-cluster networking. The project uses eBPF for protocol-stack acceleration and describes the result as low latency and high throughput. Supported environments include Kubernetes ACK, Alibaba Cloud VPC/ENI, Alibaba Cloud Linux 3/4, ContainerOS, and Ubuntu. In self-hosted clusters, trunking is unavailable; the README also marks VPC Network Mode and Exclusive ENI Mode as deprecated.
Spec sheet
- Product
- Terway is a CNI plugin for Alibaba Cloud Kubernetes (ACK), built on Alibaba Cloud ENI technology.Read 3 Oct 2026 · github.com
- Community support
- The README invites bug fixes, feature work, documentation improvements, and code contributions, and lists a DingTalk group ID of 35924643.Read 3 Oct 2026 · github.com
- Deprecated modes
- The README marks VPC Network Mode and Exclusive ENI Mode as deprecated.Read 3 Oct 2026 · github.com
- ENI mode
- ENI network mode allocates ENIs to Pods to optimize resource use and network performance.Read 3 Oct 2026 · github.com
- IP support
- Terway supports dual-stack IPv4 and IPv6.Read 3 Oct 2026 · github.com
- Network security
- Terway supports Kubernetes NetworkPolicy and traditional security groups for multi-dimensional network access control.Read 3 Oct 2026 · github.com
- Node pools
- Terway supports configuring node pools for exclusive ENI usage.Read 3 Oct 2026 · github.com
- Performance
- Terway uses eBPF for protocol stack acceleration and describes the result as low latency and high throughput.Read 3 Oct 2026 · github.com
- Pod networking
- Each Pod has its own network stack and IP address; Pods on the same ECS instance communicate directly, while cross-ECS Pod traffic travels through VPC ENIs without VxLAN encapsulation.Read 3 Oct 2026 · github.com
- Security reporting
- The project asks users to report code vulnerabilities to [email protected] and refers to SECURITY.md for details.Read 3 Oct 2026 · github.com
- Self-hosted limitation
- The README says ACK-provided versions match the open-source version except that Trunking is unavailable in self-hosted clusters.Read 3 Oct 2026 · github.com
- Trunking
- Trunking allows Pods to have independent ENIs for flexible security group and switch configurations.Read 3 Oct 2026 · github.com
Plans and prices
Open source Free Trunking is unavailable in self-hosted clusters Read 3 Oct 2026 · github.com
Strong points and limits
Strong points
- Free open-source CNI plugin
- Each Pod gets its own IP address
- Supports NetworkPolicy and security groups
- Dual-stack IPv4 and IPv6 support
- eBPF acceleration for network protocols
Limits
- Trunking is unavailable in self-hosted clusters
- VPC Network Mode is deprecated
- Exclusive ENI Mode is deprecated
Who it suits
Terway suits teams running Alibaba Cloud Kubernetes or compatible self-hosted Linux clusters that need ENI-based Pod networking and policy controls.
Verdict
Terway provides ENI-oriented Pod networking with policy controls, dual-stack support, and eBPF acceleration. Self-hosted users should account for the missing trunking feature and deprecated network modes.
Where Specifiction places it
- Container Networking Software#22 of 287.0
Alternatives to TerwayAll alternatives →
Aviatrix Kubernetes Firewall 8.5 Visit 
Calico Open Source Free plan 8.0 Visit 
Cilium Free plan 7.8 Visit