Envoy Proxy vs HAProxy Community Edition
Envoy Proxy
envoyproxy.ioHAProxy Community Edition
haproxy.orgSide by side
| Figure | Envoy Proxy | HAProxy Community Edition |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | Yes |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 3 |
| Spec score · Reverse Proxy Software | 8.0 (#14) | 8.8 (#5) |
| Architecture | Envoy is a self-contained, out-of-process proxy that can work with applications written in different languages. | HAProxy uses an event-driven architecture and light multithreading on SMP machines. |
| Integrations | The documentation names Envoy Gateway and Istio as control planes compatible with Envoy's API. | The 3.4 release notes list an OpenTelemetry filter and ACME certificate features including DNS-01 challenges. |
| Purpose | Envoy is an open-source edge and service proxy designed for cloud-native and AI-native applications. | HAProxy is a free, fast reverse proxy offering high availability, load balancing, and proxying for TCP and HTTP applications. |
| Security | Envoy supports TLS, JWT, role-based access control, and OAuth-related authentication and authorization features. | Listed defensive measures include chroot, privilege drops, fork prevention, strict protocol validation, and checks for impossible states. |
Plans
HAProxy Community Edition
- HAProxy Community EditionFree
- HAProxy Community EditionFree
- HAProxy EnterprisePriced on request
In their own words
Envoy Proxy
Envoy Proxy is a free, open-source proxy for edge traffic and service-to-service communication in cloud-native and AI-native applications. It runs as a self-contained process outside the application and can serve software written in different languages. Envoy handles HTTP/1.1, HTTP/2, gRPC, and HTTP/3, with HTTP/3 documented as alpha. Traffic features include routing, retries, circuit breaking, rate limiting, request shadowing, and outlier detection. It exposes subsystem statistics, an administration interface, and distributed tracing through third-party providers. Security features include TLS, JWT, role-based access control, and OAuth-related authorization and authentication. Operators must configure protections such as watermarks, overload management, and circuit breakers for availability resilience. Installation options include Docker images for amd64 and arm64, macOS Homebrew, and static binaries. Its API is compatible with Envoy Gateway and Istio.
HAProxy Community Edition
HAProxy Community Edition is free, self-hosted software for proxying TCP and HTTP applications, with high availability and load balancing. It is aimed especially at very high-traffic websites. HAProxy runs on Linux, where it is included with most mainstream distributions and is often deployed by default on cloud platforms. Its event-driven design uses light multithreading on SMP machines. The project lists Layer 4 and Layer 7 routing and TLS termination, along with TCP and HTTP support; recent versions also include QUIC and HTTP/3 features. Listed safeguards include chroot, privilege drops, fork prevention, strict protocol validation, and checks for impossible states. The site reports up to 2 million SSL requests per second and 100 Gbps of forwarded traffic on AWS Graviton2. HAProxy 3.4 is in development, and 3.4.6 is the latest listed release in that branch. Its features include dynamic backends, HTTP/2 flood protections, ACME improvements, experimental QMUX, and an OpenTelemetry filter. LTS branches receive five years of maintenance; other stable branches receive 12 to 18 months.