The envoyproxy/ratelimit repository is a Go and gRPC service that provides generic rate limiting capabilities for applications of various types. The service enables applications to request rate limit decisions based on a domain and a set of descriptors, then reads configuration from disk, composes a cache key, and consults a Redis cache to return a decision to the caller. This architecture makes it particularly useful for distributed systems that need to enforce traffic control policies across multiple services.
The repository is classified across 21 distinct categories including distributed systems, traffic management, concurrency limits, HTTP filters, Envoy proxy integration, flow control, API throttling, service mesh support, network efficiency, protocol support, resource allocation, HTTP/2 support, request control, load balancing, traffic control, API gateway functionality, request throttling, distributed rate limiting, network performance, rate limiting, and quota management. This broad classification reflects the service's versatility in handling different rate limiting scenarios across modern infrastructure.
The Docker image for this service uses Google's distroless base image specifically gcr.io/distroless/static-debian12:nonroot, pinned to a specific SHA digest for deterministic builds. The distroless approach provides enhanced security through minimal attack surface, smaller image sizes, reduced vulnerabilities, better compliance with security requirements, non-root execution as UID 65532, and reproducible builds.
The service currently supports the v3 rls.proto API from the Envoy data-plane-api, with v2 rls.proto now deprecated. The API deprecation history shows that v1.0.0 was tagged after the service had been in production use at Lyft for over two years. Version 1.1.0 introduced the data-plane-api proto and initiated deprecation of the legacy ratelimit.proto.
The README documents extensive configuration capabilities including file-based and xDS Management Server-based configuration loading, support for local cache and Redis backends with connection pool settings, Memcache support, custom headers, tracing, TLS and mTLS support, health checking, gRPC keepalive settings, statistics collection via DogStatsD and Prometheus, and debug endpoints. The configuration format uses YAML to support comments and includes features like shadow mode, descriptor definitions, rate limit definitions, and wildcard threshold sharing.
