sidecar proxy
also: sidecar, envoy proxy
A lightweight proxy service that runs as a separate container or process alongside an application, handling networking tasks like traffic routing, load balancing, and security without requiring changes to the application code.
A sidecar proxy is an architectural pattern where a dedicated proxy process runs on the same host or pod as your main application. Instead of the application directly handling network communication, the proxy intercepts and manages all incoming and outgoing traffic, enabling sophisticated networking features transparently.
Common tasks handled by sidecar proxies include TLS/mTLS encryption, request routing, load balancing, retries, circuit breaking, and observability metrics collection. Examples include Envoy (used in Istio service mesh) and linkerd-proxy. In Kubernetes, a sidecar proxy typically runs as a separate container within the same pod as the application.
Example: In a Kubernetes deployment using Istio, a Pod contains both your Node.js application and an Envoy proxy sidecar. All traffic from the app passes through Envoy, which can intelligently route requests, enforce policies, and collect metrics—all without modifying the application itself.