Sōzu

Free plan LinuxSelf-hosted

What Sōzu is

Sōzu is a free, open-source, self-hosted TCP and HTTP reverse proxy for Linux, built in Rust. It targets changing web infrastructure and can apply configuration updates while running, without a reload. External tools send atomic configuration diffs through a Unix socket using a Protocol Buffers-based protocol. Its process and worker model is designed to support upgrades while requests continue, including avoiding connection loss during configuration and binary changes. Sōzu detects failed backends and offers Round Robin, Random, Least_loaded, and Power of two load balancing. It can terminate TLS with ring, AWS-LC, or OpenSSL backends selected at compile time. Logs can go to stdout, files, TCP, UDP, or Unix sockets, while metrics use StatsD or local aggregation queried through the configuration socket. Linux binaries and tagged-release Docker images are published, and source builds are documented. Fixed resource and connection limits are intended to reduce out-of-memory kills and latency at high connection counts.

Who it suits

Sōzu suits Linux teams running self-hosted, frequently changing web infrastructure. It is especially relevant to cloud or PaaS providers managing many applications or customers.

What it does well

Runtime configuration changes without reloads
Multiple backend load-balancing algorithms
TLS termination with three compile-time backends
Logs support files, sockets, TCP, and UDP
Linux binaries and Docker images available

What to know first

Self-hosted deployment requires operational management
GNU Affero GPL obligations apply to covered businesses
Fixed resource and connection limits are part of design

Verdict

Sōzu focuses on dynamic proxy operation, runtime updates, backend balancing, and upgrade continuity. Its self-hosted Linux deployment and AGPL licensing are important considerations before adoption.

Facts from Sōzu's own pages

Control plane: External tools communicate with the main process through a Unix socket using a Protocol Buffers based binary protocol, and configuration is applied as atomic diffs. · sozu.io, 8 Oct 2026
Deployment: The project publishes Linux binaries and Docker images for tagged releases and also documents building from source. · github.com, 8 Oct 2026
Dynamic configuration: Sōzu applies configuration changes at runtime without reloading and supports multiple updates per second. · sozu.io, 8 Oct 2026
Headquarters: Nantes, France · sozu.io, 28 Sept 2026
High availability: Sōzu is designed to stay up while it upgrades itself and to avoid losing connections during configuration changes and binary upgrades. · sozu.io, 8 Oct 2026
Installation: The project README says prebuilt binaries are available for Linux and Docker images are published for tagged releases. · github.com, 8 Oct 2026
Intended users: The maker describes Sōzu as used by cloud and PaaS providers to manage changing web infrastructure and frequent app and customer additions. · sozu.io, 8 Oct 2026
License: Sōzu is covered by the GNU Affero General Public License version 3.0 and above; the maker says businesses based on Sōzu should contribute back or contact Clever Cloud for a business agreement. · sozu.io, 8 Oct 2026
Limits: The project says Sōzu uses fixed resource and connection limits to help avoid out-of-memory kills and increased latency under high connection counts. · sozu.io, 8 Oct 2026
Load balancing: It detects broken backend servers and supports Round Robin, Random, Least_loaded, and Power of two load balancing algorithms. · sozu.io, 8 Oct 2026
Logging: Its logger can send logs to stdout, files, TCP, UDP, and Unix sockets. · sozu.io, 8 Oct 2026
Metrics: Metrics can be sent using a StatsD compatible protocol or aggregated locally for querying through the configuration socket. · sozu.io, 8 Oct 2026
Product: Sōzu is an open source TCP and HTTP reverse proxy built in Rust for highly demanding web infrastructure. · sozu.io, 8 Oct 2026
Purpose: Sōzu is an open-source TCP and HTTP reverse proxy built in Rust for demanding, dynamic web infrastructures. · sozu.io, 8 Oct 2026
Release verification: The project README says releases include SHA256 checksums, sigstore keyless signatures, and SLSA build provenance attestations for tarballs. · github.com, 8 Oct 2026
Resource limits: Sōzu uses fixed resource and connection limits to help avoid out of memory kills and increased latency under high connection counts. · sozu.io, 8 Oct 2026
Runtime configuration: It applies configuration changes at runtime without reloading, including atomic configuration diffs through a Unix socket using a Protocol Buffers based protocol. · sozu.io, 8 Oct 2026
Security: The project describes Rust as providing memory safety and says Sōzu workers are sandboxed, with backends shielded behind the proxy. · github.com, 8 Oct 2026
Support contact: The site’s legal notice lists [email protected] for general support. · sozu.io, 8 Oct 2026
TLS: Sōzu can act as a TLS endpoint and supports ring, AWS-LC, and OpenSSL cryptographic backends at compile time. · github.com, 8 Oct 2026
Upgrades: Its main process and worker model is designed to allow upgrades while continuing to process requests. · sozu.io, 8 Oct 2026

Where Sōzu stands on Freedom251

Reverse Proxy Software#27 of 33