Zuul

Free plan LinuxSelf-hosted

What Zuul is

Zuul is a free, Apache-2.0 open-source, self-hosted Layer 7 application gateway for Linux. It handles requests between devices or websites and an application backend, providing dynamic routing, monitoring, resiliency and security. Filters can apply authentication, security checks, monitoring, stress testing, load shedding, static responses and multiregion routing. Zuul supports HTTP, HTTP/2, WebSocket and Server-Sent Events. It can work with Eureka for service discovery, static server lists or another discovery service. The documented default load balancer uses Ribbon with round-robin selection and availability-zone success tracking. Retries cover read timeouts, reset connections, connection errors, HTTP 503 responses and configurable idempotent status codes. Request Passport records timestamped lifecycle events, while Request Attempts records proxy attempts and status. Listed capabilities include mutual TLS, rate limiting, request transformation, Kubernetes support, cloud fault injection, experiment scheduling and blast-radius controls. Network fault injection is not supported. Maven and Gradle examples are provided for Zuul Core 4.0.0.

Who it suits

Zuul suits teams that need a self-hosted gateway whose routing, authentication and resilience behavior can be adapted to changing API traffic. It is intended for Linux deployments managed by the user.

What it does well

Free and Apache-2.0 licensed
Dynamic routing, load shedding and multiregion routing
Supports HTTP, HTTP/2, WebSocket and SSE
Mutual TLS and filter-based authentication
Includes experiment scheduling and blast-radius controls

What to know first

Self-hosted deployment required
Linux platform listed
Network fault injection is not supported
Per-host connection pools can raise backend connection minimums

Limits

Zuul is self-hosted, so deployment requires operating the gateway on Linux. Its documented per-host, per-event-loop connection pools can create a high minimum number of backend connections when many instances and event loops run.

Getting started

Install the Zuul Core 4.0.0 dependency using the Maven coordinates
Alternatively add the documented Gradle dependency
Build the sample application with Gradle
Run the sample app in your Linux self-hosted environment
Use the project wiki for usage and how-to guidance

Verdict

Zuul offers extensive gateway filters and traffic controls without a software price. Operating it yourself, and planning for its documented connection-pool behavior, are central deployment considerations.

Questions

Is Zuul free and open source?

Yes. Zuul is free, open source and licensed under Apache-2.0.

Where can Zuul run?

It is distributed as a self-hosted product for Linux.

Which protocols does Zuul support?

Supported protocols are HTTP, HTTP/2, WebSocket and Server-Sent Events.

What authentication methods are available?

Zuul supports filter-based authentication, mutual TLS and custom authentication handlers.

How is Zuul installed?

The getting-started guide provides Maven coordinates for Zuul Core 4.0.0 and examples for building and running a sample application with Gradle.

Does Zuul support network fault injection?

No. Cloud fault injection is listed, while network fault injection is not supported.

Facts from Zuul's own pages

Authentication: Zuul filters can identify authentication requirements for resources and reject requests that do not satisfy them. · github.com, 9 Oct 2026
Configuration limit: The documented connection pool uses a pool per host and event loop, which can make the minimum number of backend connections high when many Zuul instances and event loops run. · github.com, 9 Oct 2026
Deployment consideration: The Core Features guide cautions that Zuul's per-host, per-event-loop connection pools can result in a high minimum number of backend connections when many instances and event loops are running. · github.com, 9 Oct 2026
Distribution: The Getting Started guide provides Maven and Gradle dependency examples for Zuul Core version 4.0.0 and instructions to build and run a sample app. · github.com, 9 Oct 2026
Filters: Zuul filters can handle authentication, security, monitoring, dynamic routing, stress testing, load shedding, static responses, and multiregion routing. · github.com, 9 Oct 2026
Installation: The getting-started guide lists Maven coordinates for zuul-core version 4.0.0 and shows how to build and run the sample app with Gradle. · github.com, 9 Oct 2026
Integrations: Zuul is designed to work with Eureka for service discovery and can also use static server lists or another discovery service. · github.com, 9 Oct 2026
Intended users: The Netflix TechBlog describes self-service routing use cases including staging traffic, onboarding services, load testing, gradual migrations, canary testing, and rejecting requests by path or header. · netflixtechblog.com, 9 Oct 2026
License: The repository is licensed under Apache-2.0. · github.com, 9 Oct 2026
Load balancing: The documented default load balancer uses Ribbon and round robin selection, with availability zone success tracking. · github.com, 9 Oct 2026
Monitoring and debugging: Request Passport records timestamped request lifecycle events, while Request Attempts tracks proxy attempts and their status. · netflixtechblog.com, 9 Oct 2026
Netflix components: Netflix's usage page describes using Hystrix, Ribbon, Turbine, and Archaius with Zuul in its deployment. · github.com, 9 Oct 2026
Product: Zuul is an L7 application gateway for dynamic routing, monitoring, resiliency, and security. · github.com, 9 Oct 2026
Protocols and security: The Netflix TechBlog lists inbound HTTP/2 support and mutual TLS among Zuul 2's features. · netflixtechblog.com, 9 Oct 2026
Resiliency: Zuul 2 includes adaptive retries and configurable concurrency limits intended to protect origin services from overload. · netflixtechblog.com, 9 Oct 2026
Routing and traffic controls: Its filters support dynamic routing, load shedding, stress testing, static responses, and multiregion routing. · github.com, 9 Oct 2026
Security features: The Zuul 4 feature list includes mutual TLS. · github.com, 9 Oct 2026
Security policy: GitHub reports that the repository has no SECURITY.md file and no published security advisories. · github.com, 9 Oct 2026
Support: The repository directs users to its wiki for usage information and how-to guidance. · github.com, 9 Oct 2026
Use case: The project describes Zuul as an edge service that handles requests from devices and websites to Netflix’s streaming application backend. · github.com, 9 Oct 2026
What it does: Zuul is an L7 application gateway for dynamic routing, monitoring, resiliency, and security. · github.com, 9 Oct 2026

Where Zuul stands on Freedom251

API Gateway Software#21 of 29