Istio
dragon.istio
A Docker Compose file for Istio alone, generated from the catalog and checked by the safety inspector. No account needed.
Service mesh that puts a proxy alongside each workload to handle routing, retries, mutual TLS, policy enforcement and telemetry without changes to application code.
Istio intercepts traffic entering and leaving each workload through a data-plane proxy, which lets routing rules, retries, timeouts, circuit breaking and fault injection be declared as configuration rather than implemented in every service. Mutual TLS between workloads is issued and rotated by the control plane, so identity-based authorisation policies replace network-location trust. Because every request passes through the proxies, consistent metrics, distributed traces and access logs are produced for services that were never instrumented. It runs on Kubernetes, with an ambient mode that removes the per-pod sidecar in favour of a shared node-level proxy.
You know it worked when
- The control plane reports healthy and its custom resource definitions are registered.
- A workload in an injected namespace starts with its proxy container running.
- Traffic between two meshed workloads is reported as mutually authenticated.
- A routing rule splitting traffic between two versions takes effect in the observed distribution.
- Request metrics for those workloads appear without the applications having been instrumented.
Known sharp edges
- Istio requires Kubernetes; the control plane container alone provides no proxying and will not start usefully without a cluster behind it.
- Sidecar injection changes pod startup ordering, and an application that opens connections before its proxy is ready fails intermittently at deploy time rather than consistently.
- Strict mutual TLS applied before every workload is enrolled cuts off traffic from anything still outside the mesh, which presents as a sudden partial outage.
- Each proxy adds latency and memory per pod, and the control plane must be sized against the number of workloads and configuration objects it watches.