// the find
linkerd/linkerd2-proxy
A purpose-built proxy for the Linkerd service mesh. Written in Rust.
linkerd2-proxy is the actual sidecar proxy that handles every byte of traffic in a Linkerd service mesh, written in Rust as a large workspace of small crates. It's for people building or extending Linkerd itself, not for someone who wants a standalone proxy to drop into an arbitrary project.
The crate decomposition is genuinely fine-grained (linkerd/addr, linkerd/dns, linkerd/distribute, linkerd/duplex, linkerd/ewma, etc.) so protocol and infra concerns compile and test independently instead of living in one monolith. Fuzzing isn't just a README line — there are real fuzz_targets wired into addr, dns, and inbound crates, backed by a public third-party security audit report from Ada Logics checked into docs/reports. It's also running in production on real clusters as the literal data plane for a CNCF project, so it's been exercised against live traffic patterns, not just unit tests. The devcontainer + justfile pairing means you can get a correct multi-crate Rust build environment without hand-assembling toolchain versions yourself.
The README only covers how to build this one component — there's no architecture doc explaining the tower-Service/stack pattern that the whole outbound/inbound pipeline is built on, so the nesting in paths like http/logical/policy/route/backend/metrics is opaque unless you already know Linkerd internals. This isn't something you can pull down and point at your own traffic; it only functions as a sidecar wired up by linkerd2's control plane, so the practical audience is contributors to Linkerd itself, not proxy users generally. None of these crates are published or documented for standalone consumption (no docs.rs presence implied, Cargo.lock committed for a workspace binary), so the nice decomposition doesn't buy you reusable libraries outside this repo. First-contribution ramp-up looks steep — the directory depth signals several layers of abstraction to internalize before a change in, say, retry or load-balancing logic lands correctly.