Linkerd2-proxy: Orientation

Linkerd2-proxy accepts long-lived TCP connections, detects protocols, enforces policy, discovers destinations, balances endpoints, proxies HTTP or opaque bytes, records metrics, and drains gracefully. Its architectural center is a pair of statically composed Tower service factories: inbound and outbound.

accept connection → detect TLS/protocol → authorize → per-target service
                                            ↓ HTTP request
route → discover/watch endpoints → queue/readiness → balance → connect/mTLS → proxy

Design thesis

Linkerd builds a concrete Tower stack for each target and uses readiness as the contract that transfers traffic only when downstream capacity exists, even while discovery and policy change concurrently.

• Generic stack construction specializes the hot data path.
• Bounded queues absorb bursts without hiding indefinite overload.
• Watches update long-lived services without rebuilding every request path.
• Drain stops admission before awaiting protocol-level completion.

We preserve target-typed stack construction, readiness/backpressure, dynamic discovery, cached per-target services, bounded queues, balancing, retries with replay limits and budgets, failure classification, and drain propagation.