Caddy, Nginx, Traefik and Envoy get lumped together — but they're not really competing for the same slot. Where you put the proxy decides everything. A working tour, with the trade-offs nobody puts on the landing page.
The single most useful idea before you compare specs: these four sit at different layers of abstraction. Treat them as interchangeable and you'll either over-build or fight the tool.
So the real question is almost never "which is best" in the abstract — it's where does this proxy live. A single host? A Docker Compose box? A Kubernetes cluster? Behind Cloudflare? Each answer reshuffles the ranking completely.
Rough, opinionated scores — higher is better, including for resource cost (a full bar = lighter). Use them to feel the silhouette, not as benchmarks.
| Axis | Nginx | Caddy | Traefik | Envoy |
|---|---|---|---|---|
| Config model | Static file + reload | Caddyfile / JSON | Labels · CRDs · file | xDS via control plane |
| Auto HTTPS (ACME) | No — bolt on certbot | Yes · headline | Yes · built in | Via control plane |
| Container discovery | No | No | Yes · headline | Via control plane |
| Kubernetes | ingress-nginx EOL | Weak | Good (Gateway API) | Strong (mesh) |
| Operational weight | Low | Lowest | Low–medium | High |
| Sweet spot | Raw speed, ubiquity | "HTTPS just works" | Dynamic containers | gRPC · mesh · control |
Scores and grades are deliberately coarse. Real throughput depends on workload, kernel tuning and TLS settings far more than on the logo.
Terminate HTTPS for example.com and proxy to an app on :4000 (Phoenix-style, so WebSockets must pass through). Watch the line count — it's the whole philosophy in miniature.
If your comparison is really an AKS/ingress decision, there's a current-state fact that flips the default. Worth knowing before you pick.
Kubernetes SIG Network moved kubernetes/ingress-nginx to best-effort maintenance that ended in March 2026 — after which there are no releases, bug fixes, or CVE patches. Existing installs keep running, but new ones are explicitly discouraged. Its planned successor, InGate, never matured and was dropped too.
Two clarifications that save a lot of confusion: this is only the Kubernetes controller — the Nginx web server that runs half the internet is completely unaffected. And F5's separate commercial nginxinc/kubernetes-ingress is a different project that lives on.
The official direction is the Gateway API — the successor to Ingress, GA since late 2023. So on Kubernetes the choice quietly changes from "which proxy" to "which Gateway API implementation". The same four names reappear wearing different hats:
Azure-first? Application Gateway for Containers is Azure's managed Gateway API implementation — worth weighing if you'd rather not run the data plane yourself.
Answer honestly about where this lives. The recommendation updates live.
A solo-owned infra heading from Docker Compose toward AKS, with Cloudflare already out front, narrows things considerably.
Traefik fits how you already run Compose — label a service and it auto-registers, no reload, certs handled. The honest cost is a real learning curve in its provider/middleware model.
Caddy wins if you'd rather have a dead-simple, readable config and don't need much dynamism. Note: behind Cloudflare you may not want origin ACME at all — which removes Caddy's biggest selling point.
Plain Nginx is still right if you mostly want a stable proxy you write by hand and everyone can debug.
Traefik's Gateway API buys conceptual continuity: one mental model from Compose to cluster. For a one-person team optimising for minimal surface, that's worth a lot.
Envoy via Envoy Gateway is the most future-aligned CNCF path and the best gRPC/observability story — keep it on the radar for when the agent/service topology grows. Don't hand-write raw Envoy.
Since you're Azure-first, Application Gateway for Containers trades some control for not running the data plane yourself.
Don't reach for Envoy directly unless you have a concrete need — for your scale it's operational weight carried for features you may never use. Use Traefik as the through-line if you value Compose-to-AKS continuity, and keep Envoy Gateway as the thing you graduate into when the topology actually justifies it. And whatever you do on AKS, don't deploy ingress-nginx fresh.