Envoy Logo

boe run

The run command starts an Envoy proxy with the specified extensions enabled. It automatically downloads the required Envoy binary if not already present, generates the necessary configuration, and launches Envoy with the extensions configured in the HTTP filter chain.

You can enable multiple extensions using the --extension flag, and also load extensions from local directories using --local for development and testing purposes. The command manages all runtime files, logs, and the Envoy admin interface automatically.

Examples

Run the example-go extension from the default registry with debug logs enabled for Lua:

boe run --extension example-go --log-level dynamic_modules:debug

Run a specific version of the example-go extension from a custom OCI registry. This is useful if you are hosting the extensions in a corporate OCI registry.

export BOE_REGISTRY=acme.org/extensions
export BOE_REGISTRY_USERNAME=username
export BOE_REGISTRY_PASSWORD=password

boe run --extension example-go:0.3.2 --log-level dynamic_modules:debug

Run a local extension from a local directory. The directory must contain the extension manifest.yaml and all the files needed to execute the extension locally.

boe run --local ~/src/built-on-envoy/extensions/composer/example

Run with a custom Envoy binary. BOE uses this binary directly; it must match the local OS/arch.

boe run --envoy-path ~/src/envoy/bazel-bin/source/exe/envoy-static --local ~/src/built-on-envoy/extensions/composer/example

For boe run --docker, the container defaults to run ID 0 (set via ENV BOE_RUN_ID=0 in the Dockerfile). Override with --run-id or the BOE_RUN_ID environment variable.

Run extensions with custom JSON configuration strings. Configs are applied in order to the combined list of --extension and --local flags. Use an empty string '' to skip an extension:

boe run --extension ext1 --extension ext2 --config '{"key":"value"}' --config ''

If the extension needs to reach external services, you can provide additional Envoy clusters using the --cluster, --cluster-insecure, and --cluster-json flags. For example:

# Configure cluster for a given URL
boe run --extension ext1 --cluster example.com:443
# Configure cluster for a given URL that is not TLS
boe run --extension ext1 --cluster-insecure example.com:80
# Configure a full cluster
boe run --extension ext1 --cluster-json '{"name":"my-cluster","type":"STRICT_DNS","load_assignment":{"cluster_name":"my-cluster","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":"address":"example.com","port_value":8081}}}}]}]}}'

Run the extensions against a custom upstream host instead of the default httpbin.org:

boe run --extension chat-completions-decoder --test-upstream-host api.openai.com

Usage details

boe run [flags]
boe run --help

Flags

Name Description Type Default Env Var Required
--envoy-version Envoy version to use (e.g., 1.31.0, dev, dev-latest) string - ENVOY_VERSION No
--envoy-path Path to a custom Envoy binary. Skips Envoy download and version selection. string - ENVOY_PATH No
--log-level Envoy component log level. string all:error ENVOY_LOG_LEVEL No
--run-id Run identifier for this invocation. Overrides the default timestamp-based ID. string - BOE_RUN_ID No
--listen-port Port for Envoy listener to accept incoming traffic. uint32 10000 - No
--admin-port Port for Envoy admin interface. uint32 9901 BOE_ADMIN_PORT No
--extension Extensions to enable (in the format: “name” or “name:version”). []string - - No
--local Path to a directory containing a local Extension to enable. []string - - No
--dev Whether to allow downloading dev versions of extensions (with -dev suffix). By default, only stable versions are allowed. bool false - No
--config Optional JSON config string for extensions. Applied in order to combined –extension and –local flags. []string - - No
--filter-type Set the filter type for an extension. Applied positionally to the combined –extension and –local flags. Accepted values: http, network, listener, udp_listener. []string - - No
--native-http-filter-before Optional YAML/JSON native HTTP filter list (or @filepath) per extension position. Overrides manifest nativeHttpFilters.before. []string - - No
--native-http-filter-after Optional YAML/JSON native HTTP filter list (or @filepath) per extension position. Overrides manifest nativeHttpFilters.after. []string - - No
--cluster Optional additional Envoy cluster provided in the host:tlsPort pattern. []string - - No
--cluster-insecure Optional additional Envoy cluster (with TLS transport disabled) provided in the host:port pattern. []string - - No
--cluster-json Optional additional Envoy cluster providing the complete cluster config in JSON format. []string - - No
--test-upstream-host Hostname for the test upstream cluster. Mutually exclusive with –test-upstream-cluster. Defaults to “httpbin.org”. string - - No
--test-upstream-cluster Name of an existing configured cluster to use as the test upstream. The cluster must be configured via –cluster, –cluster-insecure, or –cluster-json. Mutually exclusive with –test-upstream-host. string - - No
--docker Run Envoy as a Docker container instead of using func-e. bool false BOE_RUN_DOCKER No
--pull Pull policy for the BOE Docker image (missing, always, never). Only applicable when running with –docker. string missing - No
--docker-image-version Override the BOE Docker image tag to use when running with –docker. By default, the image version matches the BOE version. string - - No
--registry OCI registry URL for the extensions. string ghcr.io/tetratelabs/built-on-envoy BOE_REGISTRY No
--insecure Allow connecting to an insecure (HTTP) registry. bool false BOE_REGISTRY_INSECURE No
--username Username for the OCI registry. string - BOE_REGISTRY_USERNAME No
--password Password for the OCI registry. string - BOE_REGISTRY_PASSWORD No