boe run
The run command starts an Envoy proxy with the specified extensions enabled. It automatically downloads the required Envoy binary if not already present, generates the necessary configuration, and launches Envoy with the extensions configured in the HTTP filter chain.
You can enable multiple extensions using the --extension flag, and also load extensions from
local directories using --local for development and testing purposes. The command manages
all runtime files, logs, and the Envoy admin interface automatically.
Examples
Run the example-go extension from the default registry with debug logs enabled for Lua:
boe run --extension example-go --log-level dynamic_modules:debug
Run a specific version of the example-go extension from a custom OCI registry. This is useful if you are hosting the
extensions in a corporate OCI registry.
export BOE_REGISTRY=acme.org/extensions
export BOE_REGISTRY_USERNAME=username
export BOE_REGISTRY_PASSWORD=password
boe run --extension example-go:0.3.2 --log-level dynamic_modules:debug
Run a local extension from a local directory. The directory must contain the extension manifest.yaml
and all the files needed to execute the extension locally.
boe run --local ~/src/built-on-envoy/extensions/composer/example
Run with a custom Envoy binary. BOE uses this binary directly; it must match the local OS/arch.
boe run --envoy-path ~/src/envoy/bazel-bin/source/exe/envoy-static --local ~/src/built-on-envoy/extensions/composer/example
For boe run --docker, the container defaults to run ID 0 (set via ENV BOE_RUN_ID=0 in the
Dockerfile). Override with --run-id or the BOE_RUN_ID environment variable.
Run extensions with custom JSON configuration strings. Configs are applied in order to the
combined list of --extension and --local flags. Use an empty string '' to skip an extension:
boe run --extension ext1 --extension ext2 --config '{"key":"value"}' --config ''
If the extension needs to reach external services, you can provide additional Envoy clusters using the --cluster, --cluster-insecure, and --cluster-json flags. For example:
# Configure cluster for a given URL
boe run --extension ext1 --cluster example.com:443
# Configure cluster for a given URL that is not TLS
boe run --extension ext1 --cluster-insecure example.com:80
# Configure a full cluster
boe run --extension ext1 --cluster-json '{"name":"my-cluster","type":"STRICT_DNS","load_assignment":{"cluster_name":"my-cluster","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":"address":"example.com","port_value":8081}}}}]}]}}'
Run the extensions against a custom upstream host instead of the default httpbin.org:
boe run --extension chat-completions-decoder --test-upstream-host api.openai.com
Usage details
boe run [flags]
boe run --help
Flags
| Name | Description | Type | Default | Env Var | Required |
|---|---|---|---|---|---|
--envoy-version | Envoy version to use (e.g., 1.31.0, dev, dev-latest) | string | - | ENVOY_VERSION | No |
--envoy-path | Path to a custom Envoy binary. Skips Envoy download and version selection. | string | - | ENVOY_PATH | No |
--log-level | Envoy component log level. | string | all:error | ENVOY_LOG_LEVEL | No |
--run-id | Run identifier for this invocation. Overrides the default timestamp-based ID. | string | - | BOE_RUN_ID | No |
--listen-port | Port for Envoy listener to accept incoming traffic. | uint32 | 10000 | - | No |
--admin-port | Port for Envoy admin interface. | uint32 | 9901 | BOE_ADMIN_PORT | No |
--extension | Extensions to enable (in the format: “name” or “name:version”). | []string | - | - | No |
--local | Path to a directory containing a local Extension to enable. | []string | - | - | No |
--dev | Whether to allow downloading dev versions of extensions (with -dev suffix). By default, only stable versions are allowed. | bool | false | - | No |
--config | Optional JSON config string for extensions. Applied in order to combined —extension and —local flags. | []string | - | - | No |
--filter-type | Set the filter type for an extension. Applied positionally to the combined —extension and —local flags. Accepted values: http, network, listener, udp_listener. | []string | - | - | No |
--native-http-filter-before | Optional YAML/JSON native HTTP filter list (or @filepath) per extension position. Overrides manifest nativeHttpFilters.before. | []string | - | - | No |
--native-http-filter-after | Optional YAML/JSON native HTTP filter list (or @filepath) per extension position. Overrides manifest nativeHttpFilters.after. | []string | - | - | No |
--cluster | Optional additional Envoy cluster provided in the host:tlsPort pattern. | []string | - | - | No |
--cluster-insecure | Optional additional Envoy cluster (with TLS transport disabled) provided in the host:port pattern. | []string | - | - | No |
--cluster-json | Optional additional Envoy cluster providing the complete cluster config in JSON format. | []string | - | - | No |
--test-upstream-host | Hostname for the test upstream cluster. Mutually exclusive with —test-upstream-cluster. Defaults to “httpbin.org”. | string | - | - | No |
--test-upstream-cluster | Name of an existing configured cluster to use as the test upstream. The cluster must be configured via —cluster, —cluster-insecure, or —cluster-json. Mutually exclusive with —test-upstream-host. | string | - | - | No |
--docker | Run Envoy as a Docker container instead of using func-e. | bool | false | BOE_RUN_DOCKER | No |
--pull | Pull policy for the BOE Docker image (missing, always, never). Only applicable when running with —docker. | string | missing | - | No |
--docker-image-version | Override the BOE Docker image tag to use when running with —docker. By default, the image version matches the BOE version. | string | - | - | No |
--registry | OCI registry URL for the extensions. | string | ghcr.io/tetratelabs/built-on-envoy | BOE_REGISTRY | No |
--insecure | Allow connecting to an insecure (HTTP) registry. | bool | false | BOE_REGISTRY_INSECURE | No |
--username | Username for the OCI registry. | string | - | BOE_REGISTRY_USERNAME | No |
--password | Password for the OCI registry. | string | - | BOE_REGISTRY_PASSWORD | No |