Envoy Logo

boe run

The run command starts an Envoy proxy with the specified extensions enabled. It automatically downloads the required Envoy binary if not already present, generates the necessary configuration, and launches Envoy with the extensions configured in the HTTP filter chain.

You can enable multiple extensions using the --extension flag, and also load extensions from local directories using --local for development and testing purposes. The command manages all runtime files, logs, and the Envoy admin interface automatically.

⚠️ boe run will try to download Envoy for your operating system and platform, but Envoy does not provide packages for all platforms. If there are no Envoy binaries for your platform, boe can transparently run Envoy in Docker. Just use boe run --docker or set the BOE_RUN_DOCKER=true environment variable.

Examples

Run the example-go extension from the default registry with debug logs enabled for Lua:

boe run --extension example-go --log-level dynamic_modules:debug

Run a specific version of the example-go extension from a custom OCI registry. This is useful if you are hosting the extensions in a corporate OCI registry.

export BOE_REGISTRY=acme.org/extensions
export BOE_REGISTRY_USERNAME=username
export BOE_REGISTRY_PASSWORD=password

boe run --extension example-go:0.3.2 --log-level dynamic_modules:debug

Run a local extension from a local directory. The directory must contain the extension manifest.yaml and all the files needed to execute the extension locally.

boe run --local ~/src/built-on-envoy/extensions/composer/example

Run extensions with custom JSON configuration strings. Configs are applied in order to the combined list of --extension and --local flags. Use an empty string '' to skip an extension:

boe run --extension ext1 --extension ext2 --config '{"key":"value"}' --config ''

If the extension needs to reach external services, you can provide additional Envoy clusters using the --cluster, --cluster-insecure, and --cluster-json flags. For example:

# Configure cluster for a given URL
boe run --extension ext1 --cluster example.com:443
# Configure cluster for a given URL that is not TLS
boe run --extension ext1 --cluster-insecure example.com:80
# Configure a full cluster
boe run --extension ext1 --cluster-json '{"name":"my-cluster","type":"STRICT_DNS","load_assignment":{"cluster_name":"my-cluster","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":"address":"example.com","port_value":8081}}}}]}]}}'

Run the extensions against a custom upstream host instead of the default httpbin.org:

boe run --extension chat-completions-decoder --test-upstream-host api.openai.com

Usage details

boe run [flags]
boe run --help

Flags

NameDescriptionTypeDefaultEnv VarRequired
--envoy-versionEnvoy version to use (e.g., 1.31.0)string-ENVOY_VERSIONNo
--log-levelEnvoy component log level.stringall:error-No
--run-idRun identifier for this invocation. Defaults to timestamp-based ID or $BOE_RUN_ID. Use ‘0’ for Docker/Kubernetes.string-BOE_RUN_IDNo
--listen-portPort for Envoy listener to accept incoming traffic.uint3210000-No
--admin-portPort for Envoy admin interface.uint329901-No
--extensionExtensions to enable (in the format: “name” or “name:version”).[]string--No
--localPath to a directory containing a local Extension to enable.[]string--No
--devWhether to allow downloading dev versions of extensions (with -dev suffix). By default, only stable versions are allowed.boolfalse-No
--configOptional JSON config string for extensions. Applied in order to combined —extension and —local flags.[]string--No
--clusterOptional additional Envoy cluster provided in the host:tlsPort pattern.[]string--No
--cluster-insecureOptional additional Envoy cluster (with TLS transport disabled) provided in the host:port pattern.[]string--No
--cluster-jsonOptional additional Envoy cluster providing the complete cluster config in JSON format.[]string--No
--test-upstream-hostHostname for the test upstream cluster.stringhttpbin.org-No
--dockerRun Envoy as a Docker container instead of using func-e.boolfalseBOE_RUN_DOCKERNo
--pullPull policy for the BOE Docker image (missing, always, never). Only applicable when running with —docker.stringmissing-No
--registryOCI registry URL for the extensions.stringghcr.io/tetratelabs/built-on-envoyBOE_REGISTRYNo
--insecureAllow connecting to an insecure (HTTP) registry.boolfalseBOE_REGISTRY_INSECURENo
--usernameUsername for the OCI registry.string-BOE_REGISTRY_USERNAMENo
--passwordPassword for the OCI registry.string-BOE_REGISTRY_PASSWORDNo