[opensourcedex]

tengine is a free, open source networking & connectivity project written in C and released under BSD-2-Clause. It has 13,371 GitHub stars, 2,502 forks and 502 open issues, and was last pushed 15 days ago. On this registry it ranks #15 of 26 tracked projects in Networking & Connectivity, with 5 head-to-head comparisons available.

What is tengine?

Tengine is a high-performance, BSD-2-Clause-licensed web server and reverse proxy that is 100% compatible with nginx, built for operators and platform teams that need HTTP/3, Kubernetes Ingress support, dynamic configuration and Chinese cryptographic standards without abandoning their existing nginx configuration.

What it is

Tengine is an open-source web server and reverse proxy written in C, originated by Taobao, which the README describes as the largest e-commerce website in Asia. It has been an open source project since December 2011 and is actively developed by the Tengine team, whose core members come from Taobao, Sogou and other internet companies. It inherits all features of nginx-1.31.5, and that inheritance is the basis of its 100% compatibility claim.

The concrete problem it addresses is extending nginx without disrupting it. Tengine is a configuration-compatible drop-in for nginx that adds capabilities the distribution it derives from does not carry, including HTTP/3 through the xquic library, Kubernetes Ingress driven dynamic configuration through tengine-ingress, active upstream health checks, and NTLS/TLCP dual-certificate TLS with the Chinese SM2, SM3 and SM4 algorithms via Tongsuo. The project reports that it has proven stable and efficient on some of the top 100 websites in the world, including taobao.com and tmall.com.

Key capabilities

  • Inherits all features of nginx-1.31.5, so existing nginx configuration continues to work.
  • HTTP/3 support over QUIC v1 and draft-29 through xquic, including connection management and multiplexing for lower latency and greater resilience to packet loss on unstable networks.
  • Kubernetes Ingress support via tengine-ingress, which dynamically configures servers, locations and upstreams without reloading or restarting worker processes.
  • Dynamic HTTP routing via tengine-ingress by header, cookie or query-parameter values, by upstream weight, and by modulo operation, plus custom request and response headers and failover to a backup upstream or a redirect by response status code.
  • NTLS/TLCP dual-certificate TLS (GM/T 0024) with SM2/SM3/SM4 via Tongsuo, including per-server-name TLS protocol selection and dynamic SSL redirect, CORS and robots settings.
  • Load balancing methods including consistent hashing, session persistence, and weighted round-robin with O(1) time and O(n) memory.
  • CONNECT HTTP method support for forward proxy, server_name in the Stream module, kernel-bypass UDP transmission, asynchronous OpenSSL with hardware such as QAT, and Zstandard response compression with pre-compressed static file serving.

Who uses it and how

  • High-traffic internet properties, with the project reporting stable and efficient operation on top-100 websites including taobao.com and tmall.com.
  • Kubernetes platform teams that use tengine-ingress to change servers, locations and upstreams dynamically, avoiding worker reloads or restarts during configuration changes.
  • Services on unstable or lossy networks that adopt HTTP/3 over QUIC for lower latency and better packet-loss resilience.
  • Deployments subject to Chinese cryptographic requirements, using NTLS/TLCP dual-certificate TLS with SM2/SM3/SM4 provided through Tongsuo.
  • Forward-proxy and TCP-proxy deployments, using the CONNECT method and the Stream module's server_name support.

Getting started

The README points to tengine.taobao.org for the full documentation, examples and guides, and Kubernetes users additionally deploy the separate tengine-ingress Ingress controller for Tengine.

How it compares

Tengine occupies the same position as nginx, which the facts name directly: it inherits all of nginx-1.31.5's features and remains 100% compatible with it, so it functions as an extended, compatible alternative rather than a different architecture. Its differentiators come from named companion components, namely xquic for HTTP/3, Tongsuo for NTLS/TLCP and the SM2, SM3 and SM4 algorithms, and tengine-ingress for Kubernetes-driven dynamic configuration. It is released under the BSD-2-Clause licence.

When to use it — and when not to

A self-hoster takes on operating the server itself, and gains the HTTP/3, NTLS/TLCP and dynamic-configuration capabilities only by building and maintaining the accompanying components: xquic, Tongsuo and, for Kubernetes, the separate tengine-ingress controller. Teams content with upstream nginx and with no requirement for HTTP/3, Kubernetes-driven dynamic configuration, forward proxy or Chinese cryptographic standards should note that compatibility is the project's core promise, so Tengine adds comparatively little in that case. The README excerpt available here is essentially a feature list that defers installation detail to the project website, and the repository carries 502 open issues, so prospective users should expect to work from the external documentation.

project readme (upstream, from github) — read inline


Tengine

Visit tengine.taobao.org for the full documentation, examples and guides.

GitHub license GitHub stars GitHub stars Build Status

Introduction

Tengine is a high-performance web server and reverse proxy originated by Taobao, the largest e-commerce website in Asia. It offers HTTP/3, Kubernetes Ingress support, zero-downtime dynamic configuration, active upstream health checks, and NTLS/TLCP (SM2/SM3/SM4), while remaining 100% compatible with nginx. Tengine has proven to be very stable and efficient on some of the top 100 websites in the world, including taobao.com and tmall.com.

Tengine has been an open source project since December 2011. It is being actively developed by the Tengine team, whose core members are from Taobao, Sogou and other Internet companies. Tengine is a community effort and everyone is encouraged to get involved.

Features

  • All features of nginx-1.31.5 are inherited, i.e., it is 100% compatible with nginx.
  • Dynamically configure the servers, locations and upstreams without reloading or restarting worker processes with tengine-ingress, the Kubernetes Ingress controller for Tengine.
  • HTTP/3 support (QUIC v1 and draft-29) with xquic, including connection management and multiplexing for lower latency and higher resilience to packet loss on unstable networks.
  • High-speed UDP transmission with kernel-bypass.
  • Dynamically configure different TLS protocols for different server names with tengine-ingress.
  • Dynamically configure timeout setting, SSL Redirects, CORS and enabling/disabling robots for the server and location with tengine-ingress.
  • Dynamically configure HTTP routing based on multiple values of a specific header, cookie or query parameter with tengine-ingress.
  • Dynamically configure HTTP routing based on multiple upstream according to weight with tengine-ingress.
  • Dynamically configure HTTP routing based on modulo operation for a specific header, cookie or query parameter with tengine-ingress.
  • Dynamically configure HTTP routing to add/append custom header or add query parameter in the HTTP request to the upstream with tengine-ingress.
  • Dynamically configure HTTP routing to add custom header in the HTTP response to the client with tengine-ingress.
  • Dynamically configure failover to a backup upstream or a redirect by response status code with tengine-ingress.
  • Support the CONNECT HTTP method for forward proxy.
  • Support asynchronous OpenSSL, using hardware such as QAT for HTTPS acceleration.
  • NTLS/TLCP (dual-certificate TLS, GM/T 0024) support with the Chinese SM2/SM3/SM4 algorithms via Tongsuo.
  • Zstandard (zstd) response compression, and serving pre-compressed static files.
  • Enhanced operations monitoring, such as asynchronous log & rollback, DNS caching, memory usage, etc.
  • Fine-grained timing statistics variables for the request and for each stage of the upstream interaction.
  • Support server_name in Stream module.
  • More load balancing methods, e.g., consistent hashing, session persistence, and a weighted round-robin with O(1) time and O(n) memory.
  • Input body filter support. It's quite handy to write Web Application Firewalls using this mechanism.
  • Dynamic scripting language (Lua) support, which is very efficient and makes it easy to extend core functionalities.
  • Limits retries for upstream servers (proxy, memcached, fastcgi, scgi, uwsgi).
  • Includes a mechanism to support standalone processes.
  • Protects the server in case system load or memory use goes too high.
  • Multiple CSS or JavaScript requests can be combined into one request to reduce download time.
  • Removes unnecessary white spaces and comments to reduce the size of a page.
  • Active health checks of upstream servers can be performed.
  • The number of worker processes and CPU affinities can be set automatically.
  • The limit_req module is enhanced with whitelist support and more conditions are allowed in a single location.
  • Enhanced diagnostic information makes it easier to troubleshoot errors.
  • More user-friendly command lines, e.g., showing all compiled-in modules and supported directives.
  • Expiration times can be specified for certain MIME types.
  • Receives HTTP traffic on the TLS listener with option.
  • Debugging HTTP connection usage.
  • Appends content to the response body.
  • ...

Installation

Container image

Multi-arch (amd64 + arm64) images with the full feature set -- Tongsuo (NTLS), xquic (QUIC/HTTP-3) and Lua -- are published on every release:

docker pull ghcr.io/alibaba/tengine:latest         # Debian based
docker pull ghcr.io/alibaba/tengine:latest-alpine  # Alpine based, smaller

docker run --rm -p 8080:80 ghcr.io/alibaba/tengine:latest

The server runs as /usr/sbin/tengine with /etc/tengine/tengine.conf; drop your own server blocks into /etc/tengine/conf.d/.

Distribution packages

Every release ships .rpm, .deb and .apk packages for the mainstream distributions (RHEL/Rocky/Alma/Anolis/openEuler/SLES, Debian/Ubuntu, Alpine) on both x86_64 and aarch64, attached to the release page:

dnf install https://github.com/alibaba/tengine/releases/download/3.2.0/tengine-3.2.0-<ts>.el9.x86_64.rpm

These packages install alongside a distribution nginx without conflicting. See packages/build/README.md for the exact feature set, how to build them yourself, and how the container images are produced.

From source

Tengine can be downloaded at https://tengine.taobao.org/download/tengine.tar.gz. You can also checkout the latest source code from GitHub at https://github.com/alibaba/tengine

To install Tengine, just follow these three steps:

./configure
make
sudo make install

By default, it will be installed to /usr/local/tengine. Everything is named after Tengine, which matches the layout used by the .rpm/.deb/.apk packages and the container images:

Default path
binary /usr/local/tengine/sbin/tengine
configuration /usr/local/tengine/conf/tengine.conf
pid file /usr/local/tengine/logs/tengine.pid
error log /usr/local/tengine/logs/error.log
access log /usr/local/tengine/logs/access.log
dynamic modules /usr/local/tengine/modules

You can use the '--prefix' option to specify the root directory, or --sbin-path, --conf-path, --pid-path, --error-log-path and --http-log-path to place the individual files. If you want to know all the 'configure' options, you should run './configure --help' for help.

Upgrading from 3.1.0 or earlier. Those releases installed to /usr/local/nginx as sbin/nginx driven by conf/nginx.conf. Because 3.2.0 writes to different paths, make install does not replace that install -- the old binary stays on disk and keeps serving traffic, and running it still reports the old version, which easily reads as "the upgrade did not take effect". After switching over, stop and remove the old install, and update any systemd unit, init script or log rotation config still pointing at the old paths. configure prints a warning when it finds an install at /usr/local/nginx/sbin/nginx.

To keep the previous layout instead, pass the old paths explicitly:

./configure --prefix=/usr/local/nginx \
    --sbin-path=/usr/local/nginx/sbin/nginx \
    --conf-path=/usr/local/nginx/conf/nginx.conf \
    --pid-path=/usr/local/nginx/logs/nginx.pid

A plain ./configure builds without Tongsuo, xquic and Lua -- those need their own libraries. To reproduce the full feature set of the released packages and images, use the packaging helpers:

packages/build/fetch-deps.sh                       # download pinned sources
packages/build/build-deps.sh --libdir /usr/lib/tengine
. dist/deps-build/deps-env.sh
./configure $(sh packages/build/configure-args.sh) \
    --with-cc-opt="-Wno-error" \
    --with-ld-opt="$(sh packages/build/configure-args.sh --print-ld-opt)" \
    --with-openssl-opt="$(sh packages/build/configure-args.sh --print-openssl-opt)"
make

Documentation

The homepage of Tengine is at https://tengine.taobao.org/ You can access https://tengine.taobao.org/documentation.html for more information.

Contact

https://github.com/alibaba/tengine/issues

Dingtalk user group: 23394285

License

BSD-2-Clause License

Frequently asked questions

Is tengine free to use?

tengine is open source under the BSD-2-Clause licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does tengine do?

A high-performance web server and reverse proxy, 100% compatible with nginx.

What is tengine written in?

tengine is primarily written in C. Its source is publicly available at https://github.com/alibaba/tengine, and it has 13,371 GitHub stars.