Every proxy driven through the identical linear ramp (zrk, open-loop,
coordinated-omission corrected) at 1000 connections. Throughput and CPU span the full ramp.
The table's p50 / p99 are each proxy's latency at a common 2k req/s reference load — a
shared, light, sub-knee rate where the number reflects per-request cost rather than queueing. The load is offered over TLS 1.3, terminated by the proxy; every proxy's
upstream leg stays plaintext, as zoxy terminates inbound only. All five load the same
self-signed ECDSA P-256 certificate — the key type is part of the measurement, since
the signature is per handshake. The generator offers no ALPN (so this is HTTP/1.1,
like every other profile) and never resumes a session, so each connection pays a full
handshake at connect time and the steady state read below is record-layer crypto on
kept-alive connections, not handshake throughput. The cipher suite is each proxy's own
choice from what the generator offers — AES-GCM and ChaCha20-Poly1305 do not cost the
same per byte, and only some of these proxies expose a knob for it, so it is recorded as
part of "the proxy as it ships" rather than pinned.
zoxy compiled for this host's CPU with SIMD (upstream release v0.9.0 x86_64-linux ReleaseSafe cpu=x86_64_v3 (SIMD, sha256-verified, mode read from the artifact)); stock images in this comparison are generic x86-64 builds
zoxy built ReleaseSafe: Zig's bounds/overflow/unreachable checks stay on in the hot path, which measured -12.7% sustained against the same code at ReleaseFast (c1k, 2x2 over v0.1.0/v0.2.1); the other proxies here are built without equivalent checks
zoxy dropped 774172 access-log lines (7.73% of completed requests) instead of blocking on stdout; the other proxies block or buffer, so this much logging work was skipped here and not by them
nginx latency histogram saturated at 60s; tail percentiles are a floor, not a value
haproxy latency histogram saturated at 60s; tail percentiles are a floor, not a value
pingora compiled for this host's CPU with SIMD (release target-cpu=native); stock images in this comparison are generic x86-64 builds
pingora latency histogram saturated at 60s; tail percentiles are a floor, not a value
envoy latency histogram saturated at 60s; tail percentiles are a floor, not a value
Successful req/s vs offered
open-loop ramp; dashed gray = perfect keep-up
Proxy CPU vs offered
container cores sampled from cAdvisor at 1Hz, on the ramp's own clock
p99 latency vs offered (while keeping up)
per-window tail (log scale); each line stops where that proxy stops keeping up
Load shed vs offered
offered load the proxy couldn't serve (1 − achieved/offered); the first few seconds include the generator's own ramp-up shortfall, which is not the proxy's