Meshlib: In-Process Policy Enforcement for Sidecar-less Service Meshes

2026-08-13

AI Summary

This work addresses the high latency, resource overhead, and challenges in enforcing Layer-7 security policies inherent in traditional sidecar-based service meshes. The authors propose Meshlib, a sidecar-free service mesh architecture that embeds a lightweight library directly into application processes to enforce Layer-7 security policies in-process, while leveraging Cilium’s eBPF data plane for transport-layer identity authentication and routing. This design preserves full policy semantics while enabling low-latency communication. Meshlib is the first sidecar-less solution to support seamless interoperability with unmodified services and allow incremental deployment. Evaluated on the TrainTicket benchmark (37 services, 126 policies), Meshlib demonstrates significantly lower end-to-end latency than Istio, Linkerd, and native Cilium, with comparable resource overhead.

Abstract

Service meshes facilitate service-to-service communication and enforce security policies in microservice architectures. However, they often depend on per-pod sidecar proxies, which introduce significant latency and resource overhead due to redundant application-layer parsing on every request. Eliminating sidecars without compromising security guarantees remains a central challenge. To address this, we introduce Meshlib, a sidecar-less service mesh extension built on Cilium as a control-plane extension. Meshlib incorporates a non-intrusive application-bound library that enforces Layer-7 policies within the application process, while delegating transport-level identity and routing to Cilium's eBPF-based data plane. This separation of responsibilities removes sidecar-induced latency and maintains the security semantics of the service mesh. The architecture remains fully interoperable with unmodified services, enabling incremental adoption within existing deployments. We evaluate Meshlib against Istio, Linkerd, and unmodified Cilium on the TrainTicket benchmark, enforcing 126 security policies across 37 services and show that it achieves the lowest end-to-end latency of all evaluated configurations with comparable resource overhead.

Problem

• service mesh
• sidecar proxy
• policy enforcement
• microservice security
• latency overhead

Innovation

• sidecar-less
• service mesh
• eBPF
• in-process policy enforcement
• Cilium