The proxy beside every process: when the sidecar's bill came due
What the service-mesh sidecar actually costs per request, per pod and per upgrade, who measured it, and why the industry built it, regretted it, and is removing it.
Reconstructs the cost of putting a proxy beside every workload from the teams that measured it: Istio's own versioned benchmarks, the MeshInsight study, Meta's library-first counterexample, and the incident record from Monzo 2017 to GitHub 2026. A reader leaves able to estimate the tax for their own workload, name the two failure classes the pattern carries, and defend where their data plane should live.
The organisations with the most traffic never paid the tax: Meta routes 99% of RPCs through an in-process library to save hundreds of thousands of machines, and Kubernetes itself took nine years to make the pattern it hosted first-class, finishing at roughly the moment its flagship mesh went sidecar-less.
What you get out of it
- Independent measurement (SoCC '23) puts the sidecar at +27-269% latency and +42-163% CPU, an order of magnitude spread driven by protocol mix, so no published percentage transfers to your workload unmeasured.
- Both published sidecar outages follow two classes: the proxy as a new single point on every path (Monzo 2017, Alpaca 2026) and the proxy as a component the platform cannot see (GitHub 2026, the nine-year jobs problem).
- Ambient's savings claims span 80% (vendor press) to roughly zero (the same vendor's measurement) because waypoints cost about what sidecars did; the saving is a function of how much L7 you re-enable.
- The exits are real but priced: per-node L4 (ambient, Cilium) pays in shared-proxy isolation arguments, the library (Meta) pays in fleet-wide upgrade coordination, proxyless gRPC pays in a single-stack feature subset.
- Kubernetes' git history records the sidecar API being approved in 2019, demoted in 2020, and rewritten in 2023 on init containers, with every 2019 design listed as a rejected alternative.
Scope
Why this, now. Istio's sidecar-less ambient mode has been GA since November 2024, Kubernetes made native sidecars stable in v1.33 in 2025, and GitHub's August 2026 outage put sidecar autoscaling back on every postmortem reading list; the placement decision is live again in most platform teams.
What it does not cover. Whether to adopt a mesh at all, mesh control-plane scaling, ingress and API gateways, and eBPF as a general CNI, which appear only where a source used them to decide data-plane placement.
Other field guides
The compute you reserve but never use
Most containers use less than half of what they reserve, and the bill follows the reservation. This guide reconstructs the request/limit contract and…
23 sources · 16 organisations · 3 postmortemsThe discount is a repossession clause
Every large cloud sells the same machines twice: firm capacity at list price and the same capacity at 60-91% off with the right to take it back on 30…
23 sources · 12 organisations · 3 postmortemsThe meter runs on cardinality
Reconstructs the telemetry cost-containment funnel from the incident record at GitLab and Datadog, the pricing sheets of three clouds, Prometheus and…
37 sources · 20 organisations · 8 postmortems