API Gateways
API Gateways are the critical entry point to your services. They manage authentication, routing, rate-limiting, observability, and security at the edge of your infrastructure. In modern architectures—especially microservices and serverless platforms—the API Gateway is the first line of defence and performance optimisation.
With Unikraft Cloud, API Gateways gain advantage from a microVM-based, scale-to-zero infrastructure that delivers the performance of specialised systems with the flexibility of serverless deployment.
Why run an API gateway on Unikraft Cloud
⚡ Ultra-low latency
MicroVMs remove the overhead of general-purpose operating systems by compiling only the required OS components alongside the API Gateway app. This results in:
- Single-digit-millisecond cold-start times (perfect for bursty API traffic).
- Minimal memory footprint, allowing more requests per node.
- Consistent, predictable response latency at scale.
🛡️ Secure by design
The open internet exposes API Gateways, making them often the most attacked component. Unikraft Cloud isolates each instance at the virtual machine level while keeping footprint minimal:
- Immutable, single-purpose microVM images reduce attack surface.
- Strong VM-level isolation without container overhead.
- Built-in memory safety and image signing to ensure trust at deployment.
💸 Scale-to-zero economics
Traffic to APIs often fluctuates—peaking during business hours, quiet overnight, and spiking during product launches. Traditional gateway clusters waste resources when idle. With Unikraft Cloud:
- API Gateways scale-to-zero when not in use, reducing idle costs to zero.
- Instant cold-starts ensure gateways are ready in milliseconds when traffic resumes.
- Fine-grained billing: pay only for requests and runtime, not for idle VMs.
🔄 Serverless-ready
API Gateways are a natural control point for serverless workloads. Running them on Unikraft Cloud enables:
- On-demand routing to serverless functions.
- Dynamic policy enforcement per request without worrying about idle nodes.
- Lightweight integration with edge compute for global distribution.
Getting started
API Gateways on Unikraft Cloud combine VM-grade security with serverless agility. Ultra-fast, cost-efficient, and scale-to-zero—so your API edge is always ready, never idle.
This guide shows you how to use Tyk, a universal API management tool for Representational State Transfer (REST), GraphQL, gRPC and async APIs. It offers open standards, scalability, governance, and AI-ready features for API development, security, and performance. Often, you deploy Tyk alongside a caching layer like Redis to store API tokens and OAuth clients.
To run it, follow these steps:
-
Install the CLI. Use the unikraft CLI or the legacy kraft CLI. You need a BuildKit builder. The easiest way to get one is via Docker. You can also set up and use BuildKit directly; see the quick start.
The unikraft CLI is the current standard, while kraft is the legacy version. Choose one of the CLIs below and only run the commands associated with it for the rest of this guide.
-
Clone the
examplesrepository andcdinto theexamples/tyk/directory:
Make sure to log into Unikraft Cloud and pick a metro close to you.
This guide uses fra (Frankfurt, 🇩🇪):
Redis
The REDIS_PASSWORD environment variable sets the Redis requirepass directive.
If not provided, it defaults to unikraft.
Build and deploy the Redis instance (used internally by Tyk):
The output shows the Redis instance details:
Tyk
Build and deploy the Tyk instance:
The output shows the Tyk instance details:
In this case, the instance names are redis-6vgvc and tyk-s9ixd, and the Tyk address is https://icy-haze-8ph4u8cz.fra.unikraft.app.
They're different for each run.
Use curl to query the Tyk instance on Unikraft Cloud:
Code
You can list information about the instances by running:
When done, you can remove the instances:
Learn more
Use the --help option for detailed information on using Unikraft Cloud:
Or visit the CLI Reference or the legacy CLI reference. For more references, check out also: