Is this repo safe to go production environment?

[luciapeixoto54]

I know that contributors to this repository are not obliged to support the problems presented by a library that is free and they work in their spare time but I am very concerned about adopting a library that is not supported or is not ready for go to production.
There are issues open since 2018 and this is very worrying in my point of view.
I would like to get opinions from those who already use this library in production.

[stann1]

I would definitely say: No, it is not suitable for prod

[raman-m]

What is your criteria? Why did you think so?

[luciapeixoto54]

That's really bad!!
Are you using this library only in development or staging environments?

[wast]

Using in prod in intranet with 100 users daily and 20 RPM. No problems with such usage.

[abdulmoizlogiciel]

Any security concerns?

[raman-m]

Feel free to run any security scanners against Ocelot repo.
And let us know your feedback please!

[raman-m]

@luciapeixoto54 on Aug 31, 2020
a library that is not supported

Hi Lucia!
The latest release: v20.0
NuGet package: Ocelot v20.0.0

---

a library is not ready for go to production.

Again, what's your criteria? Why did you think so?

---

There are issues open since 2018 and this is very worrying in my point of view.

There reason why those issues were not (reviewed, developed, answered) is... that Ocelot team was tiny. Only Tom and a few contributors did make PRs and development. It is impossible to read and reply to every community members by one person, and develop the product in situation when contributors didn't help much in development.

Any product & repo in development has a lot of open issues because the community expresses their interest in using the product.
I don't want to share any links to other gateway repos, but I will make an exception especially for you. Open these links to ensure that a gateway product in development has long list of open issues:

• Link 1 has 41 open issues on Nov 4, 2023
• Link 2 has 147 open issues on Nov 4, 2023
• Link 3 has 638 open issues on Nov 4, 2023
• Link 4 has 1 471 open issues on Nov 4, 2023
• Ocelot has 475 open issues on Nov 4, 2023. A half of them are just questions like your, not real issues ready for development.

We are inviting you as a contributor to help us to close these issues. We value every PR from our community!

---

I would like to get opinions from those who already use this library in production.

@RaynaldM @ggnaegi
I know the fact that your teams use Ocelot in production. Please, share honest feedback about Ocelot!
What do you like/dislike in Ocelot? And why do you use it in production?
Thanks!

[RaynaldM]

We've been using Ocelot in production for just over a year without any major problems.
I migrated it to .NET 7 at the end of last year on a fork because we needed it (to maintain homogeneity with our other apps) and since then, several new versions have been released.
We have an energetic, motivated and committed product manager: @raman-m 😃

So we expect to be using it for a long time to come (especially as we're starting to get to know it well in dev and operations).
Our gateway handles an intense flow of requests and doesn't require a lot of resources, so what more could you want?

What's missing the most:
I have a real problem with logs. Let me explain: sometimes there are too many of them, and often they lack precision (for example here and here: which Downstream is concern). I think it's the user app's responsibility to log (and perhaps process) warning and error logs. We're in the process of remaking an IOcelotLogger to better process logs.
We'd also like to add OpenTelemetry to better track it in production.

[ggnaegi]

Hi @luciapeixoto54 !
We use Ocelot in production. We had to fork the repository in 2021 to fix a bug in consul's polling mechanism. Since then it works fine. We are now testing the official version 20.0 (version that includes the consul polling fix), and we will probably roll it out this year. Since @raman-m took over support, several features have been merged, code quality has been improved, so it's safe for the production environment, for http requests at least.