Calico Open Source

Networking and security for containers and Kubernetes


Calico Open Source is a networking and security solution for containers, virtual machines, and native host-based workloads. It supports a broad range of platforms including Kubernetes, OpenShift, Docker EE, OpenStack, and bare metal services.

Whether you opt to use Calico’s eBPF data plane, Linux’s standard networking pipeline, or the Windows data plane, Calico delivers blazing-fast performance with true cloud-native scalability. Calico provides developers and cluster operators with a consistent experience and set of capabilities whether running in public cloud or on-premises, or on a single node or across a multi-thousand node cluster.


Pluggable data planes includes eBPF, Windows, VPP, and Linux

Any container, any Kubernetes distro, any cloud

Unparalleled scalability & efficient resource utilization

Real-world production hardened



Choice of data planes

Calico Open Source offers a choice of data planes, including a pure Linux eBPF data plane, a standard Linux networking data plane, and a Windows HNS data plane. Calico combines cutting-edge features with standard primitives system administrators are already familiar with, to provide networking and security for containers and Kubernetes.

Full Kubernetes network policy support

Calico Open Source’s network policy engine is the original reference implementation of Kubernetes network policy. It implements the full set of features defined by the Kubernetes networking API, giving users all of the capabilities and flexibility envisaged when the API was originally defined.

Kubernetes-native Security Policy Model

Calico Open Source translates networking and security best practices into a rich networking and security policy model for Kubernetes-native environments. Calico makes it easy for DevOps, SRE, platform architect, security, and compliance teams to allow or deny access to traffic. The solution comes with built-in support for WireGuard encryption, with higher performance and lower CPU consumption.

Calico’s policy engine enforces the same policy model at the host networking layer and at the application layer. Thus, it protects infrastructure from compromised workloads, and vice-versa.

Best-in-class Performance

Calico Open Source uses the Linux kernel’s built-in, highly optimized forwarding and access control capabilities to deliver native Linux networking data plane performance, typically without requiring any of the encap/decap overheads. Calico’s control plane and policy engine are optimized to minimize overall CPU usage and occupancy, leading to higher performance and lower monthly bills.

Workload interoperability

Calico Open Source enables Kubernetes workloads and non-Kubernetes or legacy workloads to communicate seamlessly and securely. Calico can easily extend to secure existing host-based workloads (whether in the public cloud, or on-premises on VMs or bare metal servers) alongside Kubernetes. All workloads are subject to the same network and security policy model for consistent enforcement of traffic flow externally and internally.

Scalable Networking

Calico’s core design principles leverage best practice cloud-native design patterns combined with proven standards based network protocols trusted worldwide by the largest internet carriers. The result is a solution with exceptional scalability that has been running at scale in production for years. Calico’s development test cycle includes regularly testing multi-thousand node clusters. Whether you are running a 10 node cluster, 100 node cluster, or more, you reap the benefits of the improved performance and scalability characteristics demanded by the largest Kubernetes clusters.


Calico uses WireGuard to encrypt on-the-wire, in-cluster pod traffic in a Kubernetes cluster for additional security. Calico automatically creates and manages WireGuard tunnels between nodes providing transport-level security for on-the-wire, in-cluster pod traffic. WireGuard provides formally verified secure and performant tunnels without any specialized hardware.

Key Features

How It Works

Quickstart Guide

Learn about Kubernetes-native networking and security with Calico on a single-host Kubernetes cluster within 15 mins.

Learn more

If you like Calico, you will love Calico Cloud



Learn more



Latest Content

Tigera has achieved AWS Security Competency status!

Tigera has achieved AWS Security Competency status!

By Laura Ferguson on Nov 29, 2023

We’re happy to announce that Tigera recently achieved Amazon Web Services (AWS) Security Competency status. This designation recognizes the security capabilities of Tigera’s Calico Cloud platform in helping customers secure...

Read more >
Securing Multi-Cloud Deployments: Box’s Zero-Trust Kubernetes Strategy with Calico

Securing Multi-Cloud Deployments: Box’s Zero-Trust Kubernetes Strategy with Calico

By Eunice Cao on Nov 29, 2023

Box, a cloud-first SaaS provider serving over 68% of Fortune 500 companies, manages a complex, shared Kubernetes infrastructure across hybrid, multi-cloud, and public cloud setups. Box relies on Calico to...

Watch here >
Microsoft AKS Security Bootcamp: Visualize cluster traffic and identify security gaps

Microsoft AKS Security Bootcamp: Visualize cluster traffic and identify security gaps

By Eunice Cao on Sep 24, 2023

Attend this in-depth, hands-on security workshop with Calico and Microsoft Azure experts to get insights into Kubernetes cluster traffic, workload interactions, and security policy enforcement. The 90-minute interactive lab comes...

Register here >