{"post":{"slug":"load-balancers-explained-2026","title":"Load balancers explained in 2026","excerpt":"Load balancers distribute traffic, absorb failures, and enable zero-downtime deployments. This 2026 guide covers algorithms, layers, and real configurations.","category":"code","date":"April 7, 2026","author":"ByteLedger Team","content":"<span class=\"dropcap\">L</span>oad balancers are the traffic cops of distributed systems. Without one, adding more servers to handle load requires changing DNS, and a single backend crash takes down your entire service. With one, you distribute requests across a fleet of servers, route around failures in milliseconds, and deploy new versions without downtime.\n\n## What changed in 2026\n\n- **Envoy is the default for service-mesh proxies.** Istio, Linkerd 2.x, and Consul Connect all use Envoy under the hood for sidecar load balancing with built-in observability.\n- **Cloud ALBs got smarter.** AWS ALB and GCP Cloud Load Balancing now support gRPC, WebSockets, and HTTP/3 (QUIC) natively — no special configuration needed.\n- **eBPF-based load balancing.** Cilium can do L4 load balancing inside the Linux kernel with near-zero overhead — relevant for high-throughput Kubernetes clusters.\n- **QUIC/HTTP3 changes latency profiles.** Load balancers that terminate QUIC connections reduce connection establishment latency by ~100 ms on first request (no TCP + TLS handshake).\n\n## Layer 4 vs Layer 7\n\n| Dimension | L4 (Transport) | L7 (Application) |\n| --- | --- | --- |\n| Operates on | TCP/UDP packets | HTTP/gRPC/WebSocket frames |\n| Routing basis | IP + port | URL path, headers, cookies |\n| TLS handling | Pass-through or terminate | Terminate, inspect, re-encrypt |\n| Performance | Faster (less inspection) | Slower, richer features |\n| Sticky sessions | IP hash | Cookie-based |\n| Examples | AWS NLB, HAProxy TCP mode | AWS ALB, Nginx, Envoy |\n\nUse L4 when raw throughput matters (databases, TCP services). Use L7 for HTTP APIs where you need path-based routing, header manipulation, or mTLS.\n\n## Load balancing algorithms\n\n| Algorithm | How it works | Best for |\n| --- | --- | --- |\n| Round-robin | Rotate through servers sequentially | Uniform request durations |\n| Least connections | Send to server with fewest active connections | Variable durations (API, DB queries) |\n| Weighted round-robin | Round-robin respecting server weights | Mixed-capacity servers |\n| IP hash | Hash client IP → consistent server | Stateful sessions (avoid if possible) |\n| Least response time | Track P95 latency per backend | Latency-sensitive APIs |\n| Random with two choices | Pick 2 random servers, send to the better | Large clusters, low overhead |\n\nFor most HTTP APIs, **least connections** is the safest default. It naturally routes away from slow backends without configuration.\n\n## Nginx load balancer configuration\n\n```nginx\nupstream api_backends {\n    least_conn;                          # algorithm\n    keepalive 32;                        # persistent connections to backends\n\n    server 10.0.1.1:3000 weight=3;\n    server 10.0.1.2:3000 weight=3;\n    server 10.0.1.3:3000 weight=1 backup; # only used when others are down\n}\n\nserver {\n    listen 443 ssl http2;\n    ssl_certificate     /etc/ssl/cert.pem;\n    ssl_certificate_key /etc/ssl/key.pem;\n\n    location /api/ {\n        proxy_pass         http://api_backends;\n        proxy_http_version 1.1;\n        proxy_set_header   Connection \"\";\n        proxy_set_header   Host $host;\n        proxy_set_header   X-Real-IP $remote_addr;\n\n        # Health-check awareness\n        proxy_next_upstream error timeout http_500 http_502 http_503;\n        proxy_next_upstream_tries 2;\n    }\n}\n```\n\n## Health checks\n\nHealth checks are not optional. A load balancer must know which backends are healthy before it routes traffic:\n\n```nginx\n# Nginx Plus active health check (free alternative: use HAProxy)\nupstream api_backends {\n    server 10.0.1.1:3000;\n    server 10.0.1.2:3000;\n\n    # Passive health check (built-in Nginx open-source)\n    # Mark unhealthy after 3 failures, re-check after 30s\n}\n\n# HAProxy active health check\nbackend api_servers\n    balance leastconn\n    option httpchk GET /healthz HTTP/1.1\\r\\nHost:\\ localhost\n    default-server inter 5s fall 3 rise 2\n    server s1 10.0.1.1:3000 check\n    server s2 10.0.1.2:3000 check\n```\n\nYour `/healthz` endpoint must check internal dependencies (DB connection, cache connectivity). A \"200 OK\" that just returns `{\"status\": \"ok\"}` without checking dependencies is a false positive.\n\n## How to pick\n\n1. **HTTP/HTTPS API traffic?** → L7: AWS ALB, Nginx, or Caddy.\n2. **TCP database connections or non-HTTP protocols?** → L4: AWS NLB or HAProxy in TCP mode.\n3. **Inside a Kubernetes cluster?** → Service type `ClusterIP` + Envoy (via service mesh) or kube-proxy.\n4. **gRPC services?** → Must use L7 (HTTP/2-aware) load balancer — L4 LBs can't distribute individual gRPC streams.\n5. **Zero infrastructure management?** → Cloud ALB (AWS, GCP, Azure) with auto-scaling target groups.\n\n## Common mistakes\n\n**No health checks.** A backend that returns 503 on every request will continue receiving traffic without active health checks. Every backend must have a `/healthz` endpoint and the LB must poll it.\n\n**Sticky sessions via IP hash.** IP addresses are not stable (mobile users, NAT). Use cookie-based stickiness or, better, design your backends to be stateless.\n\n**Long connection timeouts.** Default Nginx `proxy_read_timeout` is 60 s. A stuck backend will hold connections for a minute. Set aggressive timeouts and let clients retry.\n\n**Not logging the original client IP.** After the LB, backends see the LB's IP. Use `X-Forwarded-For` or the PROXY protocol to preserve the original IP in access logs.\n\n## What to skip\n\n- **DNS-based load balancing as your only strategy** — DNS TTLs mean failover takes minutes, not milliseconds.\n- **Session-stateful backends** — state on backends makes load balancing hard. Move sessions to Redis; keep backends stateless.\n- **Self-managed load balancers for simple apps** — cloud ALBs handle DDoS mitigation, certificate renewal, and scaling automatically at very low cost (~$20/month base).\n\n## FAQ\n\n**What is the difference between a load balancer and a reverse proxy?**\nA reverse proxy forwards requests to backends on behalf of clients; a load balancer is a reverse proxy that distributes requests across multiple backends. Every load balancer is a reverse proxy; not every reverse proxy is a load balancer.\n\n**Can a load balancer be a single point of failure?**\nYes — so cloud LBs run multiple instances across availability zones automatically. For self-managed LBs (Nginx, HAProxy), use VRRP (keepalived) for active-passive failover.\n\n**What is connection draining / graceful shutdown?**\nWhen deregistering a backend, the LB stops sending new requests but waits for in-flight requests to complete before removing the backend. AWS ALB calls this \"deregistration delay\" (default 300 s).\n\n**How do load balancers handle WebSockets?**\nWebSockets require sticky routing (the same backend handles the whole connection lifetime) and L7 LBs that support the HTTP Upgrade mechanism. Configure `proxy_http_version 1.1` and the `Upgrade` header in Nginx.\n\n## Where to go next\n\n- [Reverse proxies explained in 2026](/blog/reverse-proxies-explained-2026)\n- [Microservices explained in 2026](/blog/microservices-explained-2026)\n- [How to set up Nginx in 2026](/blog/how-to-set-up-nginx-2026)","hue":307,"metaTitle":"Load Balancers Explained in 2026 (L4, L7, Algorithms)","metaDescription":"2026 guide to load balancers: L4 vs L7, round-robin vs least-connections, health checks, TLS termination, and Nginx/HAProxy/Envoy configuration examples.","keywords":["load balancers explained 2026","load balancing algorithms 2026","l4 vs l7 load balancer 2026","nginx load balancer 2026","haproxy 2026","load balancer health checks 2026","application load balancer 2026","round robin vs least connections 2026","load balancing best practices 2026","high availability load balancer 2026"],"tldr":["**Load balancers sit in front of your servers** and distribute requests so no single instance is overwhelmed.","**L4 vs L7** — L4 (TCP) is faster; L7 (HTTP) enables content-based routing, header inspection, and TLS termination.","**Least-connections beats round-robin** for workloads with variable request durations; use round-robin only for uniform workloads.","**Health checks are mandatory** — a load balancer without health checks is worse than no load balancer (it routes to dead backends).","**Skip:** rolling your own Layer 7 load balancer from scratch — Nginx, HAProxy, Envoy, and cloud ALBs solve this problem reliably."],"readTime":"5 min read","wordCount":1032},"related":[{"slug":"load-balancing-algorithms-2026","title":"Load balancing algorithms in 2026: how traffic gets spread","excerpt":"The algorithm your load balancer uses decides how traffic spreads across servers. This 2026 guide compares round robin, least connections, IP hash, and power of two choices, and when each fits.","category":"code","date":"June 29, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":305},{"slug":"what-is-a-load-balancer-2026","title":"What is a load balancer in 2026? A clear explanation","excerpt":"A load balancer spreads incoming traffic across several servers so no single one gets overwhelmed. This guide explains how it works, the main types, and why it matters.","category":"code","date":"May 7, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":50},{"slug":"what-is-a-reverse-proxy-2026","title":"What Is a Reverse Proxy? Explained for 2026","excerpt":"A reverse proxy sits in front of your servers and handles TLS, routing, caching, and load balancing. Here is the plain-language 2026 version.","category":"code","date":"May 1, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":138}],"sameCategory":[{"slug":"bazel-build-explained-2026","title":"Bazel Explained: What Hermetic Builds Actually Cost","excerpt":"Bazel delivers reproducible, precisely cached builds and demands that you describe everything. Here is what you get, what it costs, and who should say no.","category":"code","date":"August 19, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":145},{"slug":"graphql-federation-2026","title":"GraphQL Federation: One Graph, Many Teams","excerpt":"Federation composes independently-owned subgraphs into a single API. Here is what it solves, the operational cost it adds, and when a simpler gateway is enough.","category":"code","date":"August 19, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":300},{"slug":"hermetic-builds-explained-2026","title":"Hermetic Builds Explained: Same Inputs, Same Output","excerpt":"A hermetic build depends only on declared inputs. Here is what that property gives you, the common leaks that break it, and how to move toward it incrementally.","category":"code","date":"August 19, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":130},{"slug":"monorepo-tooling-compared-2026","title":"Monorepo Tooling Compared: What You Actually Need","excerpt":"Monorepo tools solve task orchestration and caching, not repository layout. Here is what each tier provides and how to tell when you have outgrown the simple option.","category":"code","date":"August 19, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":150}],"newer":{"slug":"kindle-vs-tablet-2026","title":"Kindle vs tablet in 2026: which should you buy for reading?","excerpt":"A Kindle does one thing exceptionally well. A tablet does many things adequately. Here is the 2026 breakdown of which is worth your money if reading is your priority.","category":"tech","date":"April 7, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":228},"older":{"slug":"mac-vs-windows-2026","title":"Mac vs Windows in 2026: which should you actually buy?","excerpt":"Apple Silicon redrew the Mac vs Windows map in 2026. Here is the honest breakdown by use case, price, ecosystem, and longevity for every buyer type.","category":"tech","date":"April 7, 2026","author":"ByteLedger Team","readTime":"5 min read","hue":242}}