Iggy stores messages without requiring a Kafka deployment
Apache Iggy is a persistent append-only message server written mainly in Rust. Producers write binary data to topics and partitions, consumers can poll by offset or timestamp, and the server stores consumer offsets. Authentication, permissions, personal access tokens, retention, deduplication, headers, TLS, encryption, and consumer groups are part of the documented surface. Clients can connect over TCP, QUIC, WebSocket, or an optional HTTP API.
The design is aimed at teams that want an event log without a JVM broker. Iggy can run as one binary, while Docker Compose, a web interface, a CLI, connectors, and cluster support cover larger deployments. SDKs are listed for 6 languages: Rust, C#, Java, Python, Node.js, and Go. C++ is explicitly described as work in progress, which is the right level of caution for a client that is not finished.
A 5 MB npm install did not exercise the Rust server
Our sandbox installed the repository's root npm package in 10 seconds. It added 2 packages, used 5 MB on disk, and npm audit reported 0 known vulnerabilities across that installed JavaScript tree. Those figures look unusually small because the root package is not the main server toolchain. The repository's primary language is Rust, and the README tells server developers to use Cargo or the supplied container setup.
There was no npm build script and no npm test script at the root, so our harness skipped both steps. A skipped target is not a successful Rust build. It also does not verify the Node SDK, web interface, Cargo workspace, connector plugins, or server behavior. The mismatch itself is useful: anyone automating setup from ecosystem detection can get a clean npm result while leaving Iggy's main product untouched.
What happened when we ran it
Our run used commit 5916e6f in an unprivileged Debian container with 3 CPUs, 8 GB of RAM, Node 22, and no secrets. Installation finished in 10 seconds with 2 packages and 5 MB on disk. The available audit reported 0 vulnerabilities at every listed severity. Build and tests were skipped because no matching npm targets existed.
The checkout contained 3,404 files, about 611,453 source lines, and 41.1 MB before installed dependencies. It had 20 CI workflow files, a Dockerfile, and a compose file, but no top-level tests directory in the lab scan. These repository signals show substantial automation around a large multi-language tree. They do not replace a cargo build and cargo test, which the README identifies as the source workflow.
We therefore cannot report server compile time, Rust test results, broker throughput, or latency from this sandbox block. The README makes performance claims and includes a benchmarking application, but our measurement did not run it. A useful evaluation would repeat the Cargo path on the intended Linux kernel and storage, then measure the producer and consumer pattern the organization will run. No performance number on this page should be read as our benchmark.
Docker asks for Linux capabilities that need review
The documented quick start can run cargo run --bin iggy-server or docker compose up. On first boot, the server generates a random root password if credentials were not supplied, and it prints that password to standard output. Root credentials are tied to the persisted data directory after creation. Later environment changes do not replace them, so operators need to capture, store, and rotate access deliberately.
The compose configuration adds SYS_NICE, sets seccomp to unconfined, and removes the memory-lock limit. Those settings may be reasonable for the server's low-level I/O design, but they are not neutral defaults in a restricted cluster. Docker on a non-Linux host also runs through a virtual machine, and the README warns of degraded performance. Production evaluation should use the same kernel, disk, capability policy, and transport planned for service.
Kafka parity and connector credentials remain open work
Issue 3560 tracks Kafka gateway protocol parity. That makes Iggy easier to test with some Kafka-facing software, but it does not support assuming that every Kafka client or administrative workflow is compatible. Teams migrating an established estate should list the exact APIs they depend on and test each one before changing brokers. Redpanda is the clearer candidate when retaining Kafka compatibility is the primary requirement.
Issue 3802 reports that the connector runtime configuration API returns plugin credentials when authentication is disabled, which the report says is the default. Connectors can move data to external systems and load custom Rust plugins, so their secrets deserve the same controls as broker credentials. Keep authentication enabled, restrict the management API, and inspect the issue's resolution status before exposing connector administration to another network.
Client maturity also differs by language. Issue 3893 tracks work to align the Python SDK with the native Rust API, while issue 3997 asks for store, get, and delete operations for consumer offsets. If Python is the main client, compare its current methods with the application design rather than using the Rust documentation as a proxy. The six-language list describes availability, not identical capabilities.
August commits are active, while Apache incubation continues
GitHub recorded 4,613 stars, 187 open issues and pull requests combined, and a last push on August 30, 2026. The latest GitHub release was server-0.8.0 on April 22. Work continued well after that tag through commits and current issue discussion, so the release date alone is not a sign of inactivity. The release notice says the project remains in the Apache Incubator and has not yet received full ASF endorsement.
Iggy is interesting when a team controls both ends of a stream and can choose its protocol deliberately. The single-binary model, several transports, and language SDKs reduce some adoption friction. Our 10-second npm result does not establish that the Rust server is ready for that job. Build the actual Cargo workspace, secure first-boot credentials, review the container privileges, and prove the required client and connector paths before replacing an existing broker.