登录

piko

andydunstallMIT活跃维护

用 Go 写的开源 Ngrok 替代品，专注承载生产流量，部署简单，特别适合跑在 Kubernetes 上做反向代理和内网穿透。

An open-source alternative to Ngrok, designed to serve production traffic and be simple to host (particularly on Kubernetes)

v0.10.1发布于 2026-10-07 15:29 UTC2,204star +3 / 7 天90fork同步于 2026-11-10 23:45 UTC
内网穿透反向代理隧道KubernetesGo
对比 GitHubgolanghttphttp-proxyreverse-proxytunneling

怎么上手

由 README 提炼，执行前请确认
原文 
piko agent http my-endpoint 3000
硬件要求按 README 说明

README 未说明

下载：源码 zip·GitHub Releases（安装包）本站不镜像安装包

项目说明

由 README 自动翻译提炼
没人工点评？写下你的经验

开源版 Ngrok，用出站隧道把内网服务安全暴露到公网，专为生产流量和 Kubernetes 托管设计

用 Go 写的开源 Ngrok 替代品，专注承载生产流量，部署简单，特别适合跑在 Kubernetes 上做反向代理和内网穿透。

核心能力

  • 上游服务主动建立出站隧道，无需公网端口
  • 按 Host 首段或 x-piko-endpoint 头路由 HTTP 请求
  • 同一端点多个上游自动做负载均衡
  • 服务端可多节点集群，故障转移与零停机部署
  • 提供 Prometheus 指标、访问日志和状态 API

容易踩的坑

README 未给出服务端启动命令，需查阅 Wiki 的 Getting Started；TCP 代理必须经 piko forward 或 Go SDK 连接，不能直连服务端；HTTP 用 Host 路由时需配置通配域名，否则改用 x-piko-endpoint 头

内容由模型根据 README 生成，可能不完整或不准确，以官方文档为准。看原文 README

最近发版

5 个版本v0.10.1
全部 release
  1. v0.10.1最新正式版2026-10-07 · 2026-10-07 15:29 UTC

    Full Changelog: https://github.com/andydunstall/piko/compare/v0.9.1...v0.10.1

  2. v0.10.02026-05-08 · 2026-05-08 10:13 UTC
    查看更新说明

    What's Changed

    New Contributors

    Full Changelog: https://github.com/andydunstall/piko/compare/v0.9.0...v0.10.0

  3. v0.9.02026-01-25 · 2026-01-25 15:14 UTC
    查看更新说明

    What's Changed

    New Contributors

    Full Changelog: https://github.com/andydunstall/piko/compare/v0.8.1...v0.9.0

  4. v0.8.12025-08-08 · 2025-08-08 07:14 UTC
    查看更新说明

    What's Changed

    Full Changelog: https://github.com/andydunstall/piko/compare/v0.8.0...v0.8.1

  5. v0.8.02025-08-08 · 2025-08-08 06:33 UTC
    查看更新说明

    What's Changed

用户点评

登录用户的真实使用记录，可按版本和硬件筛选
共 0 条

    还没有人点评。第一个说出真实体验的人最有价值。

    README 原文

    未翻译
    在 GitHub 打开

    What Is Piko?

    Piko is a reverse proxy that provides a secure way to connect to services that aren’t publicly routable, known as tunneling. Instead of sending traffic directly to your services, your upstream services open outbound-only connections (tunnels) to Piko, then Piko forwards traffic to your services via their established connections.

    Piko has two key design goals:

    • Built to serve production traffic by running as a cluster of nodes for fault tolerance, horizontal scaling and zero-downtime deployments
    • Simple to host behind a HTTP(S) load balancer on Kubernetes

    Therefore Piko can be used as an open-source alternative to Ngrok.

    Such as you may use Piko to expose services in a customer network, a bring your own cloud (BYOC) service, or to connect to user devices.

    Reverse Proxy

    In a traditional reverse proxy, you configure routing rules describing how to route incoming traffic to your upstream services. The proxy will then open connections to your services and forward incoming traffic. This means your upstream services must be discoverable and have an exposed port that's accessible from the proxy.

    Whereas with Piko, your upstreams open outbound-only connections to the Piko server and specify what endpoint they are listening on. Piko then forwards incoming traffic to the correct upstream via its outbound connection.

    Therefore your services may run anywhere without requiring a public route, as long as they can open a connection to the Piko server.

    Endpoints

    Upstream services listen for traffic on a particular endpoint. Piko then manages routing incoming connections and requests to an upstream service listening on the target endpoint. If multiple upstreams are listening on the same endpoint, requests are load balanced among the available upstreams.

    No static configuration is required to configure endpoints, upstreams can listen on any endpoint they choose.

    You can open an upstream listener using the Piko agent, which supports both HTTP and TCP upstreams. Such as to listen on endpoint my-endpoint and forward traffic to localhost:3000:

    # HTTP listener.
$ piko agent http my-endpoint 3000

# TCP listener.
$ piko agent tcp my-endpoint 3000

    You can also use the Go SDK to listen directly from your application using a standard net.Listener.

    HTTP(S)

    Piko acts as a transparent HTTP(S) reverse proxy.

    Incoming HTTP(S) requests identify the target endpoint to connect to using either the Host header or x-piko-endpoint header.

    When using the Host header, Piko uses the first segment as the endpoint ID. Such as if your hosting Piko with a wildcard domain at *.piko.example.com, sending a request to foo.piko.example.com will be routed to an upstream listening on endpoint foo.

    To avoid having to set up a wildcard domain you can instead use the x-piko-endpoint header, such as if Piko is hosted at piko.example.com, you can send requests to endpoint foo using header x-piko-endpoint: foo.

    TCP

    Piko supports proxying TCP traffic, though unlike HTTP it requires using either Piko forward or the Go SDK to map the desired local TCP port to the target endpoint.

    Piko forward listens on a local TCP port and forwards connections to the configured upstream endpoint via the Piko server.

    Such as to listen on port 3000 and forward connections to endpoint my-endpoint:

    piko forward 3000 my-endpoint

    Note unlike with HTTP, there is no way to identify the target endpoint when connecting with raw TCP, which is why you must first connect to Piko forward instead of connecting directly to the Piko server. Piko forward can also authenticate with the server and forward connections via TLS.

    You can also use the Go SDK to open a net.Conn that's connected to the configured endpoint.

    Design Goals

    Production Traffic

    Piko is built to serve production traffic by running the Piko server as a cluster of nodes to be fault tolerant, scale horizontally and support zero downtime deployments.

    Say an upstream is listening for traffic on endpoint E and connects to node N. Node N will notify the other nodes that it has a listener for endpoint E, so they can route incoming traffic for that endpoint to node N, which then forwards the traffic to the upstream via its outbound-only connection to the server. If node N fails or is deprovisioned, the upstream listener will reconnect to another node and the cluster propagates the new routing information to the other nodes in the cluster. See How Piko Works for details.

    Piko also has a Prometheus endpoint, access logging, and status API so you can monitor your deployment and debug issues. See observability for details.

    Hosting

    Piko is built to be simple to host on Kubernetes. This means it can run as a cluster of nodes (such as a StatefulSet), supports gradual rollouts, and can be hosted behind a HTTP load balancer or Kubernetes Gateway.

    Upstream services and downstream clients may connect to any node in the cluster via the load balancer, then the cluster manages routing traffic to the appropriate upstream.

    See Kubernetes for details.

    Getting Started

    See Getting Started.

    How Piko Works

    See How Piko Works.

    Support

    Use GitHub Discussions to ask questions, get help, or suggest ideas.

    Docs

    See Wiki.

    Contributing

    See CONTRIBUTING.

    License

    MIT License, please see LICENSE for details.

    相关项目

    同分类里 star 最高的项目
    对比全部 →
    frp
    fatedier·Go

    一款用 Go 编写的高性能反向代理，能把 NAT 或防火墙后面的本地服务安全暴露到公网，常用于内网穿透和远程访问。

    内网穿透+4内网穿透 / 隧道
    110517+4915kv0.72.02026-11-10 09:44 UTC
    tailscale
    tailscale·Go

    基于 WireGuard 的零配置虚拟组网工具，把设备连成加密私有网络，支持 SSO、OAuth 和 2FA 登录，省去手动配置 VPN 的麻烦。

    虚拟组网+4内网穿透 / 隧道
    38888+1493.5kv1.104.62026-11-10 23:04 UTC
    ngrok
    inconshreveable·Go

    Unified ingress for developers

    内网穿透 / 隧道
    243834.2k2024-04-26 18:11 UTC
    awesome-tunneling
    anderspitman·Python

    汇总 ngrok、Cloudflare Tunnel、Tailscale、ZeroTier 等内网穿透与隧道方案的开源清单，重点收录可自托管的替代工具，方便按需选型。

    内网穿透+4内网穿透 / 隧道
    22034+101.1k2026-11-10 15:03 UTC