Overview

Introduction to Dapr, the durable execution engine for workflows and AI agents

Dapr provides durable, verifiable execution so your workflows and AI agents survive failure and keep running to completion. At its core is a durable execution workflow engine that guarantees every step runs to completion despite crashes, restarts, and network outages, recovering state from exactly where it left off. Workflow execution histories can be cryptographically signed and verifiable, making what ran tamper-evident and auditable, and the same engine powers durable AI agents that reason, call tools, and recover from any point of failure without losing progress.

As a CNCF distributed application runtime, Dapr is portable and event-driven, making it easy for any developer to build resilient, stateless, and stateful applications that run on the cloud and edge, embracing the diversity of languages and developer frameworks.

Any language, any framework, anywhere

Any language, any framework, anywhereThree bands. At the top, an application hexagon beside the brand marks for Node.js, Python, .NET, Go, Java, PHP and Rust, under the heading "Use any language or runtime". In the middle, the application calls Dapr over HTTP or gRPC, and Dapr offers sixteen APIs in two rows: Workflows, Publish and subscribe, Service invocation, State management, Actors, Jobs, Configuration, Secrets, Bindings, Middleware, and then the six alpha APIs Cryptography, Distributed lock, Conversation, Binary Store, Search and Vector. A column beside them holds what Dapr gives every API: Observability, Security and Resiliency. At the bottom, under the heading "Host on and integrate with any cloud or edge infrastructure", Dapr exchanges data with Azure, AWS, Google Cloud, Kubernetes, virtual or physical machines, databases, message brokers and services.Use any language or runtimeAppHTTP/gRPCDapr APIsCross-cutting APIsWorkflowsPublish &subscribeServiceinvocationStatemanagementActorsJobsConfigurationSecretsBindingsMiddlewareCryptographyalphaDistributedlockalphaConversationalphaBinary StorealphaSearchalphaVectoralphaObservabilitySecurityResiliencyHost on & integrate with any cloud or edge infrastructureAzureKubernetesVirtual orphysical machinesDatabasesMessage brokersServices
Download SVG

With the current wave of cloud adoption, web + database application architectures (such as classic 3-tier designs) are trending more toward microservice application architectures, which are inherently distributed. You shouldn’t have to become a distributed systems expert just to create microservices applications.

This is where Dapr comes in. Dapr codifies the best practices for building microservice applications into open, independent APIs called building blocks. Dapr’s building blocks:

  • Enable you to build portable applications using the language and framework of your choice.
  • Are completely independent
  • Have no limit to how many you use in your application

Using Dapr, you can incrementally migrate your existing applications to a microservices architecture, thereby adopting cloud native patterns such scale out/in, resiliency, and independent deployments.

Dapr is platform agnostic, meaning you can run your applications:

  • Locally
  • On any Kubernetes cluster
  • On virtual or physical machines
  • In other hosting environments that Dapr integrates with.

This enables you to build microservice applications that can run on the cloud and edge.

Microservice building blocks for cloud and edge

The Dapr building block APIsFifteen cards, five across and three down, one for each Dapr building block API. Workflows automate and orchestrate tasks within your application. Publish and subscribe provides secure, scalable messaging between services. Service invocation performs direct, secure, service to service method calls. State management creates long running, stateless and stateful services. Actors encapsulate code and data in reusable actor objects. Jobs schedules tasks to run at specified intervals or times. Configuration accesses application configuration and is notified of updates. Secrets securely accesses secrets from your application. Bindings provides input and output bindings to external resources, including databases and queues. Six more are in alpha: cryptography performs operations for encrypting and decrypting data, distributed lock gives mutually exclusive access to shared resources, conversation converses between different large language models, binary store stores, retrieves and deletes binary files, search indexes and queries JSON documents, and vector stores vectors and runs similarity queries.WorkflowsAutomate and orchestratetasks within yourapplicationPublish & subscribeSecure, scalable messagingbetween servicesService invocationPerform direct, secureservice-to-servicemethod callsState managementCreate long running,stateless and statefulservicesActorsEncapsulate code and datain reusable actor objectsJobsScheduled tasks to runat specified intervalsor timesConfigurationAccess applicationconfiguration and benotified of updatesSecretsSecurely access secretsfrom your applicationBindingsInput and output bindingsto external resources,including databasesand queuesCryptographyPerform operations forencrypting anddecrypting dataalphaDistributed lockMutually exclusive accessto shared resourcesalphaConversationConverse between differentlarge language modelsalphaBinary StoreStore, retrieve and deletebinary files usingpluggable componentsalphaSearchIndex, retrieve and queryJSON documents infull-text search enginesalphaVectorStore vectors and runsimilarity queries againstvector databasesalpha
Download SVG

Dapr provides distributed system building blocks for you to build microservice applications in a standard way and to deploy to any environment.

Each of these building block APIs is independent, meaning that you can use any number of them in your application.

Building BlockDescription
WorkflowsDapr’s durable execution engine for defining long-running, persistent processes or data flows that span multiple microservices, guaranteeing each step runs to completion despite failures. The workflow API can be combined with other Dapr building blocks, and workflow histories can be cryptographically signed and verified.
Service-to-service invocationResilient service-to-service invocation enables method calls, including retries, on remote services, wherever they are located in the supported hosting environment.
Publish and subscribePublishing events and subscribing to topics between services enables event-driven architectures to simplify horizontal scalability and make them resilient to failure. Dapr provides at-least-once message delivery guarantee, message TTL, consumer groups and other advance features.
State managementWith state management for storing and querying key/value pairs, long-running, highly available, stateful services can be easily written alongside stateless services in your application. The state store is pluggable and examples include AWS DynamoDB, Azure Cosmos DB, Azure SQL Server, GCP Firebase, PostgreSQL or Redis, among others.
Binary StoreThe binary store API enables you to store, retrieve, and delete files that are too large for a state store. File content is streamed between your application and the configured store rather than buffered in the Dapr sidecar as a JSON value.
Resource bindingsResource bindings with triggers builds further on event-driven architectures for scale and resiliency by receiving and sending events to and from any external source such as databases, queues, file systems, etc.
ActorsA pattern for stateful and stateless objects that makes concurrency simple, with method and state encapsulation. Dapr provides many capabilities in its actor runtime, including concurrency, state, and life-cycle management for actor activation/deactivation, and timers and reminders to wake up actors.
SecretsThe secrets management API integrates with public cloud and local secret stores to retrieve the secrets for use in application code.
ConfigurationThe configuration API enables you to retrieve and subscribe to application configuration items from configuration stores.
Distributed lockThe distributed lock API enables your application to acquire a lock for any resource that gives it exclusive access until either the lock is released by the application, or a lease timeout occurs.
CryptographyThe cryptography API provides an abstraction layer on top of security infrastructure such as key vaults. It contains APIs that allow you to perform cryptographic operations, such as encrypting and decrypting messages, without exposing keys to your applications.
JobsThe jobs API enables you to schedule jobs at specific times or intervals.
ConversationThe conversation API enables you to abstract the complexities of interacting with large language models (LLMs) and includes features such as prompt caching and personally identifiable information (PII) obfuscation. Using conversation components, you can supply prompts to converse with different LLMs.
SearchThe search API enables you to index, retrieve, and query documents in full-text search engines through one portable API. Using search components, you can swap search engines without changing your application code.
VectorThe vector API enables you to store embeddings and run similarity queries against vector databases through one portable API. Using vector components, you can swap vector databases without changing your application code.

Cross-cutting APIs

Alongside its building blocks, Dapr provides cross-cutting APIs that apply across all the build blocks you use.

Building BlockDescription
ResiliencyDapr provides the capability to define and apply fault tolerance resiliency policies via a resiliency spec. Supported specs define policies for resiliency patterns such as timeouts, retries/back-offs, and circuit breakers.
ObservabilityDapr emits metrics, logs, and traces to debug and monitor both Dapr and user applications. Dapr supports distributed tracing to easily diagnose and serve inter-service calls in production using the W3C Trace Context standard and Open Telemetry to send to different monitoring tools.
SecurityDapr supports in-transit encryption of communication between Dapr instances using the Dapr control plane, Sentry service. You can bring in your own certificates, or let Dapr automatically create and persist self-signed root and issuer certificates.

Sidecar architecture

Dapr exposes its HTTP and gRPC APIs as a sidecar architecture, either as a container or as a process, not requiring the application code to include any Dapr runtime code. This makes integration with Dapr easy from other runtimes, as well as providing separation of the application logic for improved supportability.

The Dapr sidecar modelApplication code on the left and the Dapr sidecar on the right, drawn as two hexagons side by side. A two-headed arrow between them is labelled "Dapr API" and "HTTP/gRPC", because the application calls Dapr over a local HTTP or gRPC endpoint rather than linking any Dapr code. Below are five example calls to that endpoint: POST to slash v1.0 slash invoke slash cart slash method slash order, GET to slash v1.0 slash state slash inventory slash item50, POST to slash v1.0 slash publish slash mybroker slash order-messages, GET to slash v1.0 slash secrets slash vault slash dbaccess, and POST to slash v1.0 slash workflows slash dapr slash businessprocess slash start.AppApplication codeDapr sidecarDapr APIHTTP/gRPCPOSThttp://localhost:3500/v1.0/invoke/cart/method/orderGEThttp://localhost:3500/v1.0/state/inventory/item50POSThttp://localhost:3500/v1.0/publish/mybroker/order-messagesGEThttp://localhost:3500/v1.0/secrets/vault/dbaccessPOSThttp://localhost:3500/v1.0/workflows/dapr/businessprocess/start
Download SVG

Hosting environments

Dapr can be hosted in multiple environments, including:

  • Self-hosted on a Windows/Linux/macOS machine for local development and in production
  • On Kubernetes or clusters of physical or virtual machines in production

Self-hosted local development

In self-hosted mode, Dapr runs as a separate sidecar process, which your service code can call via HTTP or gRPC. Each running service has a Dapr runtime process (or sidecar) configured to use state stores, pub/sub, binding components, and the other building blocks.

You can use the Dapr CLI to run a Dapr-enabled application on your local machine. In the following diagram, Dapr’s local development environment gets configured with the CLI init command. Try this out with the getting started samples.

Dapr in self-hosted modeOn the left, a dashed region labelled Docker Desktop holds the four containers that dapr init runs: the Dapr scheduler, which schedules jobs to run at specified intervals; the Dapr placement service, which creates a mapping table of actor instances and pods; Redis, for state management and pub/sub messaging; and Zipkin, which receives distributed tracing. In the middle, dapr run starts an application with a Dapr sidecar beside it, and the sidecar talks to each of those containers. On the right, the sidecar uses components for publish and subscribe, workflows, state management, configuration and secrets. Along the bottom, a dashed strip says this runs on a local dev machine or virtual machine, on Windows, macOS, Linux or ARM.Docker Desktopdapr initSchedulerSchedule jobs to runat specified intervalsPlacementCreate mapping table ofactor instances and podsRedisState management andpub/sub messagingZipkinSend distributedtracingAppdapr run [flags]Use componentsPublish &subscribeWorkflowsStatemanagementConfigurationSecretsWindows, macOS, Linux or ARM: a local dev machine or virtual machine
Download SVG

Kubernetes

Kubernetes can be used for either:

In container hosting environments such as Kubernetes, Dapr runs as a sidecar container with the application container in the same pod.

Dapr’s dapr-sidecar-injector and dapr-operator control plane services provide first-class integration to:

  • Launch Dapr as a sidecar container in the same pod as the service container
  • Provide notifications of Dapr component updates provisioned in the cluster

The dapr-sentry service is a certificate authority that enables mutual TLS between Dapr sidecar instances for secure data encryption, as well as providing identity via Spiffe. For more information on the Sentry service, read the security overview

Deploying and running a Dapr-enabled application into your Kubernetes cluster is as simple as adding a few annotations to the deployment schemes. Visit the Dapr on Kubernetes docs.

Dapr on KubernetesA dashed region stands for the Kubernetes cluster. Along its top are the five Dapr control plane services, each in its own pod: placement, which maps actor instances to pods and is used for actors only; the sidecar injector, which injects the Dapr sidecar into annotated pods; sentry, the certificate authority, which manages mTLS and assigns SPIFFE identity; the operator, which manages components and Kubernetes service endpoints; and the scheduler, which schedules jobs for the Jobs and Workflow APIs. Each reaches down to an application pod in the middle, where the Dapr sidecar runs beside the application. The kubelet probes that pod, using readiness and liveness probes on the healthz API to decide Dapr health state. Below, a dashed strip headed "Host on any cloud or edge infrastructure" carries Azure, AWS, Google Cloud, Alibaba Cloud and Kubernetes. On the right, the sidecar uses components for publish and subscribe, workflows, state management, configuration and secrets.PodPlacementActor partitionplacementMap actorinstances to pods,for actors onlyPodInjectorDapr runtimeinjectorInject the sidecarinto annotatedpodsPodSentryCertificateauthorityManage mTLS,assign SPIFFEidentityPodOperatorComponentupdatesManage componentsand serviceendpointsPodSchedulerDistributed jobschedulingSchedule jobs forthe Jobs andWorkflow APIsPodAppKubeletReadiness and livenessprobes on the healthz APIdecide Dapr health stateHost on any cloud or edge infrastructureAzureAlibaba CloudKubernetesUse componentsPublish &subscribeWorkflowsStatemanagementConfigurationSecrets
Download SVG

Clusters of physical or virtual machines

The Dapr control plane services can be deployed in high availability (HA) mode to clusters of physical or virtual machines in production. In the diagram below, the Actor Placement and security Sentry services are started on three different VMs to provide HA control plane. In order to provide name resolution using DNS for the applications running in the cluster, Dapr uses multicast DNS by default, but can also optionally support Hashicorp Consul service.

The Dapr control plane across a cluster of machinesThree dashed regions stand for three machines, VM1, VM2 and VM3. Each runs the same four services in a column, and arrows join each service across all three machines, which is what makes the control plane highly available. Described once beside their row, the four are Consul for DNS name resolution if you choose it over multicast DNS, the Dapr placement service which creates the mapping table of actor instances, the Dapr scheduler which schedules jobs at specified intervals for the Jobs and Workflow APIs and for actor reminders, and Dapr sentry which assigns SPIFFE identity and manages mTLS. An application with a Dapr sidecar runs on the first machine and another on the third, and the two sidecars call each other. On the right, the sidecars use components for publish and subscribe, workflows, state management, configuration and secrets, and below those is the certificate store shared by all the machines.VM1VM2VM3DNS name resolution,if you choose Consulover mDNSConsulConsulConsulCreate the mapping tableof actor instancesPlacementPlacementPlacementSchedule jobs at specifiedintervals, for the Jobs andWorkflow APIs and remindersSchedulerSchedulerSchedulerAssign SPIFFE identityand manage mTLSSentrySentrySentryApp AApp BUse componentsPublish &subscribeWorkflowsStatemanagementConfigurationSecretsCert store forall machines
Download SVG

Developer language SDKs and frameworks

Dapr offers a variety of SDKs and frameworks to make it easy to begin developing with Dapr in your preferred language.

Dapr SDKs

To make using Dapr more natural for different languages, it also includes language specific SDKs for:

  • Go
  • Java
  • JavaScript
  • .NET
  • PHP
  • Python

These SDKs expose the functionality of the Dapr building blocks through a typed language API, rather than calling the http/gRPC API. This enables you to write a combination of stateless and stateful functions and actors all in the language of your choice. Since these SDKs share the Dapr runtime, you get cross-language actor and function support.

Developer frameworks

Dapr can be used from any developer framework. Here are some that have been integrated with Dapr:

Web

LanguageFrameworksDescription
.NETASP.NET CoreBrings stateful routing controllers that respond to pub/sub events from other services. Can also take advantage of ASP.NET Core gRPC Services.
JavaSpring BootBuild Spring boot applications with Dapr APIs
PythonFlaskBuild Flask applications with Dapr APIs
JavaScriptExpressBuild Express applications with Dapr APIs
PHPYou can serve with Apache, Nginx, or Caddyserver.

Dapr Agents

Dapr Agents and what it is built onA user on the left talks to Dapr Agents, drawn as a square with a robot mark, and Dapr Agents answers. From it, one line runs to a column of five capabilities: planning, memory, tools, MCP support, and delegating tasks to other agents. Tools reaches on to the outside world, drawn as a globe on the right. Along the bottom, a dashed band labelled "Built on Dapr" holds the three things the framework gets from Dapr: durable execution, observability and security.Built on DaprDurable executionObservabilitySecurityUserDapr AgentsInteractionPlanningMemoryToolsMCP supportDelegate tasksOutside world
Download SVG

Dapr Agents is a Python framework for building intelligent, durable agents powered by LLMs. It provides agent-centric capabilities such as tool calling, memory management, MCP support and agent orchestration, while leveraging Dapr for durability, observability, and security, at scale.

Integrations and extensions

Visit the integrations page to learn about some of the first-class support Dapr has for various frameworks and external products, including:

  • Public cloud services, like Azure and AWS
  • Visual Studio Code
  • GitHub

Designed for operations

Dapr is designed for operations and security. The Dapr sidecars, runtime, components, and configuration can all be managed and deployed easily and securely to match your organization’s needs.

Dapr supports monitoring tools for deeper visibility into the Dapr system services and sidecars, while the observability capabilities of Dapr provide insights into your application, such as tracing and metrics.

Last modified October 30, 2026: Centre every drawing in its canvas, and size diagrams by calculation (87851cdbc)