Temporal vs Dapr Workflow

Temporal runs a dedicated durable execution cluster with polyglot SDKs, while Dapr Workflow adds durable workflows to an existing Dapr sidecar estate. The right choice depends on whether Dapr is already your application runtime.

On this page

Temporal vs Dapr Workflow: when each one fits a Kubernetes team

Choose Temporal when durable workflows are the core product and your team can justify a dedicated server cluster to run them. Choose Dapr Workflow when Dapr is already your application runtime and you want workflows to ride on the sidecar you already operate. The decision turns on what you already run. Existing Dapr use, the state store behind it, the language mix of your teams, who owns operations, and how much visibility and versioning control you need will settle the question more reliably than feature checklists. Start with the inventory. If your services already call Dapr building blocks and your platform team already manages sidecars and an actor state store, Dapr Workflow adds little new infrastructure. Confirm which state store your environment uses and whether it is supported for Dapr actors in your Dapr version, since Dapr stores each workflow actor's state, including its inbox of driving messages, in that configured store. If Dapr is not yet in production, adopting it only for workflows means a new runtime model, and Temporal's separate server, persistence and visibility stores may be the cleaner boundary.

Then test the operational and governance needs. Temporal self-hosting means running Frontend, History, Matching and Worker services plus persistence and visibility stores, and its self-hosted security settings such as the Authorizer and ClaimMapper must be configured deliberately because the default noopAuthorizer allows every API request. Dapr Workflow inherits access policies and the dapr workflow CLI for listing, suspending, terminating and purging instances, so confirm those controls satisfy your audit needs. Ask both vendors and your own platform team how in-flight workflows are versioned during rolling deployments, and what visibility search you need across executions before you commit.

Which scenarios favor Temporal and which favor Dapr Workflow

This table maps common team situations to the option that fits better and the condition that reverses the choice. Read each row as a starting point, then check it against your existing Kubernetes, language and operations footprint. The main takeaway is that Dapr Workflow usually wins where Dapr is already in use, while Temporal wins where workflow operations and multi-language durability are the central requirement.

ScenarioBetter fit and whyWhen the other option wins
Existing Dapr estate with state stores already configuredDapr Workflow, because it runs inside the Dapr sidecar and stores workflow state in the actor state store your applications already use, adding no separate server cluster.Temporal wins if the Dapr estate is light and you need a dedicated durable engine with its own history and tooling.
Polyglot organization with services in several languagesTemporal, because its SDKs for Go, Java, TypeScript and Python each express workflows as ordinary code under one server model. Confirm the exact SDK set for your languages.Dapr Workflow wins if your languages are already covered by Dapr SDKs and teams want one sidecar pattern across services.
Team with no Dapr footprint on KubernetesTemporal, because adopting it means one dedicated server deployment rather than introducing a sidecar runtime across every application pod.Dapr Workflow wins if you plan to adopt Dapr for other building blocks anyway, so the workflow engine comes at little extra cost.
Long-running human approval flowsTemporal, because its complete ordered event history and signals suit approvals that wait for days, with the history visible to operators. Confirm the wait limits and retention settings for your use case.Dapr Workflow wins if approvals are modest in number and external events can be delivered through Dapr's existing human-in-the-loop pattern.
Need for a dedicated workflow operations surfaceTemporal, because its Web UI, CLI and visibility store are built around finding and managing executions at scale, though you must provision visibility storage yourself.Dapr Workflow wins if the dapr workflow CLI and API cover your operator needs and you do not want another system to run.
Strict control over where workflow state is storedDapr Workflow, because state goes to the actor state store you configure, which can be the same database your services already govern. Confirm the store choice is supported for your environment.Temporal wins if you need a database and visibility layout that is documented and tested independently of application data stores.

How Temporal Service and Dapr Workflow are built and deployed

Temporal runs as a dedicated cluster of services with its own persistence and visibility stores, while Dapr Workflow runs inside the Dapr sidecar and keeps its state in whatever actor state store the application already uses. The cards below compare what each design means for upgrades, scaling and on-call work, and what to confirm before choosing.

Temporal's dedicated service cluster

A self-hosted Temporal Service runs Frontend, History, Matching and Worker services, plus a persistence store and a visibility store. Your platform team owns each of these components as separate workloads, so you need capacity planning, monitoring and restart procedures for all of them. Ask who on your team will be paged when History or Matching degrades, and whether that person has run the service before.

Dapr's sidecar-based runtime

Dapr runs as a sidecar container or process next to each application, and the workflow engine runs inside that sidecar layer rather than as a separate cluster. Operationally, you manage the Dapr control plane and sidecar injection with the application rollout, not a standalone workflow server. Confirm that your platform already runs Dapr sidecars in production, because adding a new sidecar pattern to a team that has none is a larger change than the workflow feature itself.

Where workflow state lives

Temporal persists a complete ordered event history in its own database, which is tested against Cassandra, PostgreSQL and MySQL. Dapr implements each workflow on actors, and each workflow actor saves its state, including its inbox of messages, in the actor state store you configure. The choice of store determines backup, restore and capacity planning, so confirm which database your DBAs already back up and support before deciding.

Upgrade paths and version coupling

Temporal Server should be upgraded one minor version at a time, moving first to the latest patch of the current minor, and schema changes must run before server upgrades when release notes call for them. Helm chart versions below 0.73.1 do not work with server images 1.30 and later, so chart and server versions must move together. Dapr upgrades the runtime alongside your application sidecar, so plan a coordinated rollout that covers every service using the sidecar.

Scaling and failure handling

Temporal scales each service role separately, so History and Matching can grow independently of the workers that run your code. Dapr scales with the application: each replica brings its own sidecar, and workflow progress resumes after pod restarts, node failures and rolling deployments. Ask load-testing questions for your own peak volume, since the cost of scaling Temporal's persistence store and Dapr's actor state store depends on your workflow count and history size.

Security defaults to verify

A self-hosted Temporal Service with no Authorizer configured uses a no-op authorizer that allows every API request, so authentication, mTLS and namespace roles must be set deliberately. Temporal services should also run on hosts not reachable from the public internet. Dapr access policies control which applications may call which workflows, so confirm that your team can express those rules in its existing identity model before going live.

Operations, languages, versioning and visibility compared

This table compares Temporal and Dapr Workflow on license, server topology, languages, storage, visibility, versioning, management tools, access controls and payload encryption. Read each row as a question to answer for your own cluster, because the two products sit at different layers of the stack. The main takeaway is that Temporal runs its own server cluster and security settings, while Dapr Workflow inherits much of its operating model from the Dapr sidecar and actor state store you already run.

CapabilityTemporalDapr Workflow
LicenseMIT for Temporal Server. Temporal Cloud is a separate managed service.Apache-2.0, a graduated CNCF project.
Server topologyFrontend, History, Matching and Worker services plus persistence and visibility stores.A sidecar beside each application, with workflow state held in the configured actor state store.
Supported languagesGo, Java, TypeScript and Python SDKs..NET, Java, Python, Go, JavaScript/TypeScript and Rust SDKs.
Persistence optionsCassandra, PostgreSQL and MySQL (tested versions listed in docs). SQLite is for development only.The actor state store configured for your Dapr deployment. Confirm which stores your Dapr version supports for workflows.
VisibilitySeparate advanced visibility store on Elasticsearch, OpenSearch, MySQL, PostgreSQL or SQLite. Elasticsearch or OpenSearch is recommended beyond a few executions.No separate visibility store is documented in the supplied material. Confirm how listing and querying scale on your state store.
Versioning of in-flight workflowsServer upgrades move one minor version at a time. Confirm your workflow code versioning approach in the Temporal docs.Versioning of in-flight workflows is a documented capability. Confirm the procedure for your Dapr release.
Management CLI and APIClient API and tooling. Confirm the exact CLI commands and Web UI actions for your server version.The dapr workflow CLI lists, shows history, suspends, resumes, terminates, reruns, raises events and purges workflows.
Authorization defaultnoopAuthorizer allows every API request until an Authorizer is configured.Access policies control which applications may call which workflows. Confirm the default before go-live.
Payload encryptionCustom codecs and a codec server encrypt payloads before storage.Not covered in the supplied material. Confirm how payload protection works with your state store and secrets setup.

What the license and managed options cost you to use

The Temporal Server is MIT licensed, so you can run and modify it inside your own infrastructure without a license fee from the project. The license line is therefore zero, but the operating line is not. A self-hosted Temporal Service runs Frontend, History, Matching and Worker services plus persistence and visibility stores, and your organization pays for the compute, databases and the engineers who patch and upgrade them. Upgrades follow a fixed order: move one minor version at a time, start with the latest patch of the current minor, and run schema upgrades first when the release notes call for them. The current line includes v1.32.1, published on October 8, 2026, according to the Temporal releases page.

  • Infrastructure: You pay for hosts or Kubernetes capacity for each service, plus the database and any Elasticsearch or OpenSearch cluster used for visibility at scale.
  • Security configuration: Without an Authorizer, the default noopAuthorizer allows every API request, so hardening with mTLS, claim mapping and an Authorizer is engineering time you must budget for.
  • Upgrade effort: Each minor upgrade is a recurring task that needs test time and a rollback plan.
  • Staffing: Someone must own on-call, capacity planning and incident response for the cluster.
  • Commercial support: The facts supplied do not describe a support contract for self-hosted Temporal, so ask Temporal directly whether one exists and what it covers.

Before comparing the license line with managed pricing, confirm who on your team owns upgrades and on-call for the cluster.

How identity integration differs when you self-host

Temporal ships with no access control by default, so your team must configure identity before anything else. If no Authorizer is configured, self-hosted Temporal uses the default noopAuthorizer, which allows every API request with no authentication or access control. You need to turn on mTLS, with separate settings for internode and frontend traffic, so that services and clients prove who they are. Then configure a ClaimMapper to map JWT or certificate claims to namespace roles, add an Authorizer plugin that enforces those roles, and enable OIDC single sign-on for the Web UI. Each of these is a configuration task owned by your team or your implementation partner, and none of them is switched on for you. Check the self-hosted security documentation against your identity provider before go-live, and test that an unauthenticated call to the frontend is refused.

Dapr controls access at the level of which application may call which workflow. Dapr workflows are managed through the API and the dapr workflow CLI, and access policies determine which applications may call which workflows. The identity of each caller is tied to its Dapr sidecar and the Kubernetes workload around it, so the practical questions are different from Temporal's. Confirm how the sidecar identity model fits your Kubernetes RBAC, your service account design and any service mesh you run, including whether mutual TLS between sidecars is handled by the mesh or by Dapr. Also confirm who may use the workflow CLI to suspend, terminate or purge running workflows, because those operations are as sensitive as the calls that start them.

Neither platform should be exposed to the public internet. The Temporal deployment documentation says Temporal services should run on hosts not reachable from the public internet, with network access restricted to trusted internal networks. Dapr workflows run beside your applications inside the cluster, so the same principle applies to any route that reaches the Dapr API or the Temporal frontend. Put network policies around both, and treat authentication as a second layer rather than a substitute for network isolation. Before you finalize the design, write down which identities can start, signal and terminate workflows, and have your security team review that list against your existing identity provider.

What drives running cost for each platform

Running cost for Temporal and Dapr Workflow comes from different places: a dedicated server cluster and its persistence store on one side, and the state store and sidecar footprint inside your existing Dapr estate on the other. The cards below separate infrastructure, people, upgrades, support and managed fees so you can ask each vendor or partner for the same breakdown.

Temporal server and persistence infrastructure

A self-hosted Temporal Service runs Frontend, History, Matching and Worker services, plus a persistence store and, for advanced visibility, a separate visibility store. Each of these is capacity you provision and pay for every month, whether it runs on your cloud account or in a data center. Persistence choice drives much of the bill, so check which database engine and version your team will operate and what backup and failover it needs.

Dapr sidecar and state store overhead

Dapr adds a sidecar next to each application, and Dapr Workflow stores each workflow actor's state in the configured actor state store. Your recurring cost is the extra CPU and memory per pod across the fleet plus the state store's capacity and throughput. If your platform already runs Dapr and a supported state store, the marginal cost may be small. Ask for the sidecar resource settings and the state store sizing assumptions in any estimate.

Engineering skills and staffing

Temporal asks your team to operate a stateful multi-service cluster and to write deterministic workflow code in the SDK language. Dapr asks for Kubernetes and Dapr component operations plus workflow code in one of its supported SDK languages. Most recurring labor goes to on-call coverage, upgrades and incident review, so count the staff who already know each stack and the training time for the rest.

Upgrade cadence and version work

Temporal Server should move one minor version at a time, starting with the latest patch of the current minor, and schema upgrades must run before server upgrades when the release notes call for them. Helm chart versions below 0.73.1 do not work with server images 1.30 and later. Dapr ships on its own release cadence, and in-flight workflow versioning is part of its feature set. Budget recurring test and rollout time for each upgrade window and ask each party how they test before production.

Support, implementation and one-time setup

Setup costs are mostly one-time: architecture, deployment, security configuration such as mTLS, authorization and SSO, and the first workflow migration. Vendor support, implementation partners and internal training are recurring or project-based decisions. Ask whether a quote covers hardening, backup testing and runbooks, and whether support hours and response commitments are written into the scope.

Managed service fees

Temporal Cloud moves server operations to the vendor and bills by usage, so the recurring cost depends on action volume and storage rather than on your servers. Dapr has no managed-service fee in the same sense, but a managed Kubernetes or state store service on your side carries its own charges. Compare a fully managed bill against your self-hosted run cost, including the people time you would no longer spend.

Moving workflows between Temporal and Dapr Workflow

This sequence gives platform teams a controlled path for moving durable workflows from one engine to the other without losing track of running executions. It ends with a cutover that both teams have verified against their own environment.

  1. Inventory running workflows and their versions

    The platform team lists every workflow type, every in-flight execution and the code version each one runs. For Temporal, this means the workflow types and task queues across each namespace. For Dapr Workflow, it means the workflow names, the applications that host them and the actor state store each one writes to. The output is a register that shows how many executions are open, how long they are expected to run and which versions they depend on. The step is done when the owning teams have signed off on the register.

  2. Decide whether in-flight executions drain or migrate

    For each workflow type, the architecture owner chooses one of two paths. Draining means the old engine keeps running existing executions until they finish, while new starts go to the new engine. Migrating means moving the work to the new engine, which requires rewriting the logic and deciding how to handle executions that are already partway through. Long-running workflows usually favor draining, while short ones may not justify the cost of running two engines. The decision is recorded per workflow type, and the step is complete when every type has a stated path.

  3. Confirm that code and histories do not transfer

    Workflow code written for Temporal's deterministic SDK model is not a drop-in source for Dapr Workflow, and the event history or actor state written by one engine cannot be loaded into the other. Both engines persist execution state in their own formats, so the team should treat history migration as a rewrite of the business logic rather than a data copy. Confirm this against each vendor's current documentation before committing to a plan, and record the version you checked. The step is done when the team has a written confirmation and a list of any open questions for the vendors.

  4. Rebuild workflow code in the target SDK

    Engineers reimplement each workflow in the target engine's language and programming model, using the Dapr workflow SDK for the language the application already uses. They separate business logic from orchestration and check that the logic that runs inside each step is idempotent, since retries will re-run it. Shared libraries and tests move with the code. The output is a tested branch of each workflow that passes the same business-level test cases as the original, and the step is done when those tests pass in a non-production environment.

  5. Map activities, retries and timers

    Each Temporal activity, retry policy, timer and child workflow is mapped to the closest equivalent in Dapr Workflow, such as activities, retry policies, durable timers and child workflows, as described in the Dapr workflow documentation. Where a Temporal feature has no direct equivalent, the team records a design decision and a compensating approach. Retry behavior is tested with forced failures, including crashes during a step. The step is complete when the mapping document is reviewed and each failure test produces the expected outcome.

  6. Align state storage and visibility expectations

    The team compares how each engine stores state and how operators find executions. Temporal uses its own persistence and visibility stores, which the team already runs in its self-hosted cluster. Dapr Workflow saves state through the actor state store configured for the application. Operators should confirm which dashboards, search queries and audit records they use today and whether the target engine provides the same view through the dapr workflow CLI or the API. Gaps become tickets with owners. The step is complete when every operator query has either a working equivalent or a documented gap.

  7. Cut over and verify

    The team switches new starts to the target engine, watches the drain of old executions and confirms that the old engine has no open work before decommissioning it. Rollback steps are rehearsed in advance, and access policies are checked so that only the intended applications can call the new workflows. The cutover is done when old executions have closed, rollback has been tested, and the owning teams confirm that business outcomes match the pre-migration baseline.

Where implementation projects usually run long

The longest stretches in a Temporal or Dapr Workflow project are rarely the first deployment. They are the sizing decisions made before go-live and the coding and rollout rules that must hold for years. On Temporal, persistence and visibility sizing comes first: the History and Matching services write to the persistence store, and advanced visibility needs its own store, with Elasticsearch or OpenSearch recommended once executions grow beyond a few. Ask your team to size these stores against expected execution volume and retention, and to confirm which tested database versions the Temporal persistence documentation lists for your chosen backend. Helm chart pinning also needs attention: chart versions below 0.73.1 do not work with server images 1.30 and later, so the chart version, server image and schema version should be pinned together in version control from day one.

Temporal's deterministic workflow code is the other long-running item. Workflow code is replayed from the event history after a failure, so changes to control flow, timers or activity ordering can break in-flight executions unless they are versioned. Plan a coding standard, a review gate for workflow changes and tests that replay recorded histories before each release. Upgrades add to this work: Temporal Server should move one minor version at a time, with schema upgrades run before server upgrades when release notes call for them.

On the Dapr side, the effort concentrates in the actor state store and the sidecar rollout. Dapr workflows keep each workflow actor's state, including its inbox, in the configured actor state store, so the store's choice, capacity, backup and access settings determine how safely workflows resume after a node failure. Confirm the store with your database owners and test a pod restart under load. Rolling out the sidecar across existing services, and deciding which applications may call which workflows through access policies, is usually a multi-team task. DeployOpen plans and implements these pieces inside your own cloud accounts or data centers, with scope, deliverables and timelines agreed in writing before work starts, so the open questions above can be settled in the statement of work rather than during the build.

Questions teams ask before choosing or hiring help

How much operating effort does self-hosted Temporal need compared with Dapr Workflow?

Self-hosted Temporal needs its own server cluster. A Temporal Service runs Frontend, History, Matching and Worker services, plus a persistence store and, for advanced visibility, a separate visibility store. You upgrade the server one minor version at a time, moving to the latest patch of the current minor first, and you run schema upgrades before server upgrades when the release notes call for them. Dapr Workflow adds no separate workflow cluster. It runs inside the Dapr sidecar beside each application and saves workflow state in the actor state store you already configure, so most of the effort sits in the Dapr runtime and that state store. Confirm the sizing, backup and upgrade routine for your own Kubernetes environment with your platform team before you compare effort in hours or headcount.

Can a team run self-hosted Temporal without Cassandra expertise?

Yes, if the team chooses PostgreSQL or MySQL instead of Cassandra. Temporal's persistence documentation lists tested versions of Cassandra 3.11, 4.0 and 5.0.4 or later, PostgreSQL 13 to 16, and MySQL 5.7 and 8.0.19 or later. Cassandra was tested as a persistence store, but Cassandra visibility was removed in version 1.24, so a Cassandra deployment must add a separate visibility store. Elasticsearch or OpenSearch is recommended for anything beyond a few workflow executions. SQLite is meant only for development and testing. A team without Cassandra skills should pick a relational store it already operates, then confirm with its database administrators that backup, failover and visibility needs are covered.

Is Dapr Workflow enough for a team already using Dapr?

It can be enough, provided your workflows fit what Dapr Workflow offers and your team accepts its actor-based design. Dapr Workflow supports task chaining, fan-out and fan-in, durable timers, retry policies, compensation, child workflows, external events and versioning of in-flight workflows. Workflow progress survives process crashes, pod restarts, node failures and rolling deployments. It is Apache-2.0 licensed and runs wherever Dapr runs. Where it may fall short is in areas the public material does not settle for your case, such as the depth of visibility tooling, the language SDKs you need and the operating model for your largest workflows. Test a representative workflow against your state store and your failure scenarios before deciding.

How does versioning of in-flight workflows work in Temporal and Dapr?

Dapr documents versioning of in-flight workflows as a supported capability, so running instances can continue while newer definitions are deployed. Temporal works differently because it replays each workflow from a complete, ordered event history. A change to workflow code can therefore break replay of executions already recorded, so teams use the versioning mechanisms in the Temporal SDK they choose. Ask the vendor or your engineers which mechanism applies to your language, how old histories are retired, and how long in-flight executions may run. Server upgrades follow a separate rule: move one minor version at a time, and run schema upgrades first when release notes require it. Replay recorded histories in continuous integration before each release.

What does a fixed-scope implementation engagement need from the client?

DeployOpen's engagements are mostly fixed-scope, so scope, deliverables and timelines are agreed in writing before work starts. An accurate scope depends on the client providing a list of workflows to build or migrate, the Kubernetes clusters and namespaces where they will run, the chosen persistence and identity providers, access to staging environments, named approvers, and the security requirements the platform must meet. The client also decides who owns on-call, upgrades and backups after handover. If ongoing support, upgrades or continuous testing are needed, they are available as retainers. Ask for a written list of assumptions and exclusions with any quote. DeployOpen does not publish a price list, so a quote follows from the written scope.

Can our team build and run this workflow platform internally?

Possibly, and skills matter more than tooling. A team that already runs Kubernetes, a relational database and Dapr in production has most of what Dapr Workflow needs. Temporal adds a server cluster, persistence and visibility stores, mTLS and authorization settings, and determinism rules that engineers must learn. The security documentation notes that a self-hosted Temporal Service with no Authorizer configured allows every API request, so someone must own that configuration and the network placement, which should keep Temporal services off the public internet. Map each component to a named owner, pilot one workflow, and decide whether outside help is needed for design, hardening, backup or ongoing upgrades.

How long does a durable workflow implementation project take?

The supplied material does not give a duration for this kind of project, so ask for one in the written scope rather than relying on a general figure. Timing usually depends on the number and complexity of workflows, whether existing jobs are migrated, the persistence and visibility choices, identity integration, the security testing and compliance evidence required, and how many environments must be built. Ask any provider for milestones tied to specific deliverables, the assumptions behind each one, and what the client must supply and approve at each gate. Also confirm which release line you will standardize on, since Temporal Server v1.32.1 was published on October 8, 2026 and Dapr v1.18.7 on October 9, 2026.

How DeployOpen helps choose, implement or migrate

DeployOpen plans, implements and supports self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. For a Temporal vs Dapr Workflow decision, we start from your Kubernetes estate, your existing Dapr use and the workflows you need to run, then build only what the written scope covers.

How we scope

  • Inventory which services already run Dapr sidecars and which state stores the actor runtime would use.
  • Document the workflows to be built, including retries, timers, external events and in-flight versioning needs.
  • Agree deliverables, timelines and responsibilities in writing before any work starts, as engagements are fixed-scope.
  • Confirm with Temporal or Dapr maintainers any feature, version or license point your environment depends on.

How we build

  • Deploy either option in your Kubernetes clusters, with Temporal's Helm charts or Dapr's runtime configured to your standards.
  • Configure persistence and visibility stores, and for Temporal, mTLS, authorization and OIDC single sign-on for the Web UI.
  • Write sample workflows in your chosen languages and test failure recovery, replay and rolling deployment behavior.
  • Run security testing against the workflow services and APIs before the platform carries production work.

How we hand over

  • Deliver runbooks covering upgrade order, schema migrations, backup of persistence stores and restore testing.
  • Document workflow ownership, access policies, namespace or application boundaries and the operational procedures your team will run.
  • Provide compliance-oriented evidence and control documentation for your assessors, noting that DeployOpen does not issue audit reports.
  • Walk your platform and development teams through operations, troubleshooting and the decision record behind the chosen engine.

How we support

  • Offer ongoing support, upgrades and continuous testing as a retainer after handover, scoped in writing.
  • Plan minor-version upgrades for the chosen engine and its persistence layer, one step at a time, with testing at each step.
  • Repeat security testing as workflows, languages and Dapr components change over the platform's lifetime.
  • Ask for a quote built from your written scope, since DeployOpen does not publish a price list.

Talk to our team.

Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.

  • 30-minute call: free, with no obligation.
  • NDA on request: we can sign before you share details.
  • Clear next steps: a scope and plan after the call.