Today we are releasing Cloudflare OS, a chatbot with connectors, just like every other tech company is doing.
Except actually, it's different. This is a remake of Sandstorm[.]io, my startup from 10 years ago, except this time built on Cloudflare Workers (the platform I've spent the last 9 years building) and deeply leveraging AI. This is more or less the culmination of my secret 10-year master plan.
This is a full-on personal app vibe coding platform, in which the sandbox is so secure that you can pretty much go wild -- the AI cannot introduce a significant security bug. We believe a company's security team can feel comfortable giving non-technical users permission to vibe code and then sleep soundly at night.
How is that possible? It's the Sandstorm security model, revisited. A "Gadget" is the same thing as a Sandstorm "Grain": a fine-grained app instance. For example, if you have a document editor app, each document runs as a separate instance of the app, in a separate sandbox (one "Gadget").
This means two things, both of which I think are Big Deals:
1. The platform can manage all access control, by controlling who can access the Gadget at all. There is no way the Gadget can accidentally leak itself to an attacker -- even an attacker who has access to other Gadgets based on the same app.
2. Since everyone is running their own copy of the code, everyone can freely modify their copy of the code.
Think about #2 a bit more.
What if, when you wanted a new feature in the software you are using, you could just prompt your agent to add it?
This doesn't work in the cloud Software-as-a-Service model, because you are not running your own copy of the app.
Sandstorm tried to change that 10 years ago, but the world wasn't ready, because not enough people had the skills or patience to actually modify their software. AI has changed that. Now you just ask the agent -- the same agent that you are using to help you interact with the Gadget can also modify the code of the Gadget.
This is really interesting. I built a similar product (not released yet), but it uses Kubernetes as the infrastructure layer instead of Cloudflare OS. I guess all these years later I am left with the same existential question that plagued Sandstorm. What is its relevance in the context of Linux containers? This is not a rhetorical question, is there a real benefit for a Sandstorm grain over a docker style Linux container? Does a containerized process not have all the same benefits of a Sandstorm grain, with the added benefit of not requiring any modifications of the containerized software?
One argument I could bring is that despite all its claims, OpenAI still had to switch from containers to MicroVMs because its agents under test still managed to break out from their containers. Is the security model of a Sandstorm grain so much better that agents wouldn't figure out how to break out of it?
Sandstorm's use of containers was just a means to an end. The real innovation was the fine-grained instances -- each document in its own container. No other container platform did that.
But honestly, it didn't work well, because of cold start times and memory usage. It's bad enough when a server takes seconds to start, but if every document you open has a long startup time and uses hundreds of MB of RAM, it's really painful.
In theory Wasm could be supported, but generally JS/TS is much more efficient when running inside isolates (our lightweight sandboxes) since you don't have to bundle a language runtime into the app. CFOS at present only exposes JS (with TS coming soon).
I'm making a whole new language to get around the problem you're talking about: it brings no runtime at all. One of my targets is a Sandstorm like system I've been slowly working on, but I'd love for it to be a fit for the actual Sandstorm successor.
I'm sorry but Workers is the technology that makes this all possible. I don't think I could have built this without Workers as a foundation. (I tried once, with Sandstorm, and like I said, it didn't work well.)
Sometimes you just can't advance the state of the art while also maintaining broad compatibility.
It's all open source, though. You can run the whole stack on your own machine.
For what it's worth, we also ran workerd inside a Sandstorm grain and not only did it work, it performed well. In the same way some people run Docker to run a single thing inside a VM solely for that thing... you can probably use workerd just to run a single Workers-based thing inside something else... and it'll probably work just swell.
Workers is a product and you're paid to develop and sell it as an employee.
I 100% understand the hustle. I do the same thing. I just don't trust a giant like Cloudflare that has done several things to weaken the open web and establish a position that is all too powerful. I don't want to give them an iota of support. Even using open source buys into their mindshare, distribution, ecosystem, and eventual supremacy and lock-in.
I'd buy this from a smaller company for sure. Just not from Google, AWS, Cloudflare.
If this was a YC startup I'd have given you my credit card info already.
I don't know what your stock in Cloudflare is like, but your upside would be way bigger building this externally. You'd probably raise an extremely large seed round.
Consider launching your own startup. Don't give Cloudflare all the upside.
Edit: I didn't realize you'd already responded. Was clarifying my position and wishes for this to not be something made by Cloudflare.
I tried it as a startup once, so I know what that's like. It's a lot of time spent running around begging for money (from investors and from customers) rather than building technology.
Workers is my startup-within-Cloudflare. It won't make me a billionaire, but it has still made me more money than I actually know what to do with, while being able to delegate all the stuff I don't like doing to other parts of the company that already do it quite well.
I have a lot of influence here. The CEO and CTO listen to me. E.g. I made my argument this all needed to be open source and self hostable, and they agreed enthusiastically.
I don't think I could build this better as a separate company.
I appreciate your extremely thoughtful answers. It greatly improves my perception and attitude about this.
I'll check it out.
I'm still anxious about the Cloudflare angle (and that's hard to shake), but beggars can't be choosers. You've legitimately built something cool and done a fantastic job spearheading that.
Thank you for the kind and well stated response. Sounds like you've had a lot of fun building this too.
I don’t think containers, as normally used, provide that much security because so much of what you want to secure is at the boundaries between containers (the network) rather than inside the container itself.
There’s not much point in preventing hyper visor escape style exploits if the agent can just SSH or psql log in to an adjacent container. Likewise there are near infinite ways to do weird things with the network to make stuff happen in another less controlled environment (eg sign up for AWS free account, make VM, do everything on that VM where controls don’t apply).
There are tools to do this, but I’ve never seen anyone package them up in a way that was pleasant to interact with. It’s got the SELinux problem of being useful, but annoying enough that everyone just disables it the second it gets in the way. It’s surprisingly hard to manage what should be able to connect to what as you start scaling out the number of things on the network. Whoops, you forgot that random software embeds its own DNS over HTTPS resolver so the normal DNS profile won’t work and everything crashed kind of issues.
Linux namespaces, and containers, are not security features in themselves. They end up having to be combined with SECCOMP and some sort of application kernel or SELinux in order to have an effective security apparatus. This is before you give it application aware security controls like policy.
It has real business value. Letting non technical users run wild without the onerous layers of controls in traditional enterprise IT.
We're already contending with users wanting to hook up every SaaS MCP to every other SaaS platform and then slap AI on top. Having a controlled sandbox for that would hugely simplify things.
> is there a real benefit for a Sandstorm grain over a docker style Linux container?
Linux containers are meant to be used by those with significant software engineering skills. Sandstorm was designed to be used, once installed by someone else, by grandma.
The article posted buries the lead. Cloudflare OS reads like almost any other AI knowledge base until midway when apps are introduced and then becomes overly technical with a code snippet.
Launching just recently and having to think about how i'm marketing things more and more, the hardest parts to really market are the AI related features.
Most of the real value AI provides isn't flashy its just eliminating the tedious work that sits between the interesting parts of a job: structuring messy data, extracting information from documents, validating it against references, filling out forms, routing it for approval, and preparing it for distribution.
The exciting work was already exciting. AI just removes the friction between point A and point D. That's alot harder to demonstrate than generating an image or writing a paragraph. "Look, here's all the data you no longer have to enter manually" isn't exactly a compelling marketing headline, even if it's where users save the most time.
I sometimes wonder who AI marketing is really for. The people who would benefit from eliminating repetitive work, or other technical people who want to see interesting AI demos.. A lot of product launches end up looking like "Here's a prompt that bootstraps X," when the bigger story is that the prompt replaces an hour of repetitive work that nobody wanted to do in the first place.
No one? Like literally, I don't understand a thing of what the blog post is saying. It's vague to the point of meaning nothing. Every piece of text I've seen that explains CloudflareOS is clear except the blog post.
I used to read their blog regularly because it had lots of interesting technical details. Lately, though, there’s less of that, and I can’t quite put my finger on what changed. My guess is that they realized how popular the blog had become and started using that attention more for advertising. There’s nothing wrong with that, but earlier the “advertisements” actually made me want to try things out and bring them back to my team. I even considered applying to work there. Not so much anymore. I’ve even removed it from my RSS feed.
I don’t like offering criticism without a solution, but I’m not really motivated to come up with one here. It looks like employees may read this, so maybe someone will see the feedback.
This matches my perception of a ton of recent Cloudflare blog posts. I literally have no idea who they are targeting. It almost feels like they're targeting themselves.
(Not meant as a nit-pick — it's just something that adds really fascinating historical colour to a useful expression, that people often mistakenly re-correct)
Not sure why you got downvoted on this one. You're right and you even turned it into a bit of language history. It's bury the lede, and now I know why.
I think it was fair. I added the bit in brackets to clarify because maybe it had come across as a nit-pick.
In my head there are corrections that are rude that I don't do, because I genuinely think authentic writing matters more and more, and because I am absolutely not above reproach where grammar and spelling is concerned.
Then there are things I think people would want to know, that are either in the intellectual-you-have-a-little-bit-of-pinach-in-your-teeth territory or in the "cool fact" territory, or somewhere hazy in between.
I figured if one is going to correctly use an expressive phrase like "bury the lede" that they've perhaps only ever heard someone say, they would absolutely want to know about the spelling quirk, because it fully makes it better.
Other people obviously read it differently and the downvote was a useful signal.
It's spelled "lede" so as not to be confused with "lead," as in the metal with which was used to print newspapers.
Since "lead" (as in beginning of a story) and "lead" (as in metal) were frequently used in print newsrooms, the spelling of one changed over time to reduce confusion.
There were a number of other language convolutions in newsrooms, such as "slug" which meant a piece of hot metal, and so was useful for describing a spent bullet, the very short text that served as a title for a particular story, and a section of metal letters on the printing press.
/Worked for two major newspaper companies back when printing newspapers was akin to printing money.
“TK” meaning “to come” is another one. “More TK” in particular is now a blogger affectation but it seems to have been a way to communicate to an editor that a story was so far incomplete, within the text of a submission, without the editor assuming the words “to come” were part of the story. And elsewhere it indicates a placeholder that needs a fact to be confirmed and filled in before publication.
Maybe it is my bubble, but the experience people are having with Anthropic particularly is motivating a big “get this stuff back under control” effort so while it may not be strategically optimal for Cloudflare the local hosting would prove more valuable to enterprises than maybe a few years back, even if presented as a backup plan.
Neat! How does that work with the AI Gateway portion? I see some references in the code but at a quick glance I can't tell if you can configure it to skip AI Gateway.
In the default configuration, you just plop your Anthropic/OpenAI/Gemini/Workers AI/ollama API keys into the UI and it talks to each provider directly.
That said, I would recommend AI Gateway, it has a lot of nice features. :)
Not yet, but that's an obvious direction to take things. :)
I'm really excited by the idea that this platform makes it safe to use blueprints that someone else vibe coded, without worrying about whether they checked it for security bugs, etc. Basically if the app works, it works. So yeah, there absolutely should be a marketplace so everyone can try everyone else's stuff.
BTW there are three blueprints installed automatically (docs, slides, sheets).
The blueprint is just code, it does not include data or capabilities.
It's, I suppose, possible that the agent added secrets to the code itself. Not, like, API keys -- the agent never sees those. But it could have extracted sensitive info and put it into code, perhaps?
We can implement restrictions on exporting blueprints from workspaces that have seen sensitive secrets, though this might be more annoying than useful. It's a tricky balance.
Thank you for your work over the years, sandstorm is a really interesting and inspiring piece of software. I'll certainly try to self-host CloudflareOS.
There is also qm with smol machines. I found this out the long way, by looking at the contributors to qm at https://github.com/yc-software/qm where I found BinSquare, the founder of smol machines. Then I found a tweet about a public instance of it where I could try out having it code something agentically - I'm in the replies here: https://x.com/binsquares/status/2083305704274976819
I guess the lock-in is to Cloudflare Workers, which is limited to JavaScript. I would in fact look into projects that are built around MicroVMs and WebAssembly. It seems Buzz would be happy to use smolmachines, or whatever. You'd have to roll your own permission system, but smolmachines would at least take care of being able to use stuff within an app, by offering persistent, portable containers.
Actually I think now I can finally say why this sandstorm.io with Cloudflare OS has lock-in. The promise is "you can pretty much go wild" and that you can hand it off to non-technical people to do that. Much as you squint, there is not a sophisticated access control system available to self-hosted users. There's a framework for building a sophisticated access control system, but that isn't the same as having something open source that you can self-host and let non technical users go wild.
However, this is cool. I just agree with you that Buzz sounds more interesting to me as someone who was into Sandstorm.
Ah, that changes the amount of work and the reward in the equation for attempting to self-host Cloudflare OS. And I knew that I could run WebAssembly manually inside of JavaScript, but it seems to be runnable directly too. What would help me to know further is how Cloudflare OS integrates its access control in that open source project, and if it is conveniently available to WebAssembly, Python, or Rust workers.
Of course, personal apps are more useful if they can connect to external services. Cloudflare OS introduces a "connector" system we call Gatekeepers. This is sort of like MCP (and MCP is supported as a kind of Gatekeeper), but with a lot more:
* Instead of exposing tools, a Gatekeeper exposes a Cap'n Web RPC API. That makes it appropriate for use by both agents (via code mode) and Gadgets.
* Gatekeepers integrate with the Cloudflare OS UI to provide inline audit logging and human-in-the-loop approvals for all side-effecting actions.
* When an action requires approval, the agent does not need to stop and wait for it. A Gatekeeper will simulate the outcome, allowing the agent to keep running and queue up more work. You can then approve everything in a batch at the end. Hopefully, this means you no longer feel the need to turn on auto-approve! (But you still can if you want.)
We have already built Gatekeepers for a huge number of services, from GitHub to Home Assistant. We've found, with the right skills, AI can basically crank these things out for any given API, solving the chicken-and-egg ecosystem problem. We are working on a "software factory" of sorts where you can input the API docs for your favorite service and get a well-written Gatekeeper. That's not quite ready yet -- so for now use the ones we provide or use the write-gatekeeper skill to write your own. You can add your own Gatekeepers to your personal deployment.
When you share a Gadget, we verify that anyone you share with also has direct permission to access each of the resources it is connected to (via the Gatekeeper system). Hence, no security bug in the Gadget itself could accidentally grant people access to things they don't already have.
Just like phishing websites, which are still a problem. I’m sure I’m being overly cautious, but this sounds like a recipe for data leaks with the low barrier to entry.
And if you want real life examples, every single LLM provider has gotten insane amounts of data shared to them, even if you have to approve.
> * When an action requires approval, the agent does not need to stop and wait for it. A Gatekeeper will simulate the outcome, allowing the agent to keep running and queue up more work. You can then approve everything in a batch at the end. Hopefully, this means you no longer feel the need to turn on auto-approve! (But you still can if you want.)
Can you say more about how you simulate outcomes of approvals? For example, if I need an approval to be granted permission to read a document, how could it simulate the document contents?
Reads are, however, limited to only the resources you have explicitly attached.
Moreover, since agents and gadgets run in a sandbox with essentially no access to the outside world except via approved channels (Gatekeepers), it's essentially not possible for the agent to leak secrets it has seen unless you approve a later write.
In fact, the system actually keeps track of everything the agent / gadget has observed to know if it is "tained", and can use that to flag later actions as dangerous, e.g. due to prompt injection or possible leaking of secrets. (This is still evolving, but all the groundwork is there.)
(Of course, this assumes you trust the LLM provider itself not to steal secrets from your prompts. Most LLM providers offer zero-data-retention options, but if you don't trust them you can also use a local LLM. We support ollama and will support others in time.)
The key aspect here is "when an action requires approval". i.e. an action which writes. Presumably you are granting the read access when firing this process off in the first place.
Interesting, so how does this work with regards to purposeful but naive changes? If, for example, we have a Notion integration, and a non-technical user can add a feature to it via prompt, would it be possible for them to accidentally add something that sends a bunch of internal-only proprietary data to Notion? Would this system prevent or flag that in some way?
Gatekeepers can specify the sensitivity of their data. A Gatekeeper can actually flag an observation (a read operation) as being so sensitive that the agent should be prohibited from writing anywhere else after having seen that.
This is what allowed us to connect Cloudflare OS to our own sensitive internal data sources, containing things like customer data, revenue info, etc. Once you connect to one of those, the system enforces no data can be shared out of it.
That said, the policies are a bit blunt right now, maybe overly restrictive. We're going to be evolving it further.
Oh, wow! This is a lot clearer to me. I've long had a soft spot in my heart about Sandstorm. Here's a comment[0] I made 11 years ago about what Sandstorm was, to me:
> I'm a web developer, but I can't really use my skills to provide an open source web app the way I'd like to. I'd like to build a small server-side budgeting app that people can use from their computers or phones to record expenses, but there's no way I can ask people to find a web host that lets them run rails, or set up a heroku account or whatever.
> So my only alternative would be to run the service myself, but then I'm storing other people's data, I have to worry about scaling if lots of people use it, and user accounts, and all this stuff.
> The idea of sandstorm is folks run this platform on their personal servers, and then it lets you browse an app store like interface and one-click install these server side apps. So I'd bundle up my budgeting rails app as a sandstorm package, and if someone wants to track their expenses from a variety of devices, they install the app. Now they're running it so the data is theirs, there's no scaling issues, and user authentication is provided by sandstorm.
It was a beautiful thing that tried to thread the needle between personal, self-hosted software and cloud-based "software as a service". I've long thought that "federated" software is the sweetspot, since it allows people to control software in more natural organizational units like families or communities, without being centrally controlled or devolving into the craziness that is "decentralized".
However, while the functionality of Cloudflare OS may be Sandstorm-inspired, I feel like it doesn't really have its soul. What a difference a decade makes! Here's another comment[1] from me 10 years ago about why I loved sandstorm, which begins:
> Oh no! I really believe sandstorm (or something like it) is what we need the future to be. Rather than having everything get sucked up into Google, Facebook, Apple, or these other few centralized services, imagine where everyone has a personal (or family, or church group or whatever) server, and they can one-click install their email apps, their document apps, etc.
These days Cloudflare has become one of the "Google, Facebook, Apple" that I mentioned. I'm still a fan of Cloudflare generally, and with kentonv behind this I absolutely have to try it out, but it doesn't have the open source, community-oriented charm that I think Sandstorm had.
edit: Oh, I didn't read far enough down the tweet chain:
> I am so proud to say, we are making this whole thing open source, Apache 2.0 license, no catch.
Hooray! Sandstorm's back on the menu, boys! This really does make me happy. I never should have doubted, ha.
For what it's worth we (the community still working on Sandstorm) are also about to release an updated version of Sandstorm. But also as someone who definitely will still be running Sandstorm at home, some of the Cloudflare OS stuff is super exciting to me, and probably well beyond what we'll tackle with Sandstorm any time soon. What Kenton's doing with gatekeepers is insanely cool.
How is this different than the capabilities which cowork by claude / chat gpt desktop apps now a days give in terms of core capabilities.
The fact that you can maybe fetch bugs from jira and present in the way you want is true for any of the agentic orchestrators, so is it really the USP ?
One difference I found against other orchestrators was that they work on a per seat billing model. Example if you have 10 team members who want access to a shared agent infrastructure, you would end up paying 10 * 20$ = 200$ per month while in this case it is probably just the AI and infrastructure bill that you have to spend, which probably might cross 200 dollars as well.
Cool. The gadgets/blueprints paradigm reminds me of Smalltalk or Lisp environments in a way -- you're shipping a messy thing, a packaged version of your own personal, always-evolving environment.
Natural language wrapper around programming. Sandboxing and controlling external interactions to minimize the cost of mistakes. As I see it, the core idea here is facilitating habitability (in the Richard P Gabriel sense) via abstracting software development and distribution in a way that allows non-programmers to engage.
I'm not sure LLMs are quite there with results/$ to fully support a personal computing revolution here. I suspect useful blueprints will largely be wrappers or reimplementations of software that is still primarily created and distributed outside of this environment.
But there's promise here, and it's cool.
Everytime I read about new things from Cloudflare they look really cool but I cannot shake the feeling of not wanting to use them for fear of lock-in, am I too paranoid?
It's the same code. The only thing it doesn't include is the global scheduling and orchestration, but you don't actually want that locally. (And honestly... that stuff is a bit of a beast.)
Durable Objects are fully supported by workerd (and Cloudflare OS uses them extensively).
There is, however, one catch currently: Durable Objects don't scale out well without the global scheduling. For running Cloudflare OS for one user, this is actually no big deal, but a company-wide instance might not work well.
wrangler is a development tool. You wouldn't want to run dev mode in production.
But workerd can be used directly without wrangler, and is production-capable in that format.
Unfortunately we did not have time to put together example configs for this before launch (I wish we could have delayed, it was out of my hands), but we will be doing so soon.
Cloudflare seems mature enough at this point that if you're willing to accept any kind of vendor lock-in, then accepting it through them is likely acceptable. I won't say they're on-par with the big cloud providers, but if they offer the services you need and you'd be willing to lock-in with AWS, etc., then they should be considered.
If you're generally opposed to any vendor lock-in, then Cloudflare is definitely a hard sell. Many of their services are pretty specific to their ecosystem and I imagine trying to keep things portable would be infeasible any many scenarios. Granted, this is true in a provider like AWS, too, if you were depending heavily on their proprietary, managed services. But there's definitely value in knowing that you can stick to "generic" services as much as possible in AWS and be able to move away relatively easily.
Cloudflare is definitely becoming a "real" cloud provider (I'd say their release of R2, for me, pushed them into the "serious contender" category), but they focus on pretty specific features that aren't very portable. This Cloudflare OS service is a good example of that. If it is exactly what you need, then it is worth checking out and taking on the risk of vendor lock-in. But if you're doing something where long-term planning and portability is important, then you'll have a hard time warranting even considering them.
Cloudflare OS does have the important risk-mitigating feature that you can fork it if the vendor becomes hostile to your interests. You can't really do that with managed services like Workers (workerd exists but isn't a drop-in replacement for the entire Workers platform).
Whether forking is economical depends, of course, on your scale and on how many others are in the same boat.
I was messing with a closed source tool from a vendor, and turns out they didn't support my use case (they were Mac only, I needed a Linux version. And I wanted it in a different programming language than they had used for maintenance and performance).
Pointed Fable and Sol at the binary and the symbols (most of the work was through http, to be fair), and a few hours later I had a fully functional version with additional features.
now of course the legality of that being closed source is iffy, but it was for personal use. In this case its open source. Need to run this on another platform ? You probably can get very far with a prompt or two.
Yes. Be locked in. It's better to go 100% and only pay the switch costs if you have to.
Developing abstractions to let you switch technologies has 2 costs: The actual development, and not fully utilizing a specific technology. Lots of people prefer pain in small doses because it can be rationalized as eventual payoff.
There are degrees of this decision, of course, but I would say most folks worry too much about this particular champagne problem.
That'd be fine if the decision just affected the decision-maker's system. But the secondary effects are that it binds the external users of that system to the vendor's ToS.
I feel exactly the same. The CF services I do use are DNS and R2. I'd be curious if there's a guide somewhere that lists their services through the lens of lock-in. For example, R2 is somewhat S3 compatible so it's less risky to use because I can swap providers.
They move pretty quick so they tend to ship a lot of product very quickly that have a lot of potentials. But they are very much MVPs, and you'll hit a lot of limitations that aren't always obvious at first blush. And then it can take years before they mature, at which point they'll pour a ton of resources and they'll go from useless to top tier in like 2 months.
It's really hard to tell.
The Vite plugin for Cloudflare Worker was one of those. It was really rough at first and I wasted hundreds of hours getting stuff working as advertised. And then in a week they fixed all the bugs.
AI Gateway is another. We used it at first because it seemed to check all the boxes, and turns out it had tons of limitations and almost none of the features of other offerings, with very few updates months+. And then recently they basically added all the features it was missing in a few weeks/months and now its good.
Agent SDK too, it was always behind with outdated dependencies and missing features all other agent frameworks had. And then one day they started iterating super fast and now its legitimately good.
You can never tell reading the docs, so you have to try it, curse because you only find the limitations once you're running the thing for real in production, abandon it, then a few months later its everything you could ever want.
I have a love hate relationship with Cloudflare. Mostly love, but still.
Same! What I tell people is that Cloudflare products can be extra beta, and you have use your nose to smell the future. Truly love hate as their ecosystem of interesting tools can be so tempting.
Yeah, with love the words "open source" mean a lot less here (de facto, of course not de jure) when the resulting open source product is entirely contingent on Cloudflare's PaaS.
And I think they suffer a little a little bit from their infrastructure being _comparatively_ unique. As providers go, they're on the harder end to replace with something else if you were to ever want to retarget your workloads.
Not at all too paranoid. Just like people figured out even with elastic everything, compute from Spot instances and all the other things we're supposed to do in AWS, the data out charges between AZ's and Region's still more than made up the cost savings for true resiliency. People are going to figure out relatively similar pricing traps in Cloudflare that are difficult to design around.
If you run an unindexed D1 query, then you get dinged for every row read. If you didn't properly perform scalability testing in non-production, then you'll never know this until you get a bill that you dissect to find out 5 million rows read for a 5 row result, if you even dig that far in the billing.
If you do not use the WebSocket Hibernation API with Durable Objects, then when you spin up a DO and hold open thousands of client WebSockets, you are being billed continuously for the entire time those connections are open—even if zero messages are being sent.
If you keep optimizing for payload size like many do by default but not event frequency (like poll a Worker every second instead of keeping a single stream open), it will show up unpleasantly in the billing.
If you treat KV like a transactional database keeping state, then be aware writes are expensive compared to reads. Pumping high-frequency write traffic into KV will result in exorbitant write operation costs and eventual consistency headaches. High-frequency state mutations belong in Durable Objects, not KV.
Batch your data to minimize request count, aggressively index your SQL queries to minimize row scans, and hibernate your idle persistent connections whenever you can. Doing all this will make your solutions cost efficient, but very locked into their ecosystem.
Cloudflare is just another corporation with greed in their eyes and if you don't design yourself to their puzzle than you're not welcomed.
This is an extra wall in walled garden land; another one you will need to jump if you want to break free. Another stab at gatekeeping the upcoming Ai era of the internet. It's no different to the playbook of Google, Apple, and Facebook of the 00's. So, no, you're not paranoid.
In the terms of security: My firefox on FreeBSD instantly triggers endless loops of "prove your human" on their turnstile. I can't use old handhelds of android and a single VPN triggers all. Anything that they don't see as "secure" you're denied from.
What is stopping Cloudflare from deeming your LLM as unsafe?
Scenario: You're ready to launch, you come up with the next best innovation for the next generation of Ai internet. Revolutionary and you're about to launch, blast off; wait. You're denied your launch because it threatens their service. The former: they like your idea more-so and clone it to become theirs.
Stories of above have all been posted on HN before. Startups have been sabotaged by rug-pulling of cloud providers. It is early-vendor lock-in and at it's best. Google & Co would be jealous; if they were not in bed with.
This will turn in to a netting of: Your Ai isn't using our service, so your Ai isn't allowed to interact with ours.
What does Cloudflare offer as a service? A turnstile to the Internet of Things and the difference this time is that you get to self-host your own corner on their patch of land with their ticket prices and access policy of.
Remember folks, no corporation gives a rat's ass about you. Internally, or externally, you're just another sheep to extract wool from.
"OS for work" - like, what does it mean? OS is operating system, it runs on a hardware and provides you to operate the system. I hate when companies destroy the English language with vibe invented terms.
An operating system manages access to shared hardware (disk, CPU, memory, networking, display, etc. on a single machine OS). MS-DOS mainly handled shared access to disk via a file system abstraction, hence the name. The naming of Cloudflare OS makes sense to me.
It doesn’t schedule tasks, doesn’t deal with physical memory, it doesn’t initialize hardware or interface with it on a low level. This is just an app that lives in user-space, nothing more.
Calling this an OS is like calling Gmail an OS.
It doesn’t make any sense.
But since OSes are notoriously difficult to define [1], half of America added AI slop to diets that were already repulsive to begin with, regurgitates the chyme, and passionately feeds it to their peers, you may even get away with it nowadays.
Well it sort of does. It allocates sandboxes and schedules apps in them. It handles loading code from storage and turning it into running programs with state.
> it doesn’t initialize hardware or interface with it on a low level.
Instead of devices it manages interfacing with external services (Gatekeepers are like drivers).
I didn't choose the name but I do think there's a fair analogy here even on a technical level.
This is not a traditional computer operating system. We use the term "operating system" in two senses:
- An operating system for the company to be productive with AI, in a way that is safe, so that the security team can sleep at night.
- An operating system for AI workloads, analogous to the sense in which a traditional operating system manages compute workloads.
It looks to me like they just wanted to distinguish their product from other AI agents/sandboxes, so they called it an OS to make it sound bigger and better.
Excluding vegetables from what convey “meat” was also not correct around 1300-1500. Definitions changes with usage and only time will tell the future of vegan steaks, meats, milks, sauvages, butters and other parties.
> food, nourishment, sustenance
> Narrower sense of "flesh of warm-blooded animals killed and used as food" is attested from c. 1300
I think because the idea of an "agent operating system" is starting to feel more and more inevitable. Since I can use AI to:
- Pull information from external sources
- Transform and/or augment that information
- Publish information
I almost do not need a traditional OS anymore. This obviously isn't entirely true: I still use it to interact directly with humans, and it's the way I access my LLM. For now.
Because AI enables a new layer more akin to an actual OS. But also because I imagine they all want all the things running through them and an OS is the widest net they can cast in that direction.
I'm mostly going off the tweet, it could be I just don't understand, but how do you managed shared data if everyone has their own copy of the code and they can add whatever features they want? I mean, I'm assuming that any sort of significant feature requires some sort of change to the data model, and even with a schema-less database you could have conflicts if two things use the same field name, for instance? Also what happens with updates? Like, part of IT is keeping people up to date, but if everyone has their own bespoke customizations how do you not clobber those?
Also the security story doesn't completely add up to me. Like, if I'm a user and I can just add features that I want, what's to stop me from placing data in there that's maybe covered under HIPPA or some other sensitive data (protected class, or even just stuff like authentication information)? Right now a small number of people need to think about data security, but this seems like it'd extend it to anyone? That kind of data, it's not just about "keeping it internal by default", there are a lot of rules around storing it at all.
I dunno, it kind of makes me think of when people suggest forking an open source project if the maintainers won't accept a suggestion. Sure, you can do that, and it does happen, but you're also basically signing up to maintain it for decades. I'm not sure if anyone wants to maintain Alice in accounting's very weird spreadsheet app 10 years after she's left the company?
(Again I'm not throwing shade, just trying to understand better)
E.g. if you're using a slide editor app, each slide deck you create is its own instance of the app, whose code can be independently modified.
The slide content and the code are kept together and sandboxed together.
Adding HIPPA data to the app is no different to adding it to the slide content. I suppose whether or not that is OK depends on a lot of things, but the same things apply to traditional PowerPoint. The fact that the code is modifiable doesn't change the situation, since those modifications are sandboxed and constrained to that one slide deck.
This represents a small part of what IT is worried about. Offer a beer and say the word "SharePoint" if you want the long version of where this could wind up.
The issue isn't letting end-users add features. The issue is twelve end-users customizing something that produces output, saving it, and now nobody can read it.
This can get solved. If it even gets a chance to gain traction (it should, though IT will of course push back). But let's not pretend we're there yet.
Indeed, at this point it's one of the most devalued terms in software. Every week I'm reading about some product calling itself "the Operating System for XYZ." It seems like it's what you do when "platform" just feels too modest. To me, if it's not bootable, calling your product an OS just reeks of marketing sleight of hand.
In some sense, it is.
Sandstorm called itself an OS too.
Arcan calls itself an Overlay-OS.
I think for any platform for general purpose computing that provides an application model that programs are written to target, it's close enough I don't mind. Ie: it makes sense for some end-user software to have a target for Windows, Linux, Sandstorm, etc.
& from the other side- what does Debian add that lets it call itself an OS? A set environment and package manager that software is specifically packaged for.
This is effectively a Codex/Claude app competitor. Good move from Cloudflare since it helps them sell their core infra offerings. I like the direction they’re going with access control.
The real question is, can Cloudflare become a equal or better OpenAI / Claude provider, while offering a vastly more robust platform than either?
I think the answer is yes, simply because both OAI and Anthropic leverage CF for their hosting today.
I used to meme back in 2008 (when Google docs first was becoming big) that "The problem has always been the sandbox". The problem Chrome and Firefox solved was the Sandbox - you can browse some random code across the web without worrying about getting hacked. The same problem has arisen today but now with AI agents.
There is likely to be huge winners in the AI space simply based on who can create the best way to contain AI agents and "expose AI value" safely.
So, that means even more pressure on OpenAI and Anthropic. I really don’t see how they will stay competitive long term. Cloudflare can offers way better product by integrating with the rest of their platform and offering a variety of models, including open models they host themselves
This is revolutionary stuff. It crystalises latent thoughts I've had about how to safely integrate agentic capability for serious work.
We're starting to see indifferently architected AI creep into every engineering tool, from requirements management to coding, MATLAB, EDA and Solidworks. At the same time we see LLMs orchestrating long running hacking campaigns that will leverage other agents and automation to propagate. We really need an architecture that can handle that complexity.
Kenton Varda hitting the ball out of the park again.
Well everyone is trying to create an environment where they can safely delegate tasks to agents.
I am no different, but my approach is a dedicated powerful computer on your desk rather than something in the cloud. I am calling it Tarvis AI (derived from TARS from Interstellar and Jarvis from Iron Man), more details here: https://tarvisai.com
I have tried many of the VM/cloud-based agent setups, and they either tend to be only novelties since you can’t do much with 2-4 vCPUs + limited RAM or they start racking up expensive cloud bills.
I realized that the underlying operating systems for AI have to be built from the ground up for agents instead of taking current OSes and taming them for agents. Not sure how much of that philosophy is followed by Cloudflare. Excited to see growth in this area.
In case anyone else is curious, local Gemma4 12B Q6 XL really struggles to make use of this for simple goals like a daily briefing after an MCP tool call. I don't think there's a simple artifact concept? Still early but confused.
I have a feeling we're all working towards the same thing, but with different frameworks and infra. The Cloudflare OS experience looks, to me, very much like what I created for myself with https://rcarmo.github.io/projects/piclaw (except that I rely on focusing different instances on different sets of skills and tooling, so only two have "Office" skills, for instance).
This is not a traditional computer operating system. We use the term "operating system" in two senses:
An operating system for the company to be productive with AI, in a way that is safe, so that the security team can sleep at night.
An operating system for AI workloads, analogous to the sense in which a traditional operating system manages compute workloads.
> An operating system for AI workloads, analogous to the sense in which a traditional operating system manages compute workloads.
They have really twisted the definition to fit their marketing here. Operating systems are what allow you to use hardware to interact with software. Their product does nothing comparable to that at all.
this is a cool idea, but i suspect will be limited in use cases. the vast majority of people don't want or can't modify their software competently and will rely on others to do that. once you're relying on someone else, they do not want to maintain different copies for every user, that sounds like a maintenance nightmare for admins or else such a new paradigm that it takes a new generation of admins 20 years to get comfortable.
> Cloudflare OS is available today and is open source. Check out the cloudflare-os GitHub repository. You can deploy it into your own Cloudflare account and use your own Access policies, AI Gateway configuration, data, and integrations.
It's open source, but it is so incredibly tied to their platform, that there is no vendor portability, which has made almost every of their product launches post-Workers kind of meh.
I can't help but wonder if these things that are now emerging have a sort of "borrowed time" component tied to them.
I see the examples, and they clearly tackle both organizational inefficiencies and human connection/communication as the core problems.
Sounds like things are converging to "my AI will talk to your AI" and the role of humans will just be a human "router" in the loop switching up nodes in a graph, like the return of Switchboard Operators from the 1950s.
Seems like a good candidate to replace my home-grown llama.cpp web UI clone. This comment used to be a gripe about their provider UX not giving an example URL (realized /v1 is expected as the final segment).
Setting up your public URLRetrying… (attempt 5 of 6)
Fingers crossed!! The last one gotta be the one...
EDIT: It let me down... (Something unexpected went wrong on our side.)
Please let me now if deploying it on your custom domain worked for you please...
EDIT: Retrying it now worked but I had to subscribe to R2 (which is free for 10GB apparently). However, after that it will tell you that you need to enable the Dynamic Workers which is actually paid...
"Your Cloudflare account is on the Free plan, but the Cloudflare OS backend needs Dynamic Workers, which requires the Workers Paid plan."
Engineers should be wary about being forced into using particular prompts/skills/instructions.
Why would I use a shared LLM-in-the-cloud, instead of my own? The shared one precludes any possibility to customize or differentiate my workflow, prompts, or skills. As an employee that sounds like a death sentence to doing my job effectively.
Everyone is building these same looking apps that look like Codex, Claude desktop. We don't need these. Slackbots work more than well enough to collaborate with agents.
Im having a hard time figuring out what the intended user interface is here. The screenshots im seeing makes this look to be an electron app, but the repo seems to be implying that this is a deployed web app.
If this is just another librechat I'll be disappointed, and frustrated- because this is so 5 months ago.
Does this beat self-stewarding my data, and placing relevant protections around my data instead.
Then the UI's, the "Apps", are just ephemeral instances over my live data whose permission I am consistently setting or reviewing.
I feel like that more accurately represents a "person" behind the data: when I am producing, creating and expressing in real life, I do not ask some intermediary 3rd-party for permission to access my voice and my output. I just produce and let whatever gets created be made there in the physical environment or in someone's head. Today's apps (edit: & cloudflare's direction here) feel more like "The moment I express or generate something, I lease it's output from someone else and ask for their permission to access my output".
This is the middle of Cloudflare's "Agents Week"... and I believe they had an Agents Week last year. We're like... at least a year or two into Cloudflare being in the AI party. ;)
Stay away, I had bad experience myself, I'm sure there is something better out there. For me I ended up asking Claude to build a custom RAG pipeline, took an afternoon and is 10x faster.
I liked Kenton's take on this: https://x.com/KentonVarda/status/2084990137180590572?s=20
Text from tweet:
Today we are releasing Cloudflare OS, a chatbot with connectors, just like every other tech company is doing.
Except actually, it's different. This is a remake of Sandstorm[.]io, my startup from 10 years ago, except this time built on Cloudflare Workers (the platform I've spent the last 9 years building) and deeply leveraging AI. This is more or less the culmination of my secret 10-year master plan.
This is a full-on personal app vibe coding platform, in which the sandbox is so secure that you can pretty much go wild -- the AI cannot introduce a significant security bug. We believe a company's security team can feel comfortable giving non-technical users permission to vibe code and then sleep soundly at night.
How is that possible? It's the Sandstorm security model, revisited. A "Gadget" is the same thing as a Sandstorm "Grain": a fine-grained app instance. For example, if you have a document editor app, each document runs as a separate instance of the app, in a separate sandbox (one "Gadget").
This means two things, both of which I think are Big Deals: 1. The platform can manage all access control, by controlling who can access the Gadget at all. There is no way the Gadget can accidentally leak itself to an attacker -- even an attacker who has access to other Gadgets based on the same app. 2. Since everyone is running their own copy of the code, everyone can freely modify their copy of the code.
Think about #2 a bit more.
What if, when you wanted a new feature in the software you are using, you could just prompt your agent to add it?
This doesn't work in the cloud Software-as-a-Service model, because you are not running your own copy of the app.
Sandstorm tried to change that 10 years ago, but the world wasn't ready, because not enough people had the skills or patience to actually modify their software. AI has changed that. Now you just ask the agent -- the same agent that you are using to help you interact with the Gadget can also modify the code of the Gadget.
And it is so fun.
This is really interesting. I built a similar product (not released yet), but it uses Kubernetes as the infrastructure layer instead of Cloudflare OS. I guess all these years later I am left with the same existential question that plagued Sandstorm. What is its relevance in the context of Linux containers? This is not a rhetorical question, is there a real benefit for a Sandstorm grain over a docker style Linux container? Does a containerized process not have all the same benefits of a Sandstorm grain, with the added benefit of not requiring any modifications of the containerized software?
One argument I could bring is that despite all its claims, OpenAI still had to switch from containers to MicroVMs because its agents under test still managed to break out from their containers. Is the security model of a Sandstorm grain so much better that agents wouldn't figure out how to break out of it?
Sandstorm's use of containers was just a means to an end. The real innovation was the fine-grained instances -- each document in its own container. No other container platform did that.
But honestly, it didn't work well, because of cold start times and memory usage. It's bad enough when a server takes seconds to start, but if every document you open has a long startup time and uses hundreds of MB of RAM, it's really painful.
Cloudflare OS doesn't use containers. It uses Dynamic Workers, which are 100x more efficient: https://blog.cloudflare.com/dynamic-workers/
So the stuff I have been building in Workers for the past 9 years turns out to be the thing that Sandstorm needed all along. What a coincidence. :)
dumb question: is this javascript/typescript only? can you use webassembly based languages instead?
In theory Wasm could be supported, but generally JS/TS is much more efficient when running inside isolates (our lightweight sandboxes) since you don't have to bundle a language runtime into the app. CFOS at present only exposes JS (with TS coming soon).
Please add Wasm support :)
I'm making a whole new language to get around the problem you're talking about: it brings no runtime at all. One of my targets is a Sandstorm like system I've been slowly working on, but I'd love for it to be a fit for the actual Sandstorm successor.
This is far too Cloudflare flavored to be interesting to me.
It's using Workers (capital W) and the core Cloudflare primitives.
I don't feel safe building on this or touching this.
I'd be happier if a startup or neutral party built this in a more agnostic way.
I'm sorry but Workers is the technology that makes this all possible. I don't think I could have built this without Workers as a foundation. (I tried once, with Sandstorm, and like I said, it didn't work well.)
Sometimes you just can't advance the state of the art while also maintaining broad compatibility.
It's all open source, though. You can run the whole stack on your own machine.
For what it's worth, we also ran workerd inside a Sandstorm grain and not only did it work, it performed well. In the same way some people run Docker to run a single thing inside a VM solely for that thing... you can probably use workerd just to run a single Workers-based thing inside something else... and it'll probably work just swell.
Workers is a product and you're paid to develop and sell it as an employee.
I 100% understand the hustle. I do the same thing. I just don't trust a giant like Cloudflare that has done several things to weaken the open web and establish a position that is all too powerful. I don't want to give them an iota of support. Even using open source buys into their mindshare, distribution, ecosystem, and eventual supremacy and lock-in.
I'd buy this from a smaller company for sure. Just not from Google, AWS, Cloudflare.
If this was a YC startup I'd have given you my credit card info already.
I don't know what your stock in Cloudflare is like, but your upside would be way bigger building this externally. You'd probably raise an extremely large seed round.
Consider launching your own startup. Don't give Cloudflare all the upside.
Edit: I didn't realize you'd already responded. Was clarifying my position and wishes for this to not be something made by Cloudflare.
I tried it as a startup once, so I know what that's like. It's a lot of time spent running around begging for money (from investors and from customers) rather than building technology.
Workers is my startup-within-Cloudflare. It won't make me a billionaire, but it has still made me more money than I actually know what to do with, while being able to delegate all the stuff I don't like doing to other parts of the company that already do it quite well.
I have a lot of influence here. The CEO and CTO listen to me. E.g. I made my argument this all needed to be open source and self hostable, and they agreed enthusiastically.
I don't think I could build this better as a separate company.
I appreciate your extremely thoughtful answers. It greatly improves my perception and attitude about this.
I'll check it out.
I'm still anxious about the Cloudflare angle (and that's hard to shake), but beggars can't be choosers. You've legitimately built something cool and done a fantastic job spearheading that.
Thank you for the kind and well stated response. Sounds like you've had a lot of fun building this too.
My approach has been an interpreted Lisp running on a web server backend and it basically does everything described here
I don’t think containers, as normally used, provide that much security because so much of what you want to secure is at the boundaries between containers (the network) rather than inside the container itself.
There’s not much point in preventing hyper visor escape style exploits if the agent can just SSH or psql log in to an adjacent container. Likewise there are near infinite ways to do weird things with the network to make stuff happen in another less controlled environment (eg sign up for AWS free account, make VM, do everything on that VM where controls don’t apply).
There are tools to do this, but I’ve never seen anyone package them up in a way that was pleasant to interact with. It’s got the SELinux problem of being useful, but annoying enough that everyone just disables it the second it gets in the way. It’s surprisingly hard to manage what should be able to connect to what as you start scaling out the number of things on the network. Whoops, you forgot that random software embeds its own DNS over HTTPS resolver so the normal DNS profile won’t work and everything crashed kind of issues.
Linux namespaces, and containers, are not security features in themselves. They end up having to be combined with SECCOMP and some sort of application kernel or SELinux in order to have an effective security apparatus. This is before you give it application aware security controls like policy.
It has real business value. Letting non technical users run wild without the onerous layers of controls in traditional enterprise IT.
We're already contending with users wanting to hook up every SaaS MCP to every other SaaS platform and then slap AI on top. Having a controlled sandbox for that would hugely simplify things.
> is there a real benefit for a Sandstorm grain over a docker style Linux container?
Linux containers are meant to be used by those with significant software engineering skills. Sandstorm was designed to be used, once installed by someone else, by grandma.
That should have been the announcement.
The article posted buries the lead. Cloudflare OS reads like almost any other AI knowledge base until midway when apps are introduced and then becomes overly technical with a code snippet.
We really struggled with how to present this to multiple audiences at once.
My tweet thread, and the GitHub readme, is really the presentation intended for the HN crowd. The blog post is for a different audience.
https://github.com/cloudflare/cloudflare-os
Launching just recently and having to think about how i'm marketing things more and more, the hardest parts to really market are the AI related features. Most of the real value AI provides isn't flashy its just eliminating the tedious work that sits between the interesting parts of a job: structuring messy data, extracting information from documents, validating it against references, filling out forms, routing it for approval, and preparing it for distribution. The exciting work was already exciting. AI just removes the friction between point A and point D. That's alot harder to demonstrate than generating an image or writing a paragraph. "Look, here's all the data you no longer have to enter manually" isn't exactly a compelling marketing headline, even if it's where users save the most time.
I sometimes wonder who AI marketing is really for. The people who would benefit from eliminating repetitive work, or other technical people who want to see interesting AI demos.. A lot of product launches end up looking like "Here's a prompt that bootstraps X," when the bigger story is that the prompt replaces an hour of repetitive work that nobody wanted to do in the first place.
> The blog post is for a different audience.
No one? Like literally, I don't understand a thing of what the blog post is saying. It's vague to the point of meaning nothing. Every piece of text I've seen that explains CloudflareOS is clear except the blog post.
I used to read their blog regularly because it had lots of interesting technical details. Lately, though, there’s less of that, and I can’t quite put my finger on what changed. My guess is that they realized how popular the blog had become and started using that attention more for advertising. There’s nothing wrong with that, but earlier the “advertisements” actually made me want to try things out and bring them back to my team. I even considered applying to work there. Not so much anymore. I’ve even removed it from my RSS feed.
I don’t like offering criticism without a solution, but I’m not really motivated to come up with one here. It looks like employees may read this, so maybe someone will see the feedback.
https://blog.cloudflare.com/three-chapters-at-cloudflare-pro...
TL;DR; jgc stopped editing the blog, and AI slop took over:
> Today, after more than 13 years at the company, I am joining Cloudflare’s board of directors and retiring from my full-time position as CTO.
> ...
> I wrote for, and edited, the Cloudflare Blog for many, many years
This matches my perception of a ton of recent Cloudflare blog posts. I literally have no idea who they are targeting. It almost feels like they're targeting themselves.
Random trivia (and something I learned this way myself from an internet reply, though I can't remember when):
What gets buried is the "lede". It is a really unusual thing — a deliberate, engineered misspelling of "lead" that leaked into broader use:
https://www.merriam-webster.com/wordplay/bury-the-lede-versu...
(Not meant as a nit-pick — it's just something that adds really fascinating historical colour to a useful expression, that people often mistakenly re-correct)
Not sure why you got downvoted on this one. You're right and you even turned it into a bit of language history. It's bury the lede, and now I know why.
I think it was fair. I added the bit in brackets to clarify because maybe it had come across as a nit-pick.
In my head there are corrections that are rude that I don't do, because I genuinely think authentic writing matters more and more, and because I am absolutely not above reproach where grammar and spelling is concerned.
Then there are things I think people would want to know, that are either in the intellectual-you-have-a-little-bit-of-pinach-in-your-teeth territory or in the "cool fact" territory, or somewhere hazy in between.
I figured if one is going to correctly use an expressive phrase like "bury the lede" that they've perhaps only ever heard someone say, they would absolutely want to know about the spelling quirk, because it fully makes it better.
Other people obviously read it differently and the downvote was a useful signal.
It's spelled "lede" so as not to be confused with "lead," as in the metal with which was used to print newspapers.
Since "lead" (as in beginning of a story) and "lead" (as in metal) were frequently used in print newsrooms, the spelling of one changed over time to reduce confusion.
There were a number of other language convolutions in newsrooms, such as "slug" which meant a piece of hot metal, and so was useful for describing a spent bullet, the very short text that served as a title for a particular story, and a section of metal letters on the printing press.
/Worked for two major newspaper companies back when printing newspapers was akin to printing money.
“TK” meaning “to come” is another one. “More TK” in particular is now a blogger affectation but it seems to have been a way to communicate to an editor that a story was so far incomplete, within the text of a submission, without the editor assuming the words “to come” were part of the story. And elsewhere it indicates a placeholder that needs a fact to be confirmed and filled in before publication.
Sandstorm without self hosting has no interest though. (Edit: see below, where the creator states it _can_ be run locally)
Buzz looks like a more reasonable direction than this does.
What do you mean? This is 100% open source and self-hostable!
https://github.com/cloudflare/cloudflare-os
It runs on the open source Workers Runtime:
https://github.com/cloudflare/workerd
You can run it at home if you want. There's even a Home Assistant Gatekeeper.
So you can run it off the public internet with no sneaky external dependency on cloudflare, slack etc?
And it would be functionally the same? With the same performance if you put enough hardware there?
If so cool, and that should have been clearly in the announcement, because as it sounded it is “I am a sucker, lock me in!”
> So you can run it off the public internet with no sneaky external dependency on cloudflare, slack etc?
Yes. It even supports ollama and works decently well with some local LLMs.
> And it would be functionally the same? With the same performance if you put enough hardware there?
Honestly it is faster running locally.
> If so cool, and that should have been clearly in the announcement,
We had so many things we wanted to say, it was hard to fit them all into one story.
The blog post is for an enterprise audience. My tweet thread is for the hacker audience.
That is actually cool.
Maybe it is my bubble, but the experience people are having with Anthropic particularly is motivating a big “get this stuff back under control” effort so while it may not be strategically optimal for Cloudflare the local hosting would prove more valuable to enterprises than maybe a few years back, even if presented as a backup plan.
Neat! How does that work with the AI Gateway portion? I see some references in the code but at a quick glance I can't tell if you can configure it to skip AI Gateway.
Use of Cloudflare AI Gateway is optional.
In the default configuration, you just plop your Anthropic/OpenAI/Gemini/Workers AI/ollama API keys into the UI and it talks to each provider directly.
That said, I would recommend AI Gateway, it has a lot of nice features. :)
You're not alone The name "cloudflare-os" by itself made me think this was heavily based on Cloudflare
Do you have a store/list of public blueprints like sandstorm?
Not yet, but that's an obvious direction to take things. :)
I'm really excited by the idea that this platform makes it safe to use blueprints that someone else vibe coded, without worrying about whether they checked it for security bugs, etc. Basically if the app works, it works. So yeah, there absolutely should be a marketplace so everyone can try everyone else's stuff.
BTW there are three blueprints installed automatically (docs, slides, sheets).
Couldn't the blueprint exfiltrate incoming data to an external location for example?
Blueprints shouldn't (if I know anything about Kenton) have access to the Internet/external locations without you granting it permission to.
The blueprint is just code, it does not include data or capabilities.
It's, I suppose, possible that the agent added secrets to the code itself. Not, like, API keys -- the agent never sees those. But it could have extracted sensitive info and put it into code, perhaps?
We can implement restrictions on exporting blueprints from workspaces that have seen sensitive secrets, though this might be more annoying than useful. It's a tricky balance.
Thank you for your work over the years, sandstorm is a really interesting and inspiring piece of software. I'll certainly try to self-host CloudflareOS.
Yes, just like SaaS was a limitation to it's utility, PaaS is still a limitation, just on a different level.
There is also qm with smol machines. I found this out the long way, by looking at the contributors to qm at https://github.com/yc-software/qm where I found BinSquare, the founder of smol machines. Then I found a tweet about a public instance of it where I could try out having it code something agentically - I'm in the replies here: https://x.com/binsquares/status/2083305704274976819
I guess the lock-in is to Cloudflare Workers, which is limited to JavaScript. I would in fact look into projects that are built around MicroVMs and WebAssembly. It seems Buzz would be happy to use smolmachines, or whatever. You'd have to roll your own permission system, but smolmachines would at least take care of being able to use stuff within an app, by offering persistent, portable containers.
Actually I think now I can finally say why this sandstorm.io with Cloudflare OS has lock-in. The promise is "you can pretty much go wild" and that you can hand it off to non-technical people to do that. Much as you squint, there is not a sophisticated access control system available to self-hosted users. There's a framework for building a sophisticated access control system, but that isn't the same as having something open source that you can self-host and let non technical users go wild.
However, this is cool. I just agree with you that Buzz sounds more interesting to me as someone who was into Sandstorm.
Workers also supports Python, Rust and anything via WebAssembly (Go, C, etc)
Ah, that changes the amount of work and the reward in the equation for attempting to self-host Cloudflare OS. And I knew that I could run WebAssembly manually inside of JavaScript, but it seems to be runnable directly too. What would help me to know further is how Cloudflare OS integrates its access control in that open source project, and if it is conveniently available to WebAssembly, Python, or Rust workers.
> the sandbox is so secure that you can pretty much go wild -- the AI cannot introduce a significant security bug.
This can only be correct when the application can’t affect anything outside the sandbox. Which would significantly restrict useful applications.
See my next tweet in the chain:
https://x.com/KentonVarda/status/2084990302784307363
-------------
Of course, personal apps are more useful if they can connect to external services. Cloudflare OS introduces a "connector" system we call Gatekeepers. This is sort of like MCP (and MCP is supported as a kind of Gatekeeper), but with a lot more:
* Instead of exposing tools, a Gatekeeper exposes a Cap'n Web RPC API. That makes it appropriate for use by both agents (via code mode) and Gadgets.
* Gatekeepers integrate with the Cloudflare OS UI to provide inline audit logging and human-in-the-loop approvals for all side-effecting actions.
* When an action requires approval, the agent does not need to stop and wait for it. A Gatekeeper will simulate the outcome, allowing the agent to keep running and queue up more work. You can then approve everything in a batch at the end. Hopefully, this means you no longer feel the need to turn on auto-approve! (But you still can if you want.)
We have already built Gatekeepers for a huge number of services, from GitHub to Home Assistant. We've found, with the right skills, AI can basically crank these things out for any given API, solving the chicken-and-egg ecosystem problem. We are working on a "software factory" of sorts where you can input the API docs for your favorite service and get a well-written Gatekeeper. That's not quite ready yet -- so for now use the ones we provide or use the write-gatekeeper skill to write your own. You can add your own Gatekeepers to your personal deployment.
Or more directly:
When you share a Gadget, we verify that anyone you share with also has direct permission to access each of the resources it is connected to (via the Gatekeeper system). Hence, no security bug in the Gadget itself could accidentally grant people access to things they don't already have.
But that is a problem. I have access to something deeply secret, I run a gadget, it reads that and sends it to whoever made it
No, a Gadget does not just get automatic access to your data. It only gets access to the things you grant it explicitly.
Just like phishing websites, which are still a problem. I’m sure I’m being overly cautious, but this sounds like a recipe for data leaks with the low barrier to entry.
And if you want real life examples, every single LLM provider has gotten insane amounts of data shared to them, even if you have to approve.
> * When an action requires approval, the agent does not need to stop and wait for it. A Gatekeeper will simulate the outcome, allowing the agent to keep running and queue up more work. You can then approve everything in a batch at the end. Hopefully, this means you no longer feel the need to turn on auto-approve! (But you still can if you want.)
Can you say more about how you simulate outcomes of approvals? For example, if I need an approval to be granted permission to read a document, how could it simulate the document contents?
Reads do not require approval. Only writes do.
Reads are, however, limited to only the resources you have explicitly attached.
Moreover, since agents and gadgets run in a sandbox with essentially no access to the outside world except via approved channels (Gatekeepers), it's essentially not possible for the agent to leak secrets it has seen unless you approve a later write.
In fact, the system actually keeps track of everything the agent / gadget has observed to know if it is "tained", and can use that to flag later actions as dangerous, e.g. due to prompt injection or possible leaking of secrets. (This is still evolving, but all the groundwork is there.)
(Of course, this assumes you trust the LLM provider itself not to steal secrets from your prompts. Most LLM providers offer zero-data-retention options, but if you don't trust them you can also use a local LLM. We support ollama and will support others in time.)
The key aspect here is "when an action requires approval". i.e. an action which writes. Presumably you are granting the read access when firing this process off in the first place.
Interesting, so how does this work with regards to purposeful but naive changes? If, for example, we have a Notion integration, and a non-technical user can add a feature to it via prompt, would it be possible for them to accidentally add something that sends a bunch of internal-only proprietary data to Notion? Would this system prevent or flag that in some way?
Gatekeepers can specify the sensitivity of their data. A Gatekeeper can actually flag an observation (a read operation) as being so sensitive that the agent should be prohibited from writing anywhere else after having seen that.
This is what allowed us to connect Cloudflare OS to our own sensitive internal data sources, containing things like customer data, revenue info, etc. Once you connect to one of those, the system enforces no data can be shared out of it.
That said, the policies are a bit blunt right now, maybe overly restrictive. We're going to be evolving it further.
Thank you. The tweet values the readers time. The blog post. Dear lord. So much noise.
This was a great summation.
>This doesn't work in the cloud Software-as-a-Service model, because you are not running your own copy of the app.
Let me introduce you to scrapling+MCP--the closest I've come.
Stealthed, controllable browser gives you an API to arbitrary web things
You can't modify it, but you can extend it which imo is the next best thing
adb (Android) is close albeit a bit more tedious. It's fun watching an LLM take screenshots, read them, then send input events back to the phone.
If you have a rooted Android, you _can_ modify the apps. Xposed, ReVanced, et al subject to Play Integrity's ever growing pervasiveness
https://xcancel.com/KentonVarda/status/2084990137180590572
Oh, wow! This is a lot clearer to me. I've long had a soft spot in my heart about Sandstorm. Here's a comment[0] I made 11 years ago about what Sandstorm was, to me:
> I'm a web developer, but I can't really use my skills to provide an open source web app the way I'd like to. I'd like to build a small server-side budgeting app that people can use from their computers or phones to record expenses, but there's no way I can ask people to find a web host that lets them run rails, or set up a heroku account or whatever.
> So my only alternative would be to run the service myself, but then I'm storing other people's data, I have to worry about scaling if lots of people use it, and user accounts, and all this stuff.
> The idea of sandstorm is folks run this platform on their personal servers, and then it lets you browse an app store like interface and one-click install these server side apps. So I'd bundle up my budgeting rails app as a sandstorm package, and if someone wants to track their expenses from a variety of devices, they install the app. Now they're running it so the data is theirs, there's no scaling issues, and user authentication is provided by sandstorm.
It was a beautiful thing that tried to thread the needle between personal, self-hosted software and cloud-based "software as a service". I've long thought that "federated" software is the sweetspot, since it allows people to control software in more natural organizational units like families or communities, without being centrally controlled or devolving into the craziness that is "decentralized".
However, while the functionality of Cloudflare OS may be Sandstorm-inspired, I feel like it doesn't really have its soul. What a difference a decade makes! Here's another comment[1] from me 10 years ago about why I loved sandstorm, which begins:
> Oh no! I really believe sandstorm (or something like it) is what we need the future to be. Rather than having everything get sucked up into Google, Facebook, Apple, or these other few centralized services, imagine where everyone has a personal (or family, or church group or whatever) server, and they can one-click install their email apps, their document apps, etc.
These days Cloudflare has become one of the "Google, Facebook, Apple" that I mentioned. I'm still a fan of Cloudflare generally, and with kentonv behind this I absolutely have to try it out, but it doesn't have the open source, community-oriented charm that I think Sandstorm had.
edit: Oh, I didn't read far enough down the tweet chain:
> I am so proud to say, we are making this whole thing open source, Apache 2.0 license, no catch.
Hooray! Sandstorm's back on the menu, boys! This really does make me happy. I never should have doubted, ha.
[0] https://news.ycombinator.com/item?id=10237821
[1] https://news.ycombinator.com/item?id=13589471
For what it's worth we (the community still working on Sandstorm) are also about to release an updated version of Sandstorm. But also as someone who definitely will still be running Sandstorm at home, some of the Cloudflare OS stuff is super exciting to me, and probably well beyond what we'll tackle with Sandstorm any time soon. What Kenton's doing with gatekeepers is insanely cool.
You should probably add a disclaimer you work at Cloudflare yourself?
> I liked Kenton's take on this: https://x.com/KentonVarda/status/2084990137180590572
https://archive.vn/wvgxq
Damn, this is a pretty big deal!
Can you explain why you think this is a big deal?
What particular feature/capability made you think this?
I do not disagree but i am curios. Lets have a discussion instead of just throwing feel good vibes around...
Uh, no? I responded to a comment. That's the context. Dafuq?
You are adding nothing to the diacussion.
> What if, when you wanted a new feature in the software you are using, you could just prompt your agent to add it?
Yep, that's precisely the vision I formulated some months ago: https://manuel.kiessling.net/2025/11/04/what-if-software-shi...
I don't get it
How is this different than the capabilities which cowork by claude / chat gpt desktop apps now a days give in terms of core capabilities.
The fact that you can maybe fetch bugs from jira and present in the way you want is true for any of the agentic orchestrators, so is it really the USP ?
One difference I found against other orchestrators was that they work on a per seat billing model. Example if you have 10 team members who want access to a shared agent infrastructure, you would end up paying 10 * 20$ = 200$ per month while in this case it is probably just the AI and infrastructure bill that you have to spend, which probably might cross 200 dollars as well.
Cool. The gadgets/blueprints paradigm reminds me of Smalltalk or Lisp environments in a way -- you're shipping a messy thing, a packaged version of your own personal, always-evolving environment.
Natural language wrapper around programming. Sandboxing and controlling external interactions to minimize the cost of mistakes. As I see it, the core idea here is facilitating habitability (in the Richard P Gabriel sense) via abstracting software development and distribution in a way that allows non-programmers to engage.
I'm not sure LLMs are quite there with results/$ to fully support a personal computing revolution here. I suspect useful blueprints will largely be wrappers or reimplementations of software that is still primarily created and distributed outside of this environment. But there's promise here, and it's cool.
Everytime I read about new things from Cloudflare they look really cool but I cannot shake the feeling of not wanting to use them for fear of lock-in, am I too paranoid?
This is 100% open source and self-hostable.
https://github.com/cloudflare/cloudflare-os
It runs on top of our open source runtime.
https://github.com/cloudflare/workerd
It's cool that it's open-source, but how much effort and scale would it take to run it on non cloud flare infra?
Does workerd have full feature-parity with Workers, including stuff like Durable Objects?
It's the same code. The only thing it doesn't include is the global scheduling and orchestration, but you don't actually want that locally. (And honestly... that stuff is a bit of a beast.)
Durable Objects are fully supported by workerd (and Cloudflare OS uses them extensively).
There is, however, one catch currently: Durable Objects don't scale out well without the global scheduling. For running Cloudflare OS for one user, this is actually no big deal, but a company-wide instance might not work well.
But I'm actually fixing that:
https://github.com/cloudflare/workerd/pull/6780
Unfortunately didn't get enough time to land it before this release, but it'll come soon.
With that I would expect a self-hosted Cloudflare OS on your own cluster to work quite well.
Can I host outside Cloudflare?
No it uses cloudflare primitives
Incorrect. You can host it on workerd on your own servers. No Cloudflare required.
Don’t the docs say running on wrangler is not for production use? Or am I missing something?
wrangler is a development tool. You wouldn't want to run dev mode in production.
But workerd can be used directly without wrangler, and is production-capable in that format.
Unfortunately we did not have time to put together example configs for this before launch (I wish we could have delayed, it was out of my hands), but we will be doing so soon.
Mentioned in the readme here:
https://github.com/cloudflare/cloudflare-os#deploy-to-your-o...
Appreciate the correction, thank you
Cloudflare seems mature enough at this point that if you're willing to accept any kind of vendor lock-in, then accepting it through them is likely acceptable. I won't say they're on-par with the big cloud providers, but if they offer the services you need and you'd be willing to lock-in with AWS, etc., then they should be considered.
If you're generally opposed to any vendor lock-in, then Cloudflare is definitely a hard sell. Many of their services are pretty specific to their ecosystem and I imagine trying to keep things portable would be infeasible any many scenarios. Granted, this is true in a provider like AWS, too, if you were depending heavily on their proprietary, managed services. But there's definitely value in knowing that you can stick to "generic" services as much as possible in AWS and be able to move away relatively easily.
Cloudflare is definitely becoming a "real" cloud provider (I'd say their release of R2, for me, pushed them into the "serious contender" category), but they focus on pretty specific features that aren't very portable. This Cloudflare OS service is a good example of that. If it is exactly what you need, then it is worth checking out and taking on the risk of vendor lock-in. But if you're doing something where long-term planning and portability is important, then you'll have a hard time warranting even considering them.
Cloudflare OS does have the important risk-mitigating feature that you can fork it if the vendor becomes hostile to your interests. You can't really do that with managed services like Workers (workerd exists but isn't a drop-in replacement for the entire Workers platform).
Whether forking is economical depends, of course, on your scale and on how many others are in the same boat.
in the world of AI, forking is so much easier.
I was messing with a closed source tool from a vendor, and turns out they didn't support my use case (they were Mac only, I needed a Linux version. And I wanted it in a different programming language than they had used for maintenance and performance).
Pointed Fable and Sol at the binary and the symbols (most of the work was through http, to be fair), and a few hours later I had a fully functional version with additional features.
now of course the legality of that being closed source is iffy, but it was for personal use. In this case its open source. Need to run this on another platform ? You probably can get very far with a prompt or two.
Yes. Be locked in. It's better to go 100% and only pay the switch costs if you have to.
Developing abstractions to let you switch technologies has 2 costs: The actual development, and not fully utilizing a specific technology. Lots of people prefer pain in small doses because it can be rationalized as eventual payoff.
There are degrees of this decision, of course, but I would say most folks worry too much about this particular champagne problem.
> Yes. Be locked in.
That'd be fine if the decision just affected the decision-maker's system. But the secondary effects are that it binds the external users of that system to the vendor's ToS.
No, you’re not too paranoid. It has already proven both in the software and hardware world what vendor lock-in can lead to.
Also check out Bunny.net.
I feel exactly the same. The CF services I do use are DNS and R2. I'd be curious if there's a guide somewhere that lists their services through the lens of lock-in. For example, R2 is somewhat S3 compatible so it's less risky to use because I can swap providers.
They also provide cover to those doing the dirty stuff which drives the need for their other products.
Not remotely paranoid.
Any platform specific code or config can be replaced with self-built infrastructure. Everything else you write should be portable.
Cloudflare is hit or miss there.
They move pretty quick so they tend to ship a lot of product very quickly that have a lot of potentials. But they are very much MVPs, and you'll hit a lot of limitations that aren't always obvious at first blush. And then it can take years before they mature, at which point they'll pour a ton of resources and they'll go from useless to top tier in like 2 months.
It's really hard to tell.
The Vite plugin for Cloudflare Worker was one of those. It was really rough at first and I wasted hundreds of hours getting stuff working as advertised. And then in a week they fixed all the bugs.
AI Gateway is another. We used it at first because it seemed to check all the boxes, and turns out it had tons of limitations and almost none of the features of other offerings, with very few updates months+. And then recently they basically added all the features it was missing in a few weeks/months and now its good.
Agent SDK too, it was always behind with outdated dependencies and missing features all other agent frameworks had. And then one day they started iterating super fast and now its legitimately good.
You can never tell reading the docs, so you have to try it, curse because you only find the limitations once you're running the thing for real in production, abandon it, then a few months later its everything you could ever want.
I have a love hate relationship with Cloudflare. Mostly love, but still.
Same! What I tell people is that Cloudflare products can be extra beta, and you have use your nose to smell the future. Truly love hate as their ecosystem of interesting tools can be so tempting.
Yeah, with love the words "open source" mean a lot less here (de facto, of course not de jure) when the resulting open source product is entirely contingent on Cloudflare's PaaS.
And I think they suffer a little a little bit from their infrastructure being _comparatively_ unique. As providers go, they're on the harder end to replace with something else if you were to ever want to retarget your workloads.
Not at all too paranoid. Just like people figured out even with elastic everything, compute from Spot instances and all the other things we're supposed to do in AWS, the data out charges between AZ's and Region's still more than made up the cost savings for true resiliency. People are going to figure out relatively similar pricing traps in Cloudflare that are difficult to design around.
If you run an unindexed D1 query, then you get dinged for every row read. If you didn't properly perform scalability testing in non-production, then you'll never know this until you get a bill that you dissect to find out 5 million rows read for a 5 row result, if you even dig that far in the billing.
If you do not use the WebSocket Hibernation API with Durable Objects, then when you spin up a DO and hold open thousands of client WebSockets, you are being billed continuously for the entire time those connections are open—even if zero messages are being sent.
If you keep optimizing for payload size like many do by default but not event frequency (like poll a Worker every second instead of keeping a single stream open), it will show up unpleasantly in the billing.
If you treat KV like a transactional database keeping state, then be aware writes are expensive compared to reads. Pumping high-frequency write traffic into KV will result in exorbitant write operation costs and eventual consistency headaches. High-frequency state mutations belong in Durable Objects, not KV.
Batch your data to minimize request count, aggressively index your SQL queries to minimize row scans, and hibernate your idle persistent connections whenever you can. Doing all this will make your solutions cost efficient, but very locked into their ecosystem.
Cloudflare is just another corporation with greed in their eyes and if you don't design yourself to their puzzle than you're not welcomed.
This is an extra wall in walled garden land; another one you will need to jump if you want to break free. Another stab at gatekeeping the upcoming Ai era of the internet. It's no different to the playbook of Google, Apple, and Facebook of the 00's. So, no, you're not paranoid.
In the terms of security: My firefox on FreeBSD instantly triggers endless loops of "prove your human" on their turnstile. I can't use old handhelds of android and a single VPN triggers all. Anything that they don't see as "secure" you're denied from.
What is stopping Cloudflare from deeming your LLM as unsafe?
Scenario: You're ready to launch, you come up with the next best innovation for the next generation of Ai internet. Revolutionary and you're about to launch, blast off; wait. You're denied your launch because it threatens their service. The former: they like your idea more-so and clone it to become theirs.
Stories of above have all been posted on HN before. Startups have been sabotaged by rug-pulling of cloud providers. It is early-vendor lock-in and at it's best. Google & Co would be jealous; if they were not in bed with.
This will turn in to a netting of: Your Ai isn't using our service, so your Ai isn't allowed to interact with ours.
What does Cloudflare offer as a service? A turnstile to the Internet of Things and the difference this time is that you get to self-host your own corner on their patch of land with their ticket prices and access policy of.
Remember folks, no corporation gives a rat's ass about you. Internally, or externally, you're just another sheep to extract wool from.
"OS for work" - like, what does it mean? OS is operating system, it runs on a hardware and provides you to operate the system. I hate when companies destroy the English language with vibe invented terms.
If this succeeds, it's going to be in spite of its branding and marketing.
An operating system manages access to shared hardware (disk, CPU, memory, networking, display, etc. on a single machine OS). MS-DOS mainly handled shared access to disk via a file system abstraction, hence the name. The naming of Cloudflare OS makes sense to me.
It doesn’t schedule tasks, doesn’t deal with physical memory, it doesn’t initialize hardware or interface with it on a low level. This is just an app that lives in user-space, nothing more.
Calling this an OS is like calling Gmail an OS.
It doesn’t make any sense.
But since OSes are notoriously difficult to define [1], half of America added AI slop to diets that were already repulsive to begin with, regurgitates the chyme, and passionately feeds it to their peers, you may even get away with it nowadays.
[1] https://os.ecci.ucr.ac.cr/slides/Andrew-S.-Tanenbaum-Modern-...
> It doesn’t schedule tasks,
It absolutely does.
> doesn’t deal with physical memory,
Well it sort of does. It allocates sandboxes and schedules apps in them. It handles loading code from storage and turning it into running programs with state.
> it doesn’t initialize hardware or interface with it on a low level.
Instead of devices it manages interfacing with external services (Gatekeepers are like drivers).
I didn't choose the name but I do think there's a fair analogy here even on a technical level.
Interesting points!
Sent from my Gmail OS
Counter point: emacs :)
It's a thing chatgpt comes up with, like em dashes or the worde 'delve'. High clanker/vibecoder signal
Why are companies slapping "OS" in their product naming? it's stupid
From the GitHub page:
It looks to me like they just wanted to distinguish their product from other AI agents/sandboxes, so they called it an OS to make it sound bigger and better.
It's awful naming if they have to explain it.
the people criticizing the vibecoded name knows what they meant, it is just not correct. It is the same as vegan meat.
Excluding vegetables from what convey “meat” was also not correct around 1300-1500. Definitions changes with usage and only time will tell the future of vegan steaks, meats, milks, sauvages, butters and other parties.
> food, nourishment, sustenance
> Narrower sense of "flesh of warm-blooded animals killed and used as food" is attested from c. 1300
https://www.etymonline.com/word/meat
Because it sounds impressive to clueless people ($).
Mostly to get trolls to retweet and complain about it for free advertising. It's working. ;)
I think because the idea of an "agent operating system" is starting to feel more and more inevitable. Since I can use AI to:
I almost do not need a traditional OS anymore. This obviously isn't entirely true: I still use it to interact directly with humans, and it's the way I access my LLM. For now.> I almost do not need a traditional OS anymore.
You sure about that?
You need a "traditional" operating system to even run your LLM, or do you have your own custom collection of drivers you flash your machine with? :p
smells like lock-in to me.
Does your LLM have hardware drivers in it? this is silly.
But "virtual machine" is not? Maybe "Virtual OS" is more acceptable?
Agreed, its like OSes have become so invisible people have actually forgotten what they do.
I agree, it has now become a cliche buzzword that product managers slap on boring non-technical things to make them sound important.
Isn’t there even a bug tracker that some company calls an ‘issue OS’ or something absurd?
Because AI enables a new layer more akin to an actual OS. But also because I imagine they all want all the things running through them and an OS is the widest net they can cast in that direction.
Cause they’re trying to build an ecosystem
i too clicked the link by this exactly 2 characters, "OS" should NOT be used in this way.
Same reason why grifters adopted web3 when Web 3.0 was already an established term.
Andy Jassy et al didn't quite name it that, but AWS was being thought of internally as "Internet OS".
It's better than "harness."
I disagree. Harness is a pretty great word, and it doesn't already have another familiar meaning.
Because the English language evolves.
I'm mostly going off the tweet, it could be I just don't understand, but how do you managed shared data if everyone has their own copy of the code and they can add whatever features they want? I mean, I'm assuming that any sort of significant feature requires some sort of change to the data model, and even with a schema-less database you could have conflicts if two things use the same field name, for instance? Also what happens with updates? Like, part of IT is keeping people up to date, but if everyone has their own bespoke customizations how do you not clobber those?
Also the security story doesn't completely add up to me. Like, if I'm a user and I can just add features that I want, what's to stop me from placing data in there that's maybe covered under HIPPA or some other sensitive data (protected class, or even just stuff like authentication information)? Right now a small number of people need to think about data security, but this seems like it'd extend it to anyone? That kind of data, it's not just about "keeping it internal by default", there are a lot of rules around storing it at all.
I dunno, it kind of makes me think of when people suggest forking an open source project if the maintainers won't accept a suggestion. Sure, you can do that, and it does happen, but you're also basically signing up to maintain it for decades. I'm not sure if anyone wants to maintain Alice in accounting's very weird spreadsheet app 10 years after she's left the company?
(Again I'm not throwing shade, just trying to understand better)
The key is the fine-grained instances (gadgets).
E.g. if you're using a slide editor app, each slide deck you create is its own instance of the app, whose code can be independently modified.
The slide content and the code are kept together and sandboxed together.
Adding HIPPA data to the app is no different to adding it to the slide content. I suppose whether or not that is OK depends on a lot of things, but the same things apply to traditional PowerPoint. The fact that the code is modifiable doesn't change the situation, since those modifications are sandboxed and constrained to that one slide deck.
This represents a small part of what IT is worried about. Offer a beer and say the word "SharePoint" if you want the long version of where this could wind up.
The issue isn't letting end-users add features. The issue is twelve end-users customizing something that produces output, saving it, and now nobody can read it.
This can get solved. If it even gets a chance to gain traction (it should, though IT will of course push back). But let's not pretend we're there yet.
Why do people add "OS" to their product/project name when it is not an OS at all?
Indeed, at this point it's one of the most devalued terms in software. Every week I'm reading about some product calling itself "the Operating System for XYZ." It seems like it's what you do when "platform" just feels too modest. To me, if it's not bootable, calling your product an OS just reeks of marketing sleight of hand.
In some sense, it is. Sandstorm called itself an OS too. Arcan calls itself an Overlay-OS.
I think for any platform for general purpose computing that provides an application model that programs are written to target, it's close enough I don't mind. Ie: it makes sense for some end-user software to have a target for Windows, Linux, Sandstorm, etc.
& from the other side- what does Debian add that lets it call itself an OS? A set environment and package manager that software is specifically packaged for.
"We invented the AI agent"
It's a chat app
"We invented the AI creative suite"
It's a chat app
"We invented the AI OS"
It's a chat app
If Cloudflare's been using this internally, could that explain why their dashboards are so confused, disjointed and broken?
When did junk like this start being called an operating system?
The same question is bothering me
So, a security-oriented cloud agent framework? Better call it an OS.
Probably better if they make it obvious that you need Workers paid plan:
"Your Cloudflare account is on the Free plan, but the Cloudflare OS backend needs Dynamic Workers, which requires the Workers Paid plan."
This is just if you don't want to host it yourself, no?
Far as I can tell, even if you host it yourself you are still bound to their workers.
which are open sourced [1]. I tried deploying it and had Deepseek v4 Flash create a dumb whiteboarding app.
[1] https://github.com/cloudflare/workerd
This is effectively a Codex/Claude app competitor. Good move from Cloudflare since it helps them sell their core infra offerings. I like the direction they’re going with access control.
The real question is, can Cloudflare become a equal or better OpenAI / Claude provider, while offering a vastly more robust platform than either?
I think the answer is yes, simply because both OAI and Anthropic leverage CF for their hosting today.
I used to meme back in 2008 (when Google docs first was becoming big) that "The problem has always been the sandbox". The problem Chrome and Firefox solved was the Sandbox - you can browse some random code across the web without worrying about getting hacked. The same problem has arisen today but now with AI agents.
There is likely to be huge winners in the AI space simply based on who can create the best way to contain AI agents and "expose AI value" safely.
So, that means even more pressure on OpenAI and Anthropic. I really don’t see how they will stay competitive long term. Cloudflare can offers way better product by integrating with the rest of their platform and offering a variety of models, including open models they host themselves
Yep, a pre-wrapped Codex for enterprise. Seems like the logical evolution from setting up an MCP.
Codex for enterprise is Codex for enterprise.
This is revolutionary stuff. It crystalises latent thoughts I've had about how to safely integrate agentic capability for serious work.
We're starting to see indifferently architected AI creep into every engineering tool, from requirements management to coding, MATLAB, EDA and Solidworks. At the same time we see LLMs orchestrating long running hacking campaigns that will leverage other agents and automation to propagate. We really need an architecture that can handle that complexity.
Kenton Varda hitting the ball out of the park again.
Well everyone is trying to create an environment where they can safely delegate tasks to agents.
I am no different, but my approach is a dedicated powerful computer on your desk rather than something in the cloud. I am calling it Tarvis AI (derived from TARS from Interstellar and Jarvis from Iron Man), more details here: https://tarvisai.com
I have tried many of the VM/cloud-based agent setups, and they either tend to be only novelties since you can’t do much with 2-4 vCPUs + limited RAM or they start racking up expensive cloud bills.
I realized that the underlying operating systems for AI have to be built from the ground up for agents instead of taking current OSes and taming them for agents. Not sure how much of that philosophy is followed by Cloudflare. Excited to see growth in this area.
Also worth reading is the blog post by the Cloudflare CIO Sam Rhea on how they are actually using it internally, with some examples.
https://blog.cloudflare.com/how-we-use-ai-with-cloudflare-os...
In case anyone else is curious, local Gemma4 12B Q6 XL really struggles to make use of this for simple goals like a daily briefing after an MCP tool call. I don't think there's a simple artifact concept? Still early but confused.
I have a feeling we're all working towards the same thing, but with different frameworks and infra. The Cloudflare OS experience looks, to me, very much like what I created for myself with https://rcarmo.github.io/projects/piclaw (except that I rely on focusing different instances on different sets of skills and tooling, so only two have "Office" skills, for instance).
I am confused... it's not an OS, is it?
https://github.com/cloudflare/cloudflare-os#cloudflare-os-an...
This is not a traditional computer operating system. We use the term "operating system" in two senses:
An operating system for the company to be productive with AI, in a way that is safe, so that the security team can sleep at night. An operating system for AI workloads, analogous to the sense in which a traditional operating system manages compute workloads.
> We use the term "operating system" incorrectly.
FTF[them]
> An operating system for AI workloads, analogous to the sense in which a traditional operating system manages compute workloads.
They have really twisted the definition to fit their marketing here. Operating systems are what allow you to use hardware to interact with software. Their product does nothing comparable to that at all.
They still use the term in the “definitions” so they aren’t actually defining anything
This "OS" label reminds me of ms with ".NET", a choice they definitely seemed to regret
this is a cool idea, but i suspect will be limited in use cases. the vast majority of people don't want or can't modify their software competently and will rely on others to do that. once you're relying on someone else, they do not want to maintain different copies for every user, that sounds like a maintenance nightmare for admins or else such a new paradigm that it takes a new generation of admins 20 years to get comfortable.
> Cloudflare OS is available today and is open source. Check out the cloudflare-os GitHub repository. You can deploy it into your own Cloudflare account and use your own Access policies, AI Gateway configuration, data, and integrations.
In case anybody missed it.
It's open source, but it is so incredibly tied to their platform, that there is no vendor portability, which has made almost every of their product launches post-Workers kind of meh.
workerd is OSS
Really not a fan of calling things an OS that are not an OS. This seems interesting, but it is also tied to CloudFlare workers, so beware.
I can't help but wonder if these things that are now emerging have a sort of "borrowed time" component tied to them.
I see the examples, and they clearly tackle both organizational inefficiencies and human connection/communication as the core problems.
Sounds like things are converging to "my AI will talk to your AI" and the role of humans will just be a human "router" in the loop switching up nodes in a graph, like the return of Switchboard Operators from the 1950s.
I really don't know how folks accept such vendor lock-in. Imagine using Cloudflare Workers as your main tech stack. This is crazy.
They had a demo https://news.ycombinator.com/item?id=49101234
timestamp is 47:45
Seems like a good candidate to replace my home-grown llama.cpp web UI clone. This comment used to be a gripe about their provider UX not giving an example URL (realized /v1 is expected as the final segment).
I think this is trying to do something similar to exe.dev, but not doing it as well
So to run this 'OS', I need to have an existing running OS...
Has anyone experienced using Buzz or YC's qm? How does this compare with those?
Setting up your public URLRetrying… (attempt 5 of 6) Fingers crossed!! The last one gotta be the one...
EDIT: It let me down... (Something unexpected went wrong on our side.)
Please let me now if deploying it on your custom domain worked for you please...
EDIT: Retrying it now worked but I had to subscribe to R2 (which is free for 10GB apparently). However, after that it will tell you that you need to enable the Dynamic Workers which is actually paid...
"Your Cloudflare account is on the Free plan, but the Cloudflare OS backend needs Dynamic Workers, which requires the Workers Paid plan."
So no free preview for me today.
Engineers should be wary about being forced into using particular prompts/skills/instructions.
Why would I use a shared LLM-in-the-cloud, instead of my own? The shared one precludes any possibility to customize or differentiate my workflow, prompts, or skills. As an employee that sounds like a death sentence to doing my job effectively.
That's why this is open source.
https://github.com/cloudflare/cloudflare-os
You're supposed to customize it.
Also it features a whole system for adding your own skills and context.
Wait, isn’t that what Mistral does for their Vibe interface for companies?
how this can be compared against Microsoft agent framework?
Seemingly Cloudflare’s strategy nowadays is shipping “open-source” projects that are coupled with their own infastructure. First EmDash CMS, now this.
Not a bad marketing strategy. Vendor lock in matters a lot less to some people than it does to me.
OH! I get it. OS = "open source"!
Everyone is building these same looking apps that look like Codex, Claude desktop. We don't need these. Slackbots work more than well enough to collaborate with agents.
I think this is cool!
I think it is cool!
I'm curious if the primary customer will be developers or IT admins
But is it actually an OS?
Is Chrome?
Does chrome claim to be an OS? or are you talking about chrome os which is an OS built on top of a Linux kernel, kind of like ubuntu or redhat
Why?
Im having a hard time figuring out what the intended user interface is here. The screenshots im seeing makes this look to be an electron app, but the repo seems to be implying that this is a deployed web app.
If this is just another librechat I'll be disappointed, and frustrated- because this is so 5 months ago.
Does this beat self-stewarding my data, and placing relevant protections around my data instead.
Then the UI's, the "Apps", are just ephemeral instances over my live data whose permission I am consistently setting or reviewing.
I feel like that more accurately represents a "person" behind the data: when I am producing, creating and expressing in real life, I do not ask some intermediary 3rd-party for permission to access my voice and my output. I just produce and let whatever gets created be made there in the physical environment or in someone's head. Today's apps (edit: & cloudflare's direction here) feel more like "The moment I express or generate something, I lease it's output from someone else and ask for their permission to access my output".
How do you install this? Where's the download link.
https://github.com/cloudflare/cloudflare-os
It's an operating system, so perhaps you need the ISO...
From: https://os.cloudflare.app/
> "Give every person an agent and workspace built around how your company works, what it knows, and the systems it relies on."
Hundreds of thousands of so called "AI startups" have been eliminated.
Or they can just transition to Cloudflare OS and keep their domain-specific data proprietary, which is where the money is in the first place.
gas town 2 real???
Finally, we have an "OS" written in typescript. And here I was thinking that an OS would be the only exception to Atwood's law /s
Ah look, yet another one jumping into AI party.
This is the middle of Cloudflare's "Agents Week"... and I believe they had an Agents Week last year. We're like... at least a year or two into Cloudflare being in the AI party. ;)
Well, one needs to keep surviving the hype wave, not that other surfers overtake it.
This is close to what I need for my company. Currently I'm test driving Open WebUI.
https://github.com/open-webui/open-webui
Stay away, I had bad experience myself, I'm sure there is something better out there. For me I ended up asking Claude to build a custom RAG pipeline, took an afternoon and is 10x faster.