Cloudflare OS: an open platform for agents, apps, and work

One argument I could bring is that despite all its claims, OpenAI still had to switch from containers to MicroVMs because its agents under test still managed to break out from their containers. Is the security model of a Sandstorm grain so much better that agents wouldn't figure out how to break out of it?

Let me introduce you to scrapling+MCP--the closest I've come.

Stealthed, controllable browser gives you an API to arbitrary web things

You can't modify it, but you can extend it which imo is the next best thing

adb (Android) is close albeit a bit more tedious. It's fun watching an LLM take screenshots, read them, then send input events back to the phone.

If you have a rooted Android, you _can_ modify the apps. Xposed, ReVanced, et al subject to Play Integrity's ever growing pervasiveness

The article posted buries the lead. Cloudflare OS reads like almost any other AI knowledge base until midway when apps are introduced and then becomes overly technical with a code snippet.

Buzz looks like a more reasonable direction than this does.

This can only be correct when the application can’t affect anything outside the sandbox. Which would significantly restrict useful applications.

This was a great summation.

Yep, that's precisely the vision I formulated some months ago: https://manuel.kiessling.net/2025/11/04/what-if-software-shi...

> I'm a web developer, but I can't really use my skills to provide an open source web app the way I'd like to. I'd like to build a small server-side budgeting app that people can use from their computers or phones to record expenses, but there's no way I can ask people to find a web host that lets them run rails, or set up a heroku account or whatever.

> So my only alternative would be to run the service myself, but then I'm storing other people's data, I have to worry about scaling if lots of people use it, and user accounts, and all this stuff.

> The idea of sandstorm is folks run this platform on their personal servers, and then it lets you browse an app store like interface and one-click install these server side apps. So I'd bundle up my budgeting rails app as a sandstorm package, and if someone wants to track their expenses from a variety of devices, they install the app. Now they're running it so the data is theirs, there's no scaling issues, and user authentication is provided by sandstorm.

It was a beautiful thing that tried to thread the needle between personal, self-hosted software and cloud-based "software as a service". I've long thought that "federated" software is the sweetspot, since it allows people to control software in more natural organizational units like families or communities, without being centrally controlled or devolving into the craziness that is "decentralized".

However, while the functionality of Cloudflare OS may be Sandstorm-inspired, I feel like it doesn't really have its soul. What a difference a decade makes! Here's another comment[1] from me 10 years ago about why I loved sandstorm, which begins:

> Oh no! I really believe sandstorm (or something like it) is what we need the future to be. Rather than having everything get sucked up into Google, Facebook, Apple, or these other few centralized services, imagine where everyone has a personal (or family, or church group or whatever) server, and they can one-click install their email apps, their document apps, etc.

These days Cloudflare has become one of the "Google, Facebook, Apple" that I mentioned. I'm still a fan of Cloudflare generally, and with kentonv behind this I absolutely have to try it out, but it doesn't have the open source, community-oriented charm that I think Sandstorm had.

edit: Oh, I didn't read far enough down the tweet chain:

> I am so proud to say, we are making this whole thing open source, Apache 2.0 license, no catch.

Hooray! Sandstorm's back on the menu, boys! This really does make me happy. I never should have doubted, ha.

[0] https://news.ycombinator.com/item?id=10237821

[1] https://news.ycombinator.com/item?id=13589471

> I liked Kenton's take on this: https://x.com/KentonVarda/status/2084990137180590572

https://archive.vn/wvgxq

How is this different than the capabilities which cowork by claude / chat gpt desktop apps now a days give in terms of core capabilities.

The fact that you can maybe fetch bugs from jira and present in the way you want is true for any of the agentic orchestrators, so is it really the USP ?

One difference I found against other orchestrators was that they work on a per seat billing model. Example if you have 10 team members who want access to a shared agent infrastructure, you would end up paying 10 * 20$ = 200$ per month while in this case it is probably just the AI and infrastructure bill that you have to spend, which probably might cross 200 dollars as well.

https://github.com/cloudflare/cloudflare-os

It runs on top of our open source runtime.

https://github.com/cloudflare/workerd

If you're generally opposed to any vendor lock-in, then Cloudflare is definitely a hard sell. Many of their services are pretty specific to their ecosystem and I imagine trying to keep things portable would be infeasible any many scenarios. Granted, this is true in a provider like AWS, too, if you were depending heavily on their proprietary, managed services. But there's definitely value in knowing that you can stick to "generic" services as much as possible in AWS and be able to move away relatively easily.

Cloudflare is definitely becoming a "real" cloud provider (I'd say their release of R2, for me, pushed them into the "serious contender" category), but they focus on pretty specific features that aren't very portable. This Cloudflare OS service is a good example of that. If it is exactly what you need, then it is worth checking out and taking on the risk of vendor lock-in. But if you're doing something where long-term planning and portability is important, then you'll have a hard time warranting even considering them.

Developing abstractions to let you switch technologies has 2 costs: The actual development, and not fully utilizing a specific technology. Lots of people prefer pain in small doses because it can be rationalized as eventual payoff.

There are degrees of this decision, of course, but I would say most folks worry too much about this particular champagne problem.

Also check out Bunny.net.

They move pretty quick so they tend to ship a lot of product very quickly that have a lot of potentials. But they are very much MVPs, and you'll hit a lot of limitations that aren't always obvious at first blush. And then it can take years before they mature, at which point they'll pour a ton of resources and they'll go from useless to top tier in like 2 months.

It's really hard to tell.

The Vite plugin for Cloudflare Worker was one of those. It was really rough at first and I wasted hundreds of hours getting stuff working as advertised. And then in a week they fixed all the bugs.

AI Gateway is another. We used it at first because it seemed to check all the boxes, and turns out it had tons of limitations and almost none of the features of other offerings, with very few updates months+. And then recently they basically added all the features it was missing in a few weeks/months and now its good.

Agent SDK too, it was always behind with outdated dependencies and missing features all other agent frameworks had. And then one day they started iterating super fast and now its legitimately good.

You can never tell reading the docs, so you have to try it, curse because you only find the limitations once you're running the thing for real in production, abandon it, then a few months later its everything you could ever want.

I have a love hate relationship with Cloudflare. Mostly love, but still.

Not remotely paranoid.

And I think they suffer a little a little bit from their infrastructure being _comparatively_ unique. As providers go, they're on the harder end to replace with something else if you were to ever want to retarget your workloads.

If you run an unindexed D1 query, then you get dinged for every row read. If you didn't properly perform scalability testing in non-production, then you'll never know this until you get a bill that you dissect to find out 5 million rows read for a 5 row result, if you even dig that far in the billing.

If you do not use the WebSocket Hibernation API with Durable Objects, then when you spin up a DO and hold open thousands of client WebSockets, you are being billed continuously for the entire time those connections are open—even if zero messages are being sent.

If you keep optimizing for payload size like many do by default but not event frequency (like poll a Worker every second instead of keeping a single stream open), it will show up unpleasantly in the billing.

If you treat KV like a transactional database keeping state, then be aware writes are expensive compared to reads. Pumping high-frequency write traffic into KV will result in exorbitant write operation costs and eventual consistency headaches. High-frequency state mutations belong in Durable Objects, not KV.

Batch your data to minimize request count, aggressively index your SQL queries to minimize row scans, and hibernate your idle persistent connections whenever you can. Doing all this will make your solutions cost efficient, but very locked into their ecosystem.

This is an extra wall in walled garden land; another one you will need to jump if you want to break free. Another stab at gatekeeping the upcoming Ai era of the internet. It's no different to the playbook of Google, Apple, and Facebook of the 00's. So, no, you're not paranoid.

In the terms of security: My firefox on FreeBSD instantly triggers endless loops of "prove your human" on their turnstile. I can't use old handhelds of android and a single VPN triggers all. Anything that they don't see as "secure" you're denied from.

What is stopping Cloudflare from deeming your LLM as unsafe?

Scenario: You're ready to launch, you come up with the next best innovation for the next generation of Ai internet. Revolutionary and you're about to launch, blast off; wait. You're denied your launch because it threatens their service. The former: they like your idea more-so and clone it to become theirs.

Stories of above have all been posted on HN before. Startups have been sabotaged by rug-pulling of cloud providers. It is early-vendor lock-in and at it's best. Google & Co would be jealous; if they were not in bed with.

This will turn in to a netting of: Your Ai isn't using our service, so your Ai isn't allowed to interact with ours.

What does Cloudflare offer as a service? A turnstile to the Internet of Things and the difference this time is that you get to self-host your own corner on their patch of land with their ticket prices and access policy of.

Remember folks, no corporation gives a rat's ass about you. Internally, or externally, you're just another sheep to extract wool from.

    This is not a traditional computer operating system. We use the term "operating system" in two senses:

    - An operating system for the company to be productive with AI, in a way that is safe, so that the security team can sleep at night.
    - An operating system for AI workloads, analogous to the sense in which a traditional operating system manages compute workloads.

Isn’t there even a bug tracker that some company calls an ‘issue OS’ or something absurd?

  - Pull information from external sources
  - Transform and/or augment that information
  - Publish information

I think for any platform for general purpose computing that provides an application model that programs are written to target, it's close enough I don't mind. Ie: it makes sense for some end-user software to have a target for Windows, Linux, Sandstorm, etc.

I think the answer is yes, simply because both OAI and Anthropic leverage CF for their hosting today.

I used to meme back in 2008 (when Google docs first was becoming big) that "The problem has always been the sandbox". The problem Chrome and Firefox solved was the Sandbox - you can browse some random code across the web without worrying about getting hacked. The same problem has arisen today but now with AI agents.

There is likely to be huge winners in the AI space simply based on who can create the best way to contain AI agents and "expose AI value" safely.

This is not a traditional computer operating system. We use the term "operating system" in two senses:

An operating system for the company to be productive with AI, in a way that is safe, so that the security team can sleep at night. An operating system for AI workloads, analogous to the sense in which a traditional operating system manages compute workloads.

https://github.com/cloudflare/cloudflare-os

You're supposed to customize it.

Also it features a whole system for adding your own skills and context.