15 ms·
Run JavaScript on Cloudflare with Workers
- jakozaur 9y agoLooks like a little bit cheaper than AWS Lambda@Edge which is $0.6/mln, but more than regular AWS Lambda $0.2/mln. On Lambda you pay extra for resources, but you can get more RAM or CPU there (e.g. running Chrome Headless is an option there). On the other hand CloudFlare Workers looks more distributed, but suitable just for 50ms CPU time, 15s wall time and 128 MB. This is enough for redirects, A/B testing, but often not enough for writing serverless applications or any kind of rendering. I wonder whether CloudFlare wants to get into serverless business and this is first iteration or if it's just a CDN which is more customisable by allowing code to run there.
- zaarn 9y agoI bet it's enough to drive a static blog from some markdown files and templates. Which would be interesting for cheap hosting while also being on cloudflare CDN.
- zackbloom 9y agoCheap hosting that also manages to be served from 120+ places around the world.
- jgrahamc 9y agoBut no data transfer charges from Cloudflare. And the JavaScript deploys in seconds not minutes.
- jakozaur 9y agoNo data transfer fees from CloudFlare is their big competitive advantage. $0.5-0.7 GB / egress on major public clouds can be brutal. Transferring one object out of S3 cost same as storing it for 2.5 months.
- apendleton 9y agoIt also looks to be much more capable than Lambda@Edge though, for what it's worth (particularly in that it can make multiple outbound requests).
- kentonv 9y agoHi folks! This is my project at Cloudflare -- which, entirely by coincidence, I joined exactly one year ago today: https://news.ycombinator.com/item?id=13860027 https://news.ycombinator.com/item?id=13860027 Happy to answer any questions.
- gregorymichael 9y agoHappy cake day! Congrats on the big ship!
- sitepodmatt 9y agoHow does a cold start perform, I'm guessing with sandboxing of v8 vs a whole new container, and deserialization of a single script into a free sandbox v8 slot (perhaps they store the AST or preJITed code for even faster start? - not familar with v8 internals) it is much faster than cold starting nodejs on AWS lambda?
- kentonv 9y agoThis is one of those questions I love answering. :) It turns out V8 is very well-optimized for loading JavaScript quickly, since that's exactly what it needs to do when loading a web site with a user waiting. We're seeing average cold start times under 5ms.
- hashseed 9y agoThere are some features in V8 to make loading a script even faster. I'd be glad to connect over these features on twitter (same username). I implemented them.
- nathantotten 9y agoSo no free tier? That’s kind of a bummer, but I guess it’s time I start paying Cloudflare for something. :)
- jgrahamc 9y ago
- jgrahamc 9y agoAnd they typically run in under 1ms and global deploys take less than 30s and it's native V8.
- neuland 9y agoAre Cloudflare Workers implemented as an NGINX module like OpenResty?
- kentonv 9y agoNope. It's a new stand-alone HTTP server. This lets us implement a tighter sandbox, since all the code is purpose-built for running inside it.
- neuland 9y agoThanks!
- ayosec 9y ago> It's a new stand-alone HTTP server. Are you going to publish more info about that HTTP server? Like the technology used to write it.
- kentonv 9y agoYeah, I'll probably write that up at some point. For now, here's the source code for the HTTP implementation. :) https://github.com/capnproto/capnproto/blob/master/c++/src/kj/compat/http.h https://github.com/capnproto/capnproto/blob/master/c++/src/k... https://github.com/capnproto/capnproto/blob/master/c++/src/kj/compat/http.c++ https://github.com/capnproto/capnproto/blob/master/c++/src/k... That's from the KJ C++ toolkit library, which is part of the Cap'n Proto project, which is my own work that predates my time at Cloudflare. We're using this in the Workers engine and updating the code as needed. Yes, I know, NIH syndrome. But it has been pretty handy to be able to jump in and make changes to the underlying HTTP code whenever we need to. I hope to spend some time writing better docs for KJ, then write a blog post all about it. The only major dependencies of the core Workers runtime are V8, KJ, and BoringSSL.
- ryanworl 9y agoCan a Cloudflare app install a worker into a Cloudflare customer’s zone?
- kentonv 9y agoNot yet, but with Workers launched this is now my top priority, and something we're all very excited about.
- graystevens 9y ago$0.50/million requests, but it’s a minimum of $5/month (giving you 10million requests essentially.) Not a criticism, this it looks like an excellent product for those who can benefit from it, just calling it out for others that read the comments here before the original content.
- zaarn 9y agoNow this is indeed quite interesting. Though 0.50 per million is only true if you have more than 10 million requests per month, otherwise the price will be higher since there is 5$ minimum.
- siscia 9y agoWhat I find missing here and in aws lambda or google function is the notion of "state". I believe it would really be a game changer if we could open and maintain an open connection with a database.
- ryanworl 9y agoIn Lambda and Cloud Functions you can open a connection with a database (or anything else) and it will stay alive across invocations of the same underlying container. Not sure how Cloudflare workers behaves here, but from their docs they recommend global variables a way to persist state, so perhaps an outbound TCP connection will stay alive across invocations of the same V8 "process".
- kentonv 9y agoWorkers only support HTTP requests, not raw TCP. So, no, at present you can't hold a database connection open, though you can make requests to HTTP-based storage APIs available from any number of providers.
- kentonv 9y agoIndeed, we want to provide storage, but easy-to-use storage that can scale to 100+ (or 1000+) nodes is tricky. We're working on it. :) PS. If you're a distributed storage expert and want to work on this, we're hiring!
- 9y ago
- neals 9y agoNot really into this space. What would be some usecases for this? Call an api, do a thing? Or more like, process some data and post the results?
- zackbloom 9y agoThere are some that people already think about doing on the edge, like complex caching rules, routing based on cookies, and edge side includes. Then there are things people are just starting to think about, like doing a/b testing by serving different variants from the edge and building their API gateway into the edge. Finally there are things people will only start dreaming of now that the tech is available, like filtering the massive stream of data coming in from IoT at the edge, or powering interactive experiences that require compute which individual machines don't have, but speed which centralization can't provide.
- thegoleffect 9y agoKenton said Workers don't have access to client's cookies, how can you do routing based on cookies with Workers?
- slig 9y agoThey don't have access to all the cookies in the users cookie jar, but since they work by intercepting requests, they can read the cookies that the browser send and act upon them.
- pbowyer 9y agoA great place to start is what companies like the Financial Times have been doing with Fastly. By pushing authentication to the edge [1] you can cache more. If you're receiving a lot of data in that you need to log and analyse later, you can use the Workers to redirect straight to your logging service - no servers involved [2]. 1. https://www.fastly.com/blog/how-solve-anything-vcl-part-3-authentication-and-feature-flags-edge https://www.fastly.com/blog/how-solve-anything-vcl-part-3-au... 2. Sorry, couldn't find the link. IIRC Fastly does this with its in-built logging feature.
- holtalanm 9y agothis looks like something that could be used to host an entire web app (sans database). Pretty cool!
- tombowditch 9y agoLooks very nice! Is the minimum cost ($5/m) per site or per account?
- jeswin 9y agoWill you be able to share how you sandbox these scripts?
- kentonv 9y agoWe have multiple layers of sandboxing. To start, each Worker runs in a separate V8 isolate (which is actually a stronger separation than Chrome uses to separate an iframe from a parent frame, by default). We also have an extremely tight seccomp filter, and a long list of other measures. We made an intentional decision early on to avoid providing any precise timers in Workers -- even Date.now() only returns the time of last I/O (so it doesn't advance during a tight loop). This proved to be a really good idea when Spectre hit. (But we also shipped V8's Spectre mitigations pretty much immediately when they appeared in git -- well before they landed in Chrome.)
- ggambetta 9y agoFWIW kentonv posting in this thread, who did this project, is the guy who invented protocol buffers :o
- ocdtrekkie 9y agoTechnically, Kenton made Protocol Buffers version 2, and open sourced it, I believe. Kenton did, however, make Cap'n Proto, which builds on what he learned from doing Protocol Buffers. And he also created Sandstorm.io, a self-hosting platform I am quite fond of. :)
- icebraining 9y ago+1 Sandstorm is awesome. And porting an app is not complicated, thanks to a sensible architecture and good documentation.
- deleted 9y ago[deleted]
- burner5692 9y agoBefore using a Cloudflare product, please consider if you want to contribute to the Internet's largest man-in-the-middle attack. They have a poor track record when it comes to security[0], privacy[1], and censorship[2]. We're at the point where it's our responsibility to protect the Internet and keep these companies in check. Cloudflare is among the worst existential threats to the Internet. [0]: https://gizmodo.com/everything-you-need-to-know-about-cloudbleed-the-lates-1792710616 https://gizmodo.com/everything-you-need-to-know-about-cloudb... [1]: https://blog.torproject.org/trouble-cloudflare https://blog.torproject.org/trouble-cloudflare [2]: https://www.nytimes.com/2017/09/13/opinion/cloudflare-daily-stormer-charlottesville.html https://www.nytimes.com/2017/09/13/opinion/cloudflare-daily-...
- keySmith 9y agoLet's not forget also scihub https://news.ycombinator.com/item?id=16310230 https://news.ycombinator.com/item?id=16310230
- ocdtrekkie 9y agoThis was in compliance with a court order. I, for one, am still relatively appreciative corporations can't go around willy-nilly refusing to obey legal orders from the government. If you have a problem with specific orders of our government, the correct avenue of upset is with them, or, should they be unwilling to change their position, by voting.
- John_KZ 9y agoThe prospect of scihub dying is terrifying, and scihub helped to push in that direction.
- stochastic_monk 9y agoAren’t they improving, though? They open-sourced a quantum resistant TLS implementation.
- burner5692 9y ago
- HugoDaniel 9y agoDo those workers have to complete a captcha ?
- thefounder 9y agoIs it possible to just change/rewrite the request origin like on AWS Edge?
- zackbloom 9y agoYes it is! You can make arbitrary requests in your Worker to anywhere on the internet you like, and return any response you like.
- thefounder 9y agoThe JS requests are limited to several MBs so you can't download large assets. This applies on AWS Edge too but on AWS you can modify the request's origin and then cloudfront agent (which has higher limits ) will perform the actual request using the origin you set.
- kentonv 9y agoThe Workers runtime fully supports streaming requests/responses. If you're just passing the response through, it does not get buffered in the worker, and it is not subject to the Worker's memory limit. You can absolutely download multi-gigabyte files through a Worker.
- kentonv 9y agoTo expand on that, when you invoke fetch() and get a Response object back, that object is returned as soon as response headers have been received; it does not wait for the body. The Response object contains a ReadableStream from which you can read the body, but if you instead pass the response directly to event.respondWith(), then it will stream right back out to the client.
- KayL 9y agoCan the playground show the resource limits info?
- zackbloom 9y agoIt's something we would love to expose in the future. That said, we have yet to see someone run into those limits (on purpose). The average worker runs with less than a ms CPU time.
- stevebmark 9y agoWasn't running code on edge nodes how Cloudflare man in the middle attacked millions of encrypted websites for a year?
- hashseed 9y agoIn what case should this be preferred over plain old Service Workers running on the user's browser? Latter is even lower latency and for free.
- mrkurt 9y agoIt's lower latency once you've delivered the javascript. There's a lot of interesting stuff you can do with edge applications. Image optimization/resizing, content rewrites, pre-rendering, API gateway, etc, etc, etc. These are all things you want to do once for many visitors. There's a lot you _can't_ do in a browser because browsers are untrusted. Edge applications can run with a different level of trust.
- kentonv 9y agoA few cases off the top of my head: - When you need to work with older browsers or non-browser clients (e.g. API clients!) that don't support service workers. - When it would be a security problem if the user can bypass or interfere with the worker (e.g. you can implement authentication in a CF Worker). - When you specifically want to optimize your use of the shared HTTP cache at the Cloudflare PoP. - When startup time of a service worker would be problematic. - When CORS would prevent you from making the requests you need from the browser side. (CORS doesn't apply to CF Workers, since the things CORS needs to protect against are inherent to the client-side environment.)
- jgrahamc 9y ago1. It's easy to maintain/update the code because it is pushed once to Cloudflare and you don't have to worry about browser caching effects on JavaScript delivered to the browser. 2. The performance of the code will be much higher than in the browser because of the server resources available and also because and subrequests will happen across Cloudflare's fast/reliable links and not whatever the end user is connected to. 3. The end user has control over what JavaScript is executed and might use a tool like Disconnect to block external scripts preventing the code from running at all. 4. Security: you can include things like API keys. 5. Script starts executing earlier. 6. Conserves bandwidth/battery life of mobile users.
- arpit 9y agoHow does this compare with running AWS Lambda's on CloudFront? https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-at-the-edge.html https://docs.aws.amazon.com/AmazonCloudFront/latest/Develope...
- emj 9y agoExciting times! Seems it's all about making a product that sells the features of serverless in the right way. Technically I would like websockets on these platforms, but I don't know how to sell that as a feature. These numbers 50 ms of compute time and 15 s idle are interesting in the serverless space. Now I'm waiting for sane performance suites to figure out what suites you, I'm guessin this solution will kill in these strange latency test for AWS lambda from the other day: https://news.ycombinator.com/item?id=16542286 https://news.ycombinator.com/item?id=16542286
- kentonv 9y ago> Technically I would like websockets on these platforms FWIW that's something I'm working on. It's tricky because it's not actually in the Service Workers standard. Currently, we support WebSocket pass-through (so if you do something like rewrite a request and return the response, and it happens to be a WebSocket handshake, it will "just work"), but haven't yet added support for terminating a WebSocket directly in a Worker (either as client or server).
- jkarneges 9y agoFanout (https://fanout.io https://fanout.io) is useful for handling raw WebSockets from a FaaS backend. Getting it to work with Cloudflare Workers is a little more involved since our Node libraries don't run in their Service Worker environment, but if you implement the negotiations manually it does work.
- bad_user 9y ago> Due to the immense amount of work that has gone into optimizing V8, it outperforms just about any popular server programming language with the possible exceptions of C/C++, Rust, and Go. Odd statement and it’s not true. I work with Node.js a lot, which is using V8 and have tested a lot of code cross compiled to both JavaScript and the JVM. As a matter of fact the JVM beats the shit out of V8 in everything but startup time. And this is not an educated guess, I have the same code, some cross-compiled via a compiler that can target both (plenty of such compilers these days, including Scala, Clojure and Kotlin) and some code hand optimized for each specific platform and the difference is huge in both cases. And let’s be clear, this is not code that handles numeric calculations, for which JS would be at a big disadvantage. Imagine that I’m not running the same unit tests, for JS I have to do much less interations in property based testing, because Travis-ci chokes on the JS tests. So it’s a constant pain that I feel weekly. And actually anybody that ever worked with both can attest to that. The performance of V8 is rather poor, except for startup time where the situation is reversed, V8 being amongst the best and the JVM amongst the worst if startup time matters.
- kentonv 9y agoYou're right, Java should have been included along with the other languages I mentioned. As a strongly-typed, compiled language, it should indeed beat V8 handily. I had intended to say that V8 outperforms other dynamically-typed languages like PHP, Python, Ruby, etc. But because startup time and RAM usage are so important to our use case, Java has never been in the running as a plausible implementation choice, so to be honest I sort of forgot about it. :/
- bad_user 9y agoYes, I admit the startup time for the JVM is terrible and your choice of V8 makes sense in that light. Plus indeed people will be able to use WebAssembly and compile languages like Rust to it.
- benjaminjackman 9y agoIt's funny I was writing ScalaJS for a while and one idea I had was to use it for jobs where startup time really mattered and then use the ScalaJVM for everything else. So I could kind of get the best of both worlds. It turned out we were able to live with the JVM startup time without any problems for needs so I never pursued it further. I think the big things coming down the pipe for the performance of each is: Value Types for java. A lot of what is needed can be done with sun.misc.unsafe already but it's an awkward way to have to program, I haven't kept up with it but hopefully it supports being dropped right onto memory mapped i/o for stuff like CapNProto style parsing. On the v8 side, I think wasm could be a massive game changer and basically eat everything in concert with javascript. I wonder how it's performance is going to stack up to true native / a warmed up jvm (that has done all the fun inlining optimizations that can make it so fast).
- JerryJoeJejinks 9y agoWould it be possible to have the worker cache api results from the origin and serve those from the edge? Would the best way be programmatically updating the worker code, or caching it via global memory?