20 ms·

Cloud Computing Without Containers

663 points by zackbloom 8y ago

z3t4 8y ago
If you know how long a request takes you can roughly calculate how many requests per second your server can handle ... When working in JavaScript/Node.JS one thing that is both sync and very slow (almost 1ms) is console.log ! So next time when running benchmarks, try removing the console.log's =) It's a mystery to me why we need millions of instructions just to put "hello world" in a pipe though. I'm thinking of learning low level programming, but I'm too scared of what I might find.
- ilaksh 8y ago
  That's what's nice about programming retro computers like the C64. The number of layers you have to dig through is small and doesn't lead to a lot of unnecessary bloat or lag.
polskibus 8y ago
The article says: "Unlike essentially every other cloud computing platform I know of, it doesn’t use containers or virtual machines. " Surely there were others before like Azure Service Fabric ?
- black-tea 8y ago
  Yeah, and that still exists doesn't it?
- wmf 8y ago
  Google App Engine also originally sort of relied on language sandboxing but it still had a separate process for each tenant.
- inopinatus 8y ago
  I’ve seen the automated provisioning and scheduling of jails and zones for application deployment, pretty much since they were invented. Automated UID provisioning for isolation and resource constraint and application package deployment, at least since the nineties. Ultimately most of us want to put files on a server and start a process. There’s just an endless variety of constantly re-invented ways to do that. Choose your scaffolding.
  - icebraining 8y ago
    Jails and Zones are essentially containers - they're ways of isolating process from each other by basically constraining what they can see and change, at the kernel level. What they're describing is actually running code from multiple people on the same process.
    - inopinatus 8y ago
      A process is any instance of a program that's being executed. That definition doesn't change whether it's a program running as an ordinary Unix process, as an Isolate in a V8 runtime in a container on a virtual machine on a bare-metal blade in a DC rack, or as a hypothetical MIPS-like CPU on my whiteboard. By "choose your scaffolding", I'm just saying "how much of the OS kernel would you like to re-invent?" That isn't a wholly cynical position. Doing so might introduce new capabilities or cost efficiencies, which seems to be Cloudflare's pitch. But very often we get excited by the possibilities and lose sight of the tons of additional stuff now required to achieve quite simple things. In the worst case (e.g. VMware) we end up re-inventing hardware abstraction, scheduling, networking, memory management, and filesystems i.e. most of the damn kernel. Docker is a less egregious offender but still deserving of the "too much scaffolding" label. In the very best outcome, the capability gets stripped down to the core enhancement and pushed back into the expectations for a base OS, which is for example why practically every OS now comes with a hypervisor and a container mechanism.
- Twirrim 8y ago
  Oracle provides bare metal instances on demand on the Oracle Cloud Infrastructure platform. There's literally no hypervisor or anything in the way. Other cloud providers also have bare metal instances as well.... it really seems such a bizarre claim that they made.
  - discodave 8y ago
    They are implicitly talking about Serverless / FaaS from other cloud platforms. Lambda, Google/Azure functions, arguably Google App Engine etc.
zapita 8y ago
Of course a language-specific sandbox with a highly restricted domain-specific API will be faster than an OS container or VM. The tradeoff is that it can run less applications unmodified, so less people can use it. I think Cloudflare workers are a cool implementation of domain-specific scripting. I’ve used it and it’s great. And with their scale I’m sure they’ll advance the state of the art in various ways. But there’s no radically new insight here.
- madmax96 8y ago
  Isn't the point of running these serverless components on data-centers closer to the edge to reduce latency in emerging IoT applications? My question is why would I want to run an unmodified application on this? Because of existing business logic in the form of shared libraries that I'd like to leverage, unmodified?
  - davemp 8y ago
    > My question is why would I want to run an unmodified application on this? Complete straw-man here, but this is what I envision: Ignorant businessmen buys a new silver bullet from a (potentially ignorant or malicious) salesperson or idea broker then wants you to "make it work" on the "serverless cloud". Most B2B software provides no reasonable method of determining if their product(s) actually work. So changing the amalgamation of your boss's silver bullets (your business application) requires the rebuilding of a hard won set of folk knowledge. This task is terrifying, unproductive, potentially impossible (non-permissive licenses), and something that most developers in this situation would like to avoid. Of course there are decent ways to avoid and/or address situations like the one described, but this seems close to what I've witnessed in industry.
    - mlthoughts2018 8y ago
      I actually have experienced basically the opposite sort of thing. There are monolothic applications and overly restrictive central IT processes where the “folk knowledge” you describe is basically a job-security obfuscation tactic for developers to wield political control and act as credit-mongering constraints on what other developer teams might want to do, under the guise of it all being for the safety or stability of the monoliths (which are already unstable and unsafe). Particularly in cases where multiplicity of different runtime environments is critical for innovation, this central IT bureaucracy can be totally killer. The worst is when outside consultants come in and just reinforce what the central IT people are already stonewalling with. For this reason, it can actually be great when new silver bullets come in from consultants who are able to break that hegemony. Sure, the silver bullets are dipshitty business crap, but if it at least offers a hook for using better modern tooling, you can successfully not die from the central IT crap. Then by showing the results of the new tools, you can undermine the “folk knowledge” gate keeper people, and force them to be honest about the declining business value of protecting the so-called stable legacy monoliths.
tschellenbach 8y ago
Wonder if you could build something similar using Go, A goroutine's overhead is only about 2KB. No idea how easy it would be to sandbox it.
- wmf 8y ago
  It wouldn't be easy at all to sandbox it; that's the problem with every language that isn't Java or JS. (And I think people gave up on Java sandboxing a decade or more ago.)
  - madmax96 8y ago
    What about JavaScript makes sandboxing easier than, say, Go, Python, etc?
    - wmf 8y ago
      Just the fact that it was designed for sandboxing hostile code from the beginning.
      - madmax96 8y ago
        How does that design actually manifest itself? I don't know very much about this - what technical details about JavaScript make this easier? And then why doesn't Node support this kind of sandboxing, but V8 does, if it's so much easier to support sandboxing than other languages?
        elithrar 8y ago
        Take a look here, at the V8 embedding docs: https://v8.dev/docs/embed https://v8.dev/docs/embed It specifically covers isolates vs. contexts, which should help contextualize it.
        jerf 8y ago
        The primary advantage is that it's already done, really. It's not hard to define isolated environments in almost any language you could name ("I should be able to have two runtime environments that support as much of the original language as possible, and they should not be able to affect each other" - a thousand i's to dot and t's to cross, but that pretty much captures the idea), but implementing them is another thing entirely. So much of the rest of language design tends to cut the other way, making sure that things are hooked together deeply for the convenience of the programmer. I'm not particularly convinced Javascript is that much better than any other language as the language goes, but the implementation is far ahead of almost anything else. I know of other implementations of this idea in other languages ("Safe" in Perl [1], various attempts at sandboxing in Python which have generally failed, Safe Haskell [2], many others), but without the browser use case driving them forward, they tend to be poorly tested and even decay over time. It tends to be a use case popular enough to get some stab at support, but not popular enough to quite result in a robust, real-world-tested library support. The browser is an exceptional use case. [1]: https://perldoc.perl.org/Safe.html https://perldoc.perl.org/Safe.html [2]: https://ghc.haskell.org/trac/ghc/wiki/SafeHaskell https://ghc.haskell.org/trac/ghc/wiki/SafeHaskell
deleted 8y ago
[deleted]
_wmd 8y ago
> Simultaneously, they don’t use a virtual machine or a container, which means you are actually running closer to the metal than any other form of cloud computing I’m aware of I recognize this is just a little marketing (which is fine), but I'm not sure what this is supposed to mean any more.. containers have identical efficiency to running on a raw VM, and VMs only trap to emulation in very few circumstances (e.g. IO) any time in the past decade. Running pure compute load in a container, guest VM or host VM should have almost identical performance.
- madmax96 8y ago
  Especially since containers use vanilla processes and light-weight access control mechanisms that I wager V8 uses some of. But they are running multiple client's services in the same process, so that's how they're saving - less context switching, smaller memory footprint, etc. I'm interested in how isolated the client's applications actually are...
  - iforgotpassword 8y ago
    Well, theoretically, perfectly. Practically, there's some exploits lingering in there for sure. But that's true for virtualizers too, so... As the article says, faster spinup (since v8 is already running) seems to be the customer's greatest advantage only, saving an order of magnitude of memory is certainly a big deal for the operator. I think since you can compile pretty Much anything to webassembly, porting over some existing tools might even be viable.
- kentonv 8y ago
  Running a single tenant in a container or VM should have the same performance as bare metal. The problems come when you want to scale the number of tenants, incurring RAM and context switching overhead. On these measures, containers are quite a bit lighter than VMs, but still quite a bit heavier than isolates. When you're only aiming to split a machine 10 ways, this might not matter, but we're targeting splitting a machine 10,000 ways, which calls for entirely new tech. (Disclosure: I'm the tech lead for Workers.)
deleted 8y ago
[deleted]
boulos 8y ago
Disclosure: I work at Google Cloud. Can you say more about the assumed security model here? We built gVisor [1] (and historically used nacl or ptrace) precisely because things like Isolates aren't (historically?!) trustworthy enough for side-by-side. Plus the whole V8-only ;). Edit: But let me say, I still think this is awesome (and love seeing more people jumping into the "just run code" space). [1] https://cloud.google.com/blog/products/gcp/open-sourcing-gvisor-a-sandboxed-container-runtime https://cloud.google.com/blog/products/gcp/open-sourcing-gvi...
- kodablah 8y ago
  Why aren't they trustworthy side-by-side? Due to lack of OS layers between them thereby making a cross-context vuln require only one step? Or inability to govern/throttle their resource use? In some instances in Chrome, aren't v8 context boundaries the only security between two scripts in the same process (though I know many second level domains get their own process, I don't remember what causes them to be shared)?
  - 7373737373 8y ago
    I would be very interested in an answer concerning resource accounting/control. It is possible to meter .wasm processes by transpiling their source to call an external metering function every time a code block is entered: https://github.com/ewasm/wasm-metering https://github.com/ewasm/wasm-metering I have not seen something like this demonstrated in a Javascript/high-level-language context yet.
  - amscanne 8y ago
    An address space provides some hardware isolation. Even if you ignore side channels, there's a lot that can go wrong in the software only case. I'm pretty sure that site isolation as a feature predated Meltdown and Spectre (though the default changed).
- kentonv 8y ago
  Hi, tech lead of Workers here. This is tricky to answer concisely because we've implemented a huge number and variety of defense-in-depth measures. (Plus, I'm in transit right now and can't type much -- maybe I'll edit to add more details later.) First, we believe Chrome has done a pretty good job hardening V8 over the years, and we get a lot of comfort knowing there's a $15,000 bug bounty for V8 breakouts. We update V8 continuously, tracking the version shipping in Chrome. That said, we obviously don't simply rely on V8 for everything. We've modeled what a V8 breakout is likely to look like, and added a variety of mitigations. Presumably, a V8 breakout bug is likely to allow an attacker to run arbitrary native code within the Workers runtime process. That's bad, but they will quickly run into some barriers to weaponizing this. For example, we obviously run with ASLR, so an attacker looking for other isolate's data would be flying blind and would likely raise segfaults. Any segfaults in production raise an alert and are investigated. Similarly, we run a tight seccomp fitler that denies all filesystem and network access, and if an attacker ever tries to invoke such syscalls, it will raise an alert and be investigated. It's worth noting that we do not allow eval() (or any other mechanism of "code generation from strings"), hence all code we execute has to have been uploaded through our code deployment pipeline. This implies we have a copy of all code. When a segfault raises an alert, we immediately look at the code that caused it. Anyone using a zero-day against us is very likely to burn their zero-day long before they manage to pull off a useful attack. You're probably also wondering about Spectre. Here's a previous comment of mine on that topic: https://news.ycombinator.com/item?id=18280156 https://news.ycombinator.com/item?id=18280156 Again, this is just a couple of the things we're doing... there's really too much to list in a HN comment. I hope to find time to write this up more formally in the future. :)
deleted 8y ago
[deleted]
luddy 8y ago
The article says that pushing a new lamda@edge function takes 30 minutes. That has not been my experience. I routinely push lambda@edge versions from the AWS console and the new versions typically run within a minute or so. Have others seen anything like a 30 minute propagation delay?
- jtokoph 8y ago
  I haven’t used lambda@edge but I have used lambda. Lambda deploys almost instantly from my experience.
- zackbloom 8y ago
  Lambda@Edge is built on Cloudfront and pushing any change to Cloudfront generally takes 20-30 minutes in my experience. Can you tell me more about the change you're making? Is it code or config changing?
  - luddy 8y ago
    I'm talking about using the Lambda@edge console to push a new, numbered version of a lambda function written in node.js. I have pushed 100s of versions in this way, and I would guess that the mean time until the new version begins running is on the order of one minute. By "begins running", I mean that the new version number appears in CloudWatch output. No other changes to config.
cfstras 8y ago
Gary Bernhardt kind-of predicted this. https://www.destroyallsoftware.com/talks/the-birth-and-death-of-javascript https://www.destroyallsoftware.com/talks/the-birth-and-death...
- aaimnr 8y ago
  Indeed! Amazing talk and amazing mind, thanks for sharing. Reminds me of Rich Hickey (whom he mentions in the talk), similarly independent and deep thinking from the first principles.
- MrRadar 8y ago
  The point about this approach being "closer to the metal" than other cloud providers definitely brought this talk to my mind. I just hope the nuclear war he also predicted for 2020 doesn't come to pass :/
- imhoguy 8y ago
  This will happen sooner than in 2030s: https://github.com/piranna/wasmachine https://github.com/piranna/wasmachine (WebAssembly on FPGA)
WrtCdEvrydy 8y ago
I would love to check this out... locally in my own computer ...for evaluation
- jeromegn 8y ago
  This is what we do at fly.io: https://github.com/superfly/fly https://github.com/superfly/fly It's based on node.js right now. It's a bit clunky, but we have many success stories of customers running it locally, on their CI and deploying to infrastructure. Currently the open source version is not the same as the production version (due to the distributed nature of our platform.) We're working on fixing that very soon and going all-in open source.
  - WrtCdEvrydy 8y ago
    And now you have my attention.
weberc2 8y ago
Do workers allow you to run init code on cold-boot only, or do you have to do all of your init with each request? If the latter, presumably that would also mean that a language like Go (compiled to wasm, obviously) would have its runtime start up with each request?
- kentonv 8y ago
  Yes, you can run init code at cold-start time. JavaScript's global scope is evaluated once per isolate created, and you would normally instantiate your WASM modules at the global scope as well.
deleted 8y ago
[deleted]
davidjnelson 8y ago
This is awesome. Would be even better if the cpu time could be increased. Right now it’s 5ms for smaller accounts, 50ms for business accounts ( ~$200/mo ), or custom for large customers.
- geostyx 8y ago
  What kinds of things are you wanting to do with more CPU time?
  - davidjnelson 8y ago
    Database and third party api access were the use cases that initially came to mind.
    - zbentley 8y ago
      Do you mean total runtime or actual CPU time? Total runtime would be affected by the use cases you mention; CPU time would not (or would not be affected nearly as much, at least). A function waiting on an HTTP response is not burning CPU.
      - davidjnelson 8y ago
        Interesting, I thought they were measuring runtime when they said cpu time. AWS Lambda is priced on runtime so I figured it would work the same. Thanks for pointing this out. I re-read the article and it is indeed cpu time not runtime for Cloudflare Workers. Sweet! The part of the article that clarifies this: > This is not meant to be a referendum on AWS billing, but it’s worth a quick mention as the economics are interesting. Lambdas are billed based on how long they run for. That billing is rounded up to the nearest 100 milliseconds, meaning people are overpaying for an average of 50 milliseconds every execution. Worse, they bill you for the entire time the Lambda is running, even if it’s just waiting for an external request to complete. As external requests can take hundreds or thousands of ms, you can end up paying ridiculous amounts at scale. > Isolates have such a small memory footprint that we, at least, can afford to only bill you while your code is actually executing. > In our case, due to the lower overhead, Workers end up being around 3x cheaper per CPU-cycle. A Worker offering 50 milliseconds of CPU is $0.50 per million requests, the equivalent Lambda is $1.84 per million. I believe lowering costs by 3x is a strong enough motivator that it alone will motivate companies to make the switch to Isolate-based providers.
fulafel 8y ago
> In an Isolate universe you have to either write your code in Javascript (we use a lot of TypeScript) [or Wasm] Not really: There are many nice managed languages that use JS as compile target. You can use ClojureScript, Scala, Purescript, Fable (F#), Haste (Haskell) etc.
- deleted 8y ago
  [deleted]
kentonv 8y ago
Hi, I'm the tech lead of Workers. Note that the core point here is multi-tenancy. With Isolates, we can host 10,000+ tenants on one machine -- something that's totally unrealistic with containers or VMs. Why does this matter? Two things: 1) It means we can run your code in many more places, because the cost of each additional location is so low. So, your code can run close to the end user rather than in a central location. 2) If your Worker makes requests to a third-party API that is also implemented as a Cloudflare Worker, this request doesn't even leave the machine. The other worker runs locally. The idea that you can have a stack of cloud services that depend on each other without incurring any latency or bandwidth costs will, I think, be game-changing.
- mdip 8y ago
  Greetings Tech Lead of Workers! I have yet to use this specific product and after reading the blog post I'm actually really frustrated that I didn't fully understand the things that I could do with Workers as I had a proof-of-concept app recently that would have been nice to test with since we've had issues with cold start delays on Lambda in similar projects in the past. And that second point that you make, above, ... holy cow; that's going to change the way I design systems and applications for customers. Personally speaking, I am a fan of CloudFlare like some of the more obsessed are fans of Apple[0]. Every time your company comes out with a new announcement, it's solves some problem I'm experiencing on projects at that moment. I could write paragraph after paragraph of all of the grief that using your services has eliminated from mine and my customer's lives, but I am certain you get that enough, already. There is no way my customer's appreciate your free tier as much as I, the developer, do. And your UX is awesome. Whichever one of your team mates designed the API button with instructions next to each option in the control panel as a way to onboard people to the API ... it's those stupid little things -- because that's there, when I'm setting up a client with a unique configuration for the first time, I start from a baseline, set it manually, test, and click into that link to see what commands I'm putting into the script should I have another client with similar needs. I probably wouldn't have thought to even look to see if you had an API were it not for those links. I'm excited to try out Workers next time I have a Lambda need that fits well. Keep up the good work -- it's taking a ton of grief out of my life. [0] A gentleman from your company sent me a T-Shirt for providing feedback for the Argo tunnel (called something different back then in beta) product -- you guys even do the damn T-Shirts right ... subtle logo on the shoulder and front, no words, and really soft cotton. It's my favorite "free vendor t-shirt" shirt. edit: A sentence ... got away from me and I had a dangling bullet
vloz 8y ago
Are you planning to release any free plan on workers as firebase cloud functions does? The current offer is 5$/month...
- geostyx 8y ago
  Is $5/month too much?
  - kamaln7 8y ago
    (not OP) It is for a side project that gets very little traffic. I'm still paying that $5/mo just to play with this tech but I can't say it's not too much for my use case. I guess that's not the target market for Workers anyway
kees99 8y ago
Very cool tech. But ridiculously expensive. According to [1] you pay $5 per 10,000,000 requests, <10ms each. That works out to less than 27.8 hours of CPU time per month. And that's assuming near-perfect utilization of that 10ms window and ignoring upfront cost of Pro plan, which this is an add-on to. Compare that to Linode/Hetzner/OVH/etc. where you get half-CPU for that money (i.e. 360 hours CPU time per month). And yeah, sure. Not apples-to-apples. FaaS, infinite scalability, yadda, yadda. But computing http responses is still computing http responses. Is this FaaS magic dust really worth 1400+% premium? [1] https://www.cloudflare.com/products/cloudflare-workers/ https://www.cloudflare.com/products/cloudflare-workers/
- kentonv 8y ago
  Another reason why this is not an apples-to-apples comparison is that most people don't run their VMs at 100% utilization. In fact, I'd wager the vast majority sit at single-digit percentages on average. Linode will still charge you for the full CPU, of course.
  - kees99 8y ago
    Well, CF always charges you for full 10,000,000 requests/mo too. Also, it is super-common (especially on low end) to offer burstable CPU VMs [1,2]. So you are not getting charged for full CPU, unless you specifically ask for it. [1] https://www.hetzner.com/cloud?country=us https://www.hetzner.com/cloud?country=us (bottom of the page, toggle between "default" and "dedicated CPU") [2] https://aws.amazon.com/ec2/instance-types/t3/ https://aws.amazon.com/ec2/instance-types/t3/ (product details, "Baseline Performance/vCPU" column)
    - geostyx 8y ago
      You aren't paying for Workers for the CPU time IMO, you're paying to be in 155 locations around the world so that your code runs closer to your user. You couldn't split a hetzner/ec2 box across locations like that. A lot can be accomplished in 10ms on Workers in my experience since they don't count waiting on network requests as part of that 10ms. If requests only require <10ms of CPU anyway, $5 per 10 million requests is pretty reasonable to me.
askaboutit 8y ago
$5 minimum. Overpriced compared to any other faas service. Can only run one worker at a time. No thanks!
thosakwe 8y ago
I know Dart isn't that loved on here, but I had a pretty similar idea a couple of weeks back, a PoC serverless platform using Dart's Isolates, which are shared-nothing: https://github.com/thosakwe/serverless_dart_platform https://github.com/thosakwe/serverless_dart_platform I know that the article briefly addressed security, but in my head, I can't even work out how they manage to securely manage multiple tenants within the same process. This isn't a knock on them, it's a lack of knowledge on my part, and I'm wondering how that would even work. Isolates in Dart can be run based on different dependency graphs (i.e. you can have an Isolate for user A's project, and a separate on for user B's, within the same process). However, things like the current working directory are shared by default. There's an IOOverrides class that lets you change this contextually, so theoretically you could hack something together that patches the entry point code to use it. I'm not sure how that could work in Node, though. What if someone were trying to overwrite another user's files? Overall, though, the #1 thing that I can't reconcile in my head is that if all the isolates are running in the same process, wouldn't they all have the same permissions? What is there to prevent someone from touching another person's files, or, if they run in the same process as the server, more sensitive data? AFAIK you can't run a Worker/Isolate as a different user within the same process? Not only that, but what about fork(2) bombs, etc.? The only thing I can think of is for Isolates to run under the context of some user who not only has no home directory, but also cannot spawn processes, or read/write/delete files. Lastly, the only other thing I can't work out is how whether the Isolates run in the same process as the server (and if so, how do they do this securely), or how they communicate with the separate process, if technically any Isolate could console.log (maybe via TCP sockets?). The whole CloudFlare workers concept is super cool... I just don't understand how it works. I feel like I'm missing some key here.
- skybrian 8y ago
  They don't provide access to the local filesystem at all.
- kentonv 8y ago
  Like JavaScript running in your browser, workers don't get direct access to files or other resources on the machine. We provide a limited API which only allows safe operations. Currently that means a Worker can send and receive HTTP requests, and read and write from Workers KV (a distributed storage system). We'll add more storage options in the future, but not raw disk access.
newnewpdro 8y ago
The implication this article makes that "containers" are somehow further from the metal than sandboxed javascript is disingenuous.
- zbentley 8y ago
  How so? Context switching has a cost, and the solution outlined within seems to achieve similar functionality while not paying nearly as much. The same is true for quota/resource management (what cgroups etc. would provide you with containers on Linux). I haven't used this, just read the same article you have, but the claim seems reasonable.
  - newnewpdro 8y ago
    You can run javascript in a container and its distance from the metal is no different than if you just ran the javascript outside of a container. Containers are just processes with limited visibility into the rest of the host, they're nothing like VMs. We've deliberately incurred the context switching costs of using multiple processes for decades because the hardware-enforced isolation of address spaces via the MMU is desirable. Of course you can gain efficiency by throwing away the multiprocess model and running separate security domains in the same address space of a single process, we're not breaking new ground here by going backwards.
z3t4 8y ago
This is cool. But why should I run stuff in a Cloud worker, when it can be run in the Browser's service worker !?
- elithrar 8y ago
  Different use-cases. You can do crypto operations in a hosted worker (sign/validate requests, auth clients), make caching decisions that don’t require you to consume (precious) client bandwidth, and make routing decisions based on both client properties (geo-location, auth state, etc) and server properties (backend uptime, latency, etc). A good example is HTTP middleware in your web framework of choice: there are things it does that can’t be done safely or correctly on the client, but that you may want to do at the edge before it hits your backend entirely.
- aaimnr 8y ago
  For all the reasons you use any kind of backend. To access authenticated resources, to persist data centrally, to share information between users, to hide your proprietary code...
lwansbrough 8y ago
This is awesome. I noticed the "In an Isolate universe you have to either write your code in Javascript (we use a lot of TypeScript), or a language which targets WebAssembly like Go or Rust" -- this is a very interesting statement! Being able to run wasm code means it could be possible to run .NET Core apps (really all I care about in the world right now) using such a system soon, thanks to work done for CoreRT (https://github.com/dotnet/corert https://github.com/dotnet/corert) Really really interested to see where this could lead.
zhobbs 8y ago
Fastly's CEO (a Cloudflare competitor) gave a pretty great tech talk on what it means to be isolated: https://www.youtube.com/watch?v=FkM1L8-qcjU https://www.youtube.com/watch?v=FkM1L8-qcjU Guessing we'll see a competitive product from Fastly in the near future.
- whorleater 8y ago
  It's important to note that for caching purposes, you can already run VCL (Varnish Cache Language) on Fastly's edge servers.
ilovecaching 8y ago
As someone who works for a large CDN and who has been working in the networking space for over two decades, the one thing that really bothers me about CF is how hyperbolic they are on their blog and twitter. >> Unlike essentially every other cloud computing platform I know of, it doesn’t use containers or virtual machines. This is light in comparison to their posts about QUIC, anycast geolocation, etc. They surely have done a lot of interesting work, but they'd lead you to believe they're hosting half the internet, and invented every advancement to CDNs in the last decade.
- deleted 8y ago
  [deleted]
- zackbloom 8y ago
  I'm sorry you feel that way. In general we feel like our biggest target with this language are the millions of people who wouldn't care about TLS 1.3, or QUIC, etc if we didn't make it clear how important they are. To us it's not about the people who know and love CDNs, it's all the people who don't, we're trying to speak to.
whoisjuan 8y ago
But this thing only runs JavaScript. The constant AWS bashing in this article doesn't make sense when the only fair comparison they can make here is AWS Lambda with a Node.js runtime against Cloudfare Workers.
- zackbloom 8y ago
  You can run any WebAssembly targeting language in a Worker.
  - theOldManTheBoa 8y ago
    Okay, so now I have to build a pipeline, to get my runtime into WebAssembly. I have to sit around and make that work. And ultimately, what does that actually look like, when fully realized in code? A sprawling mess of compromises, or a full rewrite. Sounds great.
- perbu 8y ago
  If you plan on using Javascript on Lambda the bashing makes perfect sense. So if want to write serverless functions in Go or Python you go somewhere else. But if you, as most other do, write them in Javascript, then this is a relevant platform to consider.
- luddy 8y ago
  AWS Lambda@edge only supports the node.js runtime, so a comparison between workers and lambda@edge isn't so unreasonable; they have very similar execution models, I think.
liquid153 8y ago
So does this mean my function(s) must be written in JavaScript? Or can it run wasm assemblies.
- geostyx 8y ago
  Both! https://blog.cloudflare.com/webassembly-on-cloudflare-workers/ https://blog.cloudflare.com/webassembly-on-cloudflare-worker...
fuball63 8y ago
I'm working on an experimental function as a service based on CGI apps. It has a lot of advantages of the article: - Process isolation - Close to hardware - No cold start But it also has some advantages like: - Any language, including compiled languages - Local testing, backed by a standard I am still experimenting with the scaling potential; my biggest concern is memory requirements. Currently I'm writing the project's blog using the project, and then am going to do some performance tests. It's hosted on a 5 dollar digital ocean instance at bigcgi.com. [edited for formatting]
- jchw 8y ago
  How would this not suffer from similar issues to Lambda? The start times are going to be worse per request than application servers today because all of the initialization can no longer be amortized. Long before containers became the hot new thing, people were using FastCGI to amortize these costs, and importantly, Scale - CGI requires expensive process creation on every request. You can't take advantage of fast, usermode context switching like with Goroutines or event-based architectures like Node.js because each request is a process in old-school CGI. And how doesn't that put you to square 1 with isolation? Cloudflare is running multi-tenant loads; you ideally want to have fine grained control on resource utilization and access controls. With CGI, you pretty much have to reinvent Docker to get the same level of isolation... I'm not sure I follow how this is superior to other solutions except for that CGI is easier to test locally.
  - fuball63 8y ago
    A fast-cgi implementation is something I've looked into if plain CGI is not fast enough. Initially I want to see what exactly the performance comparison is with plain CGI, and then iterate from there. As for resource utilization/constraints, it runs on freebsd and uses rctl to limit memory usage and number of processes. One thing I want to find out is how to balance user resource constraints with the total load of the shared server.
    - jchw 8y ago
      Oh, I see - so freebsd jails are used for this. At least for process isolation that seems like a solid approach. Still, I do wonder how much of the problem with containers is container overhead. To me a big difference is about what costs can be amortized. With CGI, pretty much every cost is paid at every request. With long running daemons, the per request overhead is removed. With Cloudflare's functions, the scheduling, request, and startup overhead are (theoretically) removed, leaving mostly just execution. With just CGI there's some win since you can drop the scheduling overhead, but I think you would probably lose that advantage as soon as you hit the upper limit where forking per request stops scaling. With FastCGI you can enable better scaling but since you now have to manage long running processes, you are officially in the scheduling business, though you could probably beat container scheduler like Kubernetes in terms of raw overhead. I don't know. Maybe this is a good idea, but I'll admit my first impression was mostly "isn't this just CGI as it always was?"
nickjj 8y ago
Really interesting article but the ending is a little weird. > This might mean Isolate-based Serverless is only for newer, more modern, applications in the immediate future. It sounds like you're implying unless your app is written with Node or Go / Rust then it must be legacy. That's not really fair to say. Plenty of modern apps are built with Python, Ruby and Elixir. I don't know if they are all webassembly compile targets, but in either case, you should probably rewrite that to be less "better write everything in Node or you're a dinosaur!".
- deleted 8y ago
  [deleted]
jeswin 8y ago
Do you have plans to open source this work? It'd be huge for p2p/decentralized apps. As of now, you can only decentralize data - this allows decentralized compute as well.
- iovoid 8y ago
  https://github.com/laverdet/isolated-vm https://github.com/laverdet/isolated-vm is similar, and used by a competitor that has a similar offer
sholladay 8y ago
So awesome to see this on the front page just a day after I was complaining about Docker on another HN thread. Seems like a very pragmatic system. Get some great benefits for a reasonably well defined and common use case (JavaScript apps that don't need to run external binaries), without doing anything crazy just to support apps that don't quite fit in the architecture. It might not work for everything, but for many apps this will be a very simple and low overhead solution. Kudos!
sriku 8y ago
Been exploring this idea in the app development context for a while now. I wished PNaCl had filled this role, but now think WebAssembly may take up this space instead as it has similar performance characteristics. The attraction of both these for us is that many languages can compile down to be run in wasm.
dblotsky 8y ago
> An Isolate-based system runs all of the code in a single process and uses its own mechanisms to ensure safe memory access. What property of this application allows it to share CPU time and memory more efficiently than the OS can?
nl 8y ago
There was a company Rackspace bought maybe 6 years ago that was building a semi-POSIX compatible layer on the v8 VM. They had Python running on it and it looked pretty interesting.
- nl 8y ago
  http://www.zerovm.org/ http://www.zerovm.org/ Not sure what progress has been made on it.
  - bklaasen 8y ago
    Looks like none in the past four years: https://github.com/zerovm/zerovm https://github.com/zerovm/zerovm
ilaksh 8y ago
So I'm guessing that in order to use modules from npm you use WebPack? And what's available is the same as a Service Worker in Chrome. So you can use http fetch but there is no raw socket etc. Does it support WebRTC (not sure if there is a way to actually use that on the server but maybe there is some weird use case for communicating between Workers). Also wondering what options there are for files or databases etc. It sounds like the design is for them to handle individual requests, but just out of curiousity, how long can the workers keep running?
- treelovinhippie 8y ago
  Yep I've got an index.js file that creates a simple API gateway via a basic switch() on the url pathname. Then individual files for each function. Bundle them into a single script with webpack and copy that into the Workers UI (there's an API for deployment too... eg can use Serverless Framework). 1MB max size, max 5-50ms CPU time, max 128MB RAM: https://developers.cloudflare.com/workers/writing-workers/resource-limits https://developers.cloudflare.com/workers/writing-workers/re... That said I've got a worker script running a pass-through websocket to GraphQL origin server and it keeps the connection open. I'm doing authentication within the worker too. Long-term I can see ability to run absolutely everything there: microservices, GraphQL server (Apollo has a beta), auth, static SPA files, SSR etc. $0.50 per million calls ($5/mth minimum). And they intend to be within 10ms ping of 99% of the global population. If they can workout how to do databases on the edge (they're working on it), then I can see a future where you could build scalable apps that serve millions of users for maybe less than $100/mth across the entire stack.
mleonhard 8y ago
Worker execution is limited to 15s of wallclock time. What happens if the client has a slow network connection and takes >15s to receive the HTTP response of a worker?
- zackbloom 8y ago
  It's actually required to _start_ all requests within 15 seconds, they can take longer before completing.
ing33k 8y ago
This tech can be a game changer for applications where latency matters more than others. My question is about portability of this. If I spend enough time and port certain parts of my application to this , will it be just tired to CF workers runtime ? Is it possible to run workers on other clouds ?
mleonhard 8y ago
I read through nearly all of the docs looking for testing guidance. How can I include a CloudFlare Worker in my automated integration tests?
mleonhard 8y ago
Can I get an automatic email when my Workers begin timing out? Will there be logs or graphs to help investigate such issues?
throwaway487548 8y ago
What, BSD jails all over again?
chaitanya 8y ago
I can’t believe Cloudflare would run untrusted customer code side by side with that of other customers. V8 isolates sound great but did the Chromium team have this threat model in mind when designing them? Not that long ago Cloudflare was bitten by a nasty bug where their own parser mixed up HTTP responses from different customers https://bugs.chromium.org/p/project-zero/issues/detail?id=1139 https://bugs.chromium.org/p/project-zero/issues/detail?id=11... Cloudflare’s response to this incident did not inspire a lot of confidence. What I am trying to say is that I won’t trust their workers implementation unless a competent external security researcher audits it. Edit: Related discussion https://news.ycombinator.com/item?id=18417257 https://news.ycombinator.com/item?id=18417257
- runeks 8y ago
  I'd have to agree with this. It sounds to me like Cloudflare is sacrificing security for performance in a fairly unpredictable manner. I also think the "Disadvantages"-section of the article casually skips the comparison of security between docker containers and V8 isolates.
- zackbloom 8y ago
  What about our response was lacking to you? I can tell you from the inside that huge amounts of code are being moved to rust to prevent that type of vulnerability from ever happening again.
  - chaitanya 8y ago
    > What about our response was lacking to you? Several observations recorded in the Project Zero report about CF's response were problematic: "I had a call with cloudflare, and explained that I was baffled why they were not sharing their notification with me." "They gave several excuses that didn't make sense, then asked to speak to me on the phone to explain. They assured me it was on the way and they just needed my PGP key. I provided it to them, then heard no further response." "I can already see that the (huge) list does not contain many pages that still have cached content from before the bug was fixed." "Cloudflare did finally send me a draft. It contains an excellent postmortem, but severely downplays the risk to customers." Granted, I have not been keeping up with what has changed at CF since then so maybe things are better. But the decisions taken wrt Workers doesn't inspire a lot of confidence. Even a Google Cloud engineer mentioned that Isolates probably aren't trustworthy enough to run untrusted code side-by-side https://news.ycombinator.com/item?id=18417257 https://news.ycombinator.com/item?id=18417257
neilwilson 8y ago
For quite a while now I've wondered why we do this. We take a physical computer and put a program on it that slices the machine up into multi-tenant abstractions called 'processes' so you can run more than one. Then somebody runs just one program on that machine in a process that uses all the machine that then slices the machine up into multi-tenant abstractions called 'X' (for various versions of X - isolates, containers, Erlang Actors, Database triggers). If the Unix process abstraction is no longer fit for all purposes, why don't we get around to de-layering the operating system so that the Unix process abstraction is just another 'Virtual Machine' sat on top of something more fundamental? Is it time for the return of the pure hypervisor?
- runeks 8y ago
  > If the Unix process abstraction is no longer fit for all purposes [...] Perhaps I'm misunderstanding you, but the Unix process abstraction was never meant to isolate processes from each other. It was designed to allow multiple processes to run on the same machine. On the other hand, the Unix OS was indeed designed to isolate itself from processes running on other Unix OS'es, which is exactly why we use the entire OS as the container of processes that need to be isolated.
- blasdel 8y ago
  You're asking for unikernels, which have had a recent renaissance: http://unikernel.org/projects/ http://unikernel.org/projects/ Some of the density advantages depended on Paravirtualization, which is quite difficult to make safe against Meltdown: https://xenbits.xen.org/xsa/advisory-254.html https://xenbits.xen.org/xsa/advisory-254.html
deleted 8y ago
[deleted]
xte 8y ago
Yes, "The Network is the Computer" (SUN's motto) and it's best implementation I know is Plan9 one. Which means me (user) at the center with my control on my system. Having anything on someone else computer it's not "The Network is the Computer" it's simply someone else computer. Also it can't scale, no matter how much you work on it, no matter what wonderful tech you create/integrate. Many now talk about edge computing because of that, and I fear it can succeed for a certain amount of time but still it can't scale. We are people, not puppet, we need to be autonomous and social, not a herd of sheep with very few shepherds.
craftoman 8y ago
Containers were always a crap. Everyone is bragging about speed and security. That's all bullshit, it's like jails for BSD. There are tons of exploits, same goes to speed. There is NOTHING comprared to bare metal, have you ever did any benchmark on applications cause my team did and find disturbing results enough to write an article and be king for one day. Docker is made for rock star developers, not rational system engineers.
- outime 8y ago
  It’s obvious that additional abstraction layers will add overhead. It’s also assumed that they add liabilities, no matter what you choose. So I’m not sure how your point is really applicable to container tech only.
  - craftoman 8y ago
    Containers are great for personal use only, not for enterprise industries. I myself have a bunch of containers running but beside simplicity of deployment I don't find them useful. That's what they made for, to actually save deployment time, not make things fast or secure.
- elithrar 8y ago
  That is completely untrue. Containers (distinct from the Docker /daemon/) provide significant security gains. Try breaking https://contained.af/ https://contained.af/
  - craftoman 8y ago
    I know it's kinda old but think about how many exploits are out there in the jungle. https://www.twistlock.com/labs-blog/escaping-docker-container-using-waitid-cve-2017-5123/ https://www.twistlock.com/labs-blog/escaping-docker-containe...
js4ever 8y ago
Cloudflare workers seems amazing and I would love to migrate few thousands of nodejs lambda I have to cf workers... But... I noticed the 1mb limit for the function size, most of my functions are between 1.5mb and 8mb depending on the npm packages required. Also execution time for my functions is between 200ms and 30sec. (Loading remote data, transform it, generate pdf,...) and workers are limited to 5-50ms!
- js4ever 8y ago
  I don't understand why I got a downvote... I'm really excited about cloudflare workers and hope they will overcome the actual limitations to make them usable for more use cases (including mine, this is why I have provided my metrics as a hint to cloudflare team)
- zackbloom 8y ago
  The time limits for Workers are actual CPU time, not clock time.
- remyg 8y ago
  Cloudflare Workers execution time is counted a little differently. When you call fetch() in a Worker and are waiting for remote data, Cloudflare doesn’t count that waiting towards the “execution time” limit. Other providers do. Note: I work at Cloudflare
rat9988 8y ago
Does the fact that a worker can run in one of the many data-centers of Cloudflare guarantee some sort of multi-regional redundancy/high-availability in case they have a problem with a region?
- zackbloom 8y ago
  Yes. One of our goals with this, not yet mentioned, is to get rid of the idea of availability zones or regions. Every worker runs in every data center. Any data center can be taken offline and traffic will be seemlessly rerouted at the BGP level.
  - rat9988 8y ago
    This is great news! In my opinion, you should emphasize a bit more on it in your writings. It's one of the most important factors. it was for us the central discussion point when were designing a platform for our webapp. We may reevaluate Cloudflare for the next iterations if you can provide this multiple-regions high-availability for your k/v store.
hinkley 8y ago
The longer we go down this road, the more the sales pitches feel like Erlang.
miguelmota 8y ago
Can someone shine some light on how secure Workers are compared to containers that use cgroups and namespaces for virtual isolation?
ZoomStop 8y ago
> Even more importantly: Amazon is bad. It is monopolistic [...] Its owner should have his immoral hoard of wealth forcibly expropriated by the state before his power grows so great that all of society is warped by it. That is a heck of a statement to make.
- ZoomStop 8y ago
  This was a reply to a different article, sorry.

663 points by zackbloom 8y ago

z3t4 8y ago

If you know how long a request takes you can roughly calculate how many requests per second your server can handle ... When working in JavaScript/Node.JS one thing that is both sync and very slow (almost 1ms) is console.log ! So next time when running benchmarks, try removing the console.log's =) It's a mystery to me why we need millions of instructions just to put "hello world" in a pipe though. I'm thinking of learning low level programming, but I'm too scared of what I might find.

ilaksh 8y ago
That's what's nice about programming retro computers like the C64. The number of layers you have to dig through is small and doesn't lead to a lot of unnecessary bloat or lag.

polskibus 8y ago

The article says: "Unlike essentially every other cloud computing platform I know of, it doesn’t use containers or virtual machines. " Surely there were others before like Azure Service Fabric ?

black-tea 8y ago
Yeah, and that still exists doesn't it?
wmf 8y ago
Google App Engine also originally sort of relied on language sandboxing but it still had a separate process for each tenant.
inopinatus 8y ago
I’ve seen the automated provisioning and scheduling of jails and zones for application deployment, pretty much since they were invented. Automated UID provisioning for isolation and resource constraint and application package deployment, at least since the nineties. Ultimately most of us want to put files on a server and start a process. There’s just an endless variety of constantly re-invented ways to do that. Choose your scaffolding.
- icebraining 8y ago
  Jails and Zones are essentially containers - they're ways of isolating process from each other by basically constraining what they can see and change, at the kernel level. What they're describing is actually running code from multiple people on the same process.
  - inopinatus 8y ago
    A process is any instance of a program that's being executed. That definition doesn't change whether it's a program running as an ordinary Unix process, as an Isolate in a V8 runtime in a container on a virtual machine on a bare-metal blade in a DC rack, or as a hypothetical MIPS-like CPU on my whiteboard. By "choose your scaffolding", I'm just saying "how much of the OS kernel would you like to re-invent?" That isn't a wholly cynical position. Doing so might introduce new capabilities or cost efficiencies, which seems to be Cloudflare's pitch. But very often we get excited by the possibilities and lose sight of the tons of additional stuff now required to achieve quite simple things. In the worst case (e.g. VMware) we end up re-inventing hardware abstraction, scheduling, networking, memory management, and filesystems i.e. most of the damn kernel. Docker is a less egregious offender but still deserving of the "too much scaffolding" label. In the very best outcome, the capability gets stripped down to the core enhancement and pushed back into the expectations for a base OS, which is for example why practically every OS now comes with a hypervisor and a container mechanism.
Twirrim 8y ago
Oracle provides bare metal instances on demand on the Oracle Cloud Infrastructure platform. There's literally no hypervisor or anything in the way. Other cloud providers also have bare metal instances as well.... it really seems such a bizarre claim that they made.
- discodave 8y ago
  They are implicitly talking about Serverless / FaaS from other cloud platforms. Lambda, Google/Azure functions, arguably Google App Engine etc.

zapita 8y ago

Of course a language-specific sandbox with a highly restricted domain-specific API will be faster than an OS container or VM. The tradeoff is that it can run less applications unmodified, so less people can use it. I think Cloudflare workers are a cool implementation of domain-specific scripting. I’ve used it and it’s great. And with their scale I’m sure they’ll advance the state of the art in various ways. But there’s no radically new insight here.

madmax96 8y ago
Isn't the point of running these serverless components on data-centers closer to the edge to reduce latency in emerging IoT applications? My question is why would I want to run an unmodified application on this? Because of existing business logic in the form of shared libraries that I'd like to leverage, unmodified?
- davemp 8y ago
  > My question is why would I want to run an unmodified application on this? Complete straw-man here, but this is what I envision: Ignorant businessmen buys a new silver bullet from a (potentially ignorant or malicious) salesperson or idea broker then wants you to "make it work" on the "serverless cloud". Most B2B software provides no reasonable method of determining if their product(s) actually work. So changing the amalgamation of your boss's silver bullets (your business application) requires the rebuilding of a hard won set of folk knowledge. This task is terrifying, unproductive, potentially impossible (non-permissive licenses), and something that most developers in this situation would like to avoid. Of course there are decent ways to avoid and/or address situations like the one described, but this seems close to what I've witnessed in industry.
  - mlthoughts2018 8y ago
    I actually have experienced basically the opposite sort of thing. There are monolothic applications and overly restrictive central IT processes where the “folk knowledge” you describe is basically a job-security obfuscation tactic for developers to wield political control and act as credit-mongering constraints on what other developer teams might want to do, under the guise of it all being for the safety or stability of the monoliths (which are already unstable and unsafe). Particularly in cases where multiplicity of different runtime environments is critical for innovation, this central IT bureaucracy can be totally killer. The worst is when outside consultants come in and just reinforce what the central IT people are already stonewalling with. For this reason, it can actually be great when new silver bullets come in from consultants who are able to break that hegemony. Sure, the silver bullets are dipshitty business crap, but if it at least offers a hook for using better modern tooling, you can successfully not die from the central IT crap. Then by showing the results of the new tools, you can undermine the “folk knowledge” gate keeper people, and force them to be honest about the declining business value of protecting the so-called stable legacy monoliths.

tschellenbach 8y ago

Wonder if you could build something similar using Go, A goroutine's overhead is only about 2KB. No idea how easy it would be to sandbox it.

wmf 8y ago
It wouldn't be easy at all to sandbox it; that's the problem with every language that isn't Java or JS. (And I think people gave up on Java sandboxing a decade or more ago.)
- madmax96 8y ago
  What about JavaScript makes sandboxing easier than, say, Go, Python, etc?
  - wmf 8y ago
    Just the fact that it was designed for sandboxing hostile code from the beginning.
    - madmax96 8y ago
      How does that design actually manifest itself? I don't know very much about this - what technical details about JavaScript make this easier? And then why doesn't Node support this kind of sandboxing, but V8 does, if it's so much easier to support sandboxing than other languages?
      - elithrar 8y ago
        Take a look here, at the V8 embedding docs: https://v8.dev/docs/embed https://v8.dev/docs/embed It specifically covers isolates vs. contexts, which should help contextualize it.
      - jerf 8y ago
        The primary advantage is that it's already done, really. It's not hard to define isolated environments in almost any language you could name ("I should be able to have two runtime environments that support as much of the original language as possible, and they should not be able to affect each other" - a thousand i's to dot and t's to cross, but that pretty much captures the idea), but implementing them is another thing entirely. So much of the rest of language design tends to cut the other way, making sure that things are hooked together deeply for the convenience of the programmer. I'm not particularly convinced Javascript is that much better than any other language as the language goes, but the implementation is far ahead of almost anything else. I know of other implementations of this idea in other languages ("Safe" in Perl [1], various attempts at sandboxing in Python which have generally failed, Safe Haskell [2], many others), but without the browser use case driving them forward, they tend to be poorly tested and even decay over time. It tends to be a use case popular enough to get some stab at support, but not popular enough to quite result in a robust, real-world-tested library support. The browser is an exceptional use case. [1]: https://perldoc.perl.org/Safe.html https://perldoc.perl.org/Safe.html [2]: https://ghc.haskell.org/trac/ghc/wiki/SafeHaskell https://ghc.haskell.org/trac/ghc/wiki/SafeHaskell

deleted 8y ago

[deleted]

_wmd 8y ago

> Simultaneously, they don’t use a virtual machine or a container, which means you are actually running closer to the metal than any other form of cloud computing I’m aware of I recognize this is just a little marketing (which is fine), but I'm not sure what this is supposed to mean any more.. containers have identical efficiency to running on a raw VM, and VMs only trap to emulation in very few circumstances (e.g. IO) any time in the past decade. Running pure compute load in a container, guest VM or host VM should have almost identical performance.

madmax96 8y ago
Especially since containers use vanilla processes and light-weight access control mechanisms that I wager V8 uses some of. But they are running multiple client's services in the same process, so that's how they're saving - less context switching, smaller memory footprint, etc. I'm interested in how isolated the client's applications actually are...
- iforgotpassword 8y ago
  Well, theoretically, perfectly. Practically, there's some exploits lingering in there for sure. But that's true for virtualizers too, so... As the article says, faster spinup (since v8 is already running) seems to be the customer's greatest advantage only, saving an order of magnitude of memory is certainly a big deal for the operator. I think since you can compile pretty Much anything to webassembly, porting over some existing tools might even be viable.
kentonv 8y ago
Running a single tenant in a container or VM should have the same performance as bare metal. The problems come when you want to scale the number of tenants, incurring RAM and context switching overhead. On these measures, containers are quite a bit lighter than VMs, but still quite a bit heavier than isolates. When you're only aiming to split a machine 10 ways, this might not matter, but we're targeting splitting a machine 10,000 ways, which calls for entirely new tech. (Disclosure: I'm the tech lead for Workers.)

deleted 8y ago

[deleted]

boulos 8y ago

Disclosure: I work at Google Cloud. Can you say more about the assumed security model here? We built gVisor [1] (and historically used nacl or ptrace) precisely because things like Isolates aren't (historically?!) trustworthy enough for side-by-side. Plus the whole V8-only ;). Edit: But let me say, I still think this is awesome (and love seeing more people jumping into the "just run code" space). [1] https://cloud.google.com/blog/products/gcp/open-sourcing-gvisor-a-sandboxed-container-runtime https://cloud.google.com/blog/products/gcp/open-sourcing-gvi...

kodablah 8y ago
Why aren't they trustworthy side-by-side? Due to lack of OS layers between them thereby making a cross-context vuln require only one step? Or inability to govern/throttle their resource use? In some instances in Chrome, aren't v8 context boundaries the only security between two scripts in the same process (though I know many second level domains get their own process, I don't remember what causes them to be shared)?
- 7373737373 8y ago
  I would be very interested in an answer concerning resource accounting/control. It is possible to meter .wasm processes by transpiling their source to call an external metering function every time a code block is entered: https://github.com/ewasm/wasm-metering https://github.com/ewasm/wasm-metering I have not seen something like this demonstrated in a Javascript/high-level-language context yet.
- amscanne 8y ago
  An address space provides some hardware isolation. Even if you ignore side channels, there's a lot that can go wrong in the software only case. I'm pretty sure that site isolation as a feature predated Meltdown and Spectre (though the default changed).
kentonv 8y ago
Hi, tech lead of Workers here. This is tricky to answer concisely because we've implemented a huge number and variety of defense-in-depth measures. (Plus, I'm in transit right now and can't type much -- maybe I'll edit to add more details later.) First, we believe Chrome has done a pretty good job hardening V8 over the years, and we get a lot of comfort knowing there's a $15,000 bug bounty for V8 breakouts. We update V8 continuously, tracking the version shipping in Chrome. That said, we obviously don't simply rely on V8 for everything. We've modeled what a V8 breakout is likely to look like, and added a variety of mitigations. Presumably, a V8 breakout bug is likely to allow an attacker to run arbitrary native code within the Workers runtime process. That's bad, but they will quickly run into some barriers to weaponizing this. For example, we obviously run with ASLR, so an attacker looking for other isolate's data would be flying blind and would likely raise segfaults. Any segfaults in production raise an alert and are investigated. Similarly, we run a tight seccomp fitler that denies all filesystem and network access, and if an attacker ever tries to invoke such syscalls, it will raise an alert and be investigated. It's worth noting that we do not allow eval() (or any other mechanism of "code generation from strings"), hence all code we execute has to have been uploaded through our code deployment pipeline. This implies we have a copy of all code. When a segfault raises an alert, we immediately look at the code that caused it. Anyone using a zero-day against us is very likely to burn their zero-day long before they manage to pull off a useful attack. You're probably also wondering about Spectre. Here's a previous comment of mine on that topic: https://news.ycombinator.com/item?id=18280156 https://news.ycombinator.com/item?id=18280156 Again, this is just a couple of the things we're doing... there's really too much to list in a HN comment. I hope to find time to write this up more formally in the future. :)

deleted 8y ago

[deleted]

luddy 8y ago

The article says that pushing a new lamda@edge function takes 30 minutes. That has not been my experience. I routinely push lambda@edge versions from the AWS console and the new versions typically run within a minute or so. Have others seen anything like a 30 minute propagation delay?

jtokoph 8y ago
I haven’t used lambda@edge but I have used lambda. Lambda deploys almost instantly from my experience.
zackbloom 8y ago
Lambda@Edge is built on Cloudfront and pushing any change to Cloudfront generally takes 20-30 minutes in my experience. Can you tell me more about the change you're making? Is it code or config changing?
- luddy 8y ago
  I'm talking about using the Lambda@edge console to push a new, numbered version of a lambda function written in node.js. I have pushed 100s of versions in this way, and I would guess that the mean time until the new version begins running is on the order of one minute. By "begins running", I mean that the new version number appears in CloudWatch output. No other changes to config.

cfstras 8y ago

Gary Bernhardt kind-of predicted this. https://www.destroyallsoftware.com/talks/the-birth-and-death-of-javascript https://www.destroyallsoftware.com/talks/the-birth-and-death...

aaimnr 8y ago
Indeed! Amazing talk and amazing mind, thanks for sharing. Reminds me of Rich Hickey (whom he mentions in the talk), similarly independent and deep thinking from the first principles.
MrRadar 8y ago
The point about this approach being "closer to the metal" than other cloud providers definitely brought this talk to my mind. I just hope the nuclear war he also predicted for 2020 doesn't come to pass :/
imhoguy 8y ago
This will happen sooner than in 2030s: https://github.com/piranna/wasmachine https://github.com/piranna/wasmachine (WebAssembly on FPGA)

WrtCdEvrydy 8y ago

I would love to check this out... locally in my own computer ...for evaluation

jeromegn 8y ago
This is what we do at fly.io: https://github.com/superfly/fly https://github.com/superfly/fly It's based on node.js right now. It's a bit clunky, but we have many success stories of customers running it locally, on their CI and deploying to infrastructure. Currently the open source version is not the same as the production version (due to the distributed nature of our platform.) We're working on fixing that very soon and going all-in open source.
- WrtCdEvrydy 8y ago
  And now you have my attention.

weberc2 8y ago

Do workers allow you to run init code on cold-boot only, or do you have to do all of your init with each request? If the latter, presumably that would also mean that a language like Go (compiled to wasm, obviously) would have its runtime start up with each request?

kentonv 8y ago
Yes, you can run init code at cold-start time. JavaScript's global scope is evaluated once per isolate created, and you would normally instantiate your WASM modules at the global scope as well.

deleted 8y ago

[deleted]

davidjnelson 8y ago

This is awesome. Would be even better if the cpu time could be increased. Right now it’s 5ms for smaller accounts, 50ms for business accounts ( ~$200/mo ), or custom for large customers.

geostyx 8y ago
What kinds of things are you wanting to do with more CPU time?
- davidjnelson 8y ago
  Database and third party api access were the use cases that initially came to mind.
  - zbentley 8y ago
    Do you mean total runtime or actual CPU time? Total runtime would be affected by the use cases you mention; CPU time would not (or would not be affected nearly as much, at least). A function waiting on an HTTP response is not burning CPU.
    - davidjnelson 8y ago
      Interesting, I thought they were measuring runtime when they said cpu time. AWS Lambda is priced on runtime so I figured it would work the same. Thanks for pointing this out. I re-read the article and it is indeed cpu time not runtime for Cloudflare Workers. Sweet! The part of the article that clarifies this: > This is not meant to be a referendum on AWS billing, but it’s worth a quick mention as the economics are interesting. Lambdas are billed based on how long they run for. That billing is rounded up to the nearest 100 milliseconds, meaning people are overpaying for an average of 50 milliseconds every execution. Worse, they bill you for the entire time the Lambda is running, even if it’s just waiting for an external request to complete. As external requests can take hundreds or thousands of ms, you can end up paying ridiculous amounts at scale. > Isolates have such a small memory footprint that we, at least, can afford to only bill you while your code is actually executing. > In our case, due to the lower overhead, Workers end up being around 3x cheaper per CPU-cycle. A Worker offering 50 milliseconds of CPU is $0.50 per million requests, the equivalent Lambda is $1.84 per million. I believe lowering costs by 3x is a strong enough motivator that it alone will motivate companies to make the switch to Isolate-based providers.

fulafel 8y ago

> In an Isolate universe you have to either write your code in Javascript (we use a lot of TypeScript) [or Wasm] Not really: There are many nice managed languages that use JS as compile target. You can use ClojureScript, Scala, Purescript, Fable (F#), Haste (Haskell) etc.

deleted 8y ago
[deleted]

kentonv 8y ago

Hi, I'm the tech lead of Workers. Note that the core point here is multi-tenancy. With Isolates, we can host 10,000+ tenants on one machine -- something that's totally unrealistic with containers or VMs. Why does this matter? Two things: 1) It means we can run your code in many more places, because the cost of each additional location is so low. So, your code can run close to the end user rather than in a central location. 2) If your Worker makes requests to a third-party API that is also implemented as a Cloudflare Worker, this request doesn't even leave the machine. The other worker runs locally. The idea that you can have a stack of cloud services that depend on each other without incurring any latency or bandwidth costs will, I think, be game-changing.

mdip 8y ago
Greetings Tech Lead of Workers! I have yet to use this specific product and after reading the blog post I'm actually really frustrated that I didn't fully understand the things that I could do with Workers as I had a proof-of-concept app recently that would have been nice to test with since we've had issues with cold start delays on Lambda in similar projects in the past. And that second point that you make, above, ... holy cow; that's going to change the way I design systems and applications for customers. Personally speaking, I am a fan of CloudFlare like some of the more obsessed are fans of Apple[0]. Every time your company comes out with a new announcement, it's solves some problem I'm experiencing on projects at that moment. I could write paragraph after paragraph of all of the grief that using your services has eliminated from mine and my customer's lives, but I am certain you get that enough, already. There is no way my customer's appreciate your free tier as much as I, the developer, do. And your UX is awesome. Whichever one of your team mates designed the API button with instructions next to each option in the control panel as a way to onboard people to the API ... it's those stupid little things -- because that's there, when I'm setting up a client with a unique configuration for the first time, I start from a baseline, set it manually, test, and click into that link to see what commands I'm putting into the script should I have another client with similar needs. I probably wouldn't have thought to even look to see if you had an API were it not for those links. I'm excited to try out Workers next time I have a Lambda need that fits well. Keep up the good work -- it's taking a ton of grief out of my life. [0] A gentleman from your company sent me a T-Shirt for providing feedback for the Argo tunnel (called something different back then in beta) product -- you guys even do the damn T-Shirts right ... subtle logo on the shoulder and front, no words, and really soft cotton. It's my favorite "free vendor t-shirt" shirt. edit: A sentence ... got away from me and I had a dangling bullet

vloz 8y ago

Are you planning to release any free plan on workers as firebase cloud functions does? The current offer is 5$/month...

geostyx 8y ago
Is $5/month too much?
- kamaln7 8y ago
  (not OP) It is for a side project that gets very little traffic. I'm still paying that $5/mo just to play with this tech but I can't say it's not too much for my use case. I guess that's not the target market for Workers anyway

kees99 8y ago

Very cool tech. But ridiculously expensive. According to [1] you pay $5 per 10,000,000 requests, <10ms each. That works out to less than 27.8 hours of CPU time per month. And that's assuming near-perfect utilization of that 10ms window and ignoring upfront cost of Pro plan, which this is an add-on to. Compare that to Linode/Hetzner/OVH/etc. where you get half-CPU for that money (i.e. 360 hours CPU time per month). And yeah, sure. Not apples-to-apples. FaaS, infinite scalability, yadda, yadda. But computing http responses is still computing http responses. Is this FaaS magic dust really worth 1400+% premium? [1] https://www.cloudflare.com/products/cloudflare-workers/ https://www.cloudflare.com/products/cloudflare-workers/

kentonv 8y ago
Another reason why this is not an apples-to-apples comparison is that most people don't run their VMs at 100% utilization. In fact, I'd wager the vast majority sit at single-digit percentages on average. Linode will still charge you for the full CPU, of course.
- kees99 8y ago
  Well, CF always charges you for full 10,000,000 requests/mo too. Also, it is super-common (especially on low end) to offer burstable CPU VMs [1,2]. So you are not getting charged for full CPU, unless you specifically ask for it. [1] https://www.hetzner.com/cloud?country=us https://www.hetzner.com/cloud?country=us (bottom of the page, toggle between "default" and "dedicated CPU") [2] https://aws.amazon.com/ec2/instance-types/t3/ https://aws.amazon.com/ec2/instance-types/t3/ (product details, "Baseline Performance/vCPU" column)
  - geostyx 8y ago
    You aren't paying for Workers for the CPU time IMO, you're paying to be in 155 locations around the world so that your code runs closer to your user. You couldn't split a hetzner/ec2 box across locations like that. A lot can be accomplished in 10ms on Workers in my experience since they don't count waiting on network requests as part of that 10ms. If requests only require <10ms of CPU anyway, $5 per 10 million requests is pretty reasonable to me.

askaboutit 8y ago

$5 minimum. Overpriced compared to any other faas service. Can only run one worker at a time. No thanks!

thosakwe 8y ago

I know Dart isn't that loved on here, but I had a pretty similar idea a couple of weeks back, a PoC serverless platform using Dart's Isolates, which are shared-nothing: https://github.com/thosakwe/serverless_dart_platform https://github.com/thosakwe/serverless_dart_platform I know that the article briefly addressed security, but in my head, I can't even work out how they manage to securely manage multiple tenants within the same process. This isn't a knock on them, it's a lack of knowledge on my part, and I'm wondering how that would even work. Isolates in Dart can be run based on different dependency graphs (i.e. you can have an Isolate for user A's project, and a separate on for user B's, within the same process). However, things like the current working directory are shared by default. There's an IOOverrides class that lets you change this contextually, so theoretically you could hack something together that patches the entry point code to use it. I'm not sure how that could work in Node, though. What if someone were trying to overwrite another user's files? Overall, though, the #1 thing that I can't reconcile in my head is that if all the isolates are running in the same process, wouldn't they all have the same permissions? What is there to prevent someone from touching another person's files, or, if they run in the same process as the server, more sensitive data? AFAIK you can't run a Worker/Isolate as a different user within the same process? Not only that, but what about fork(2) bombs, etc.? The only thing I can think of is for Isolates to run under the context of some user who not only has no home directory, but also cannot spawn processes, or read/write/delete files. Lastly, the only other thing I can't work out is how whether the Isolates run in the same process as the server (and if so, how do they do this securely), or how they communicate with the separate process, if technically any Isolate could console.log (maybe via TCP sockets?). The whole CloudFlare workers concept is super cool... I just don't understand how it works. I feel like I'm missing some key here.

skybrian 8y ago
They don't provide access to the local filesystem at all.
kentonv 8y ago
Like JavaScript running in your browser, workers don't get direct access to files or other resources on the machine. We provide a limited API which only allows safe operations. Currently that means a Worker can send and receive HTTP requests, and read and write from Workers KV (a distributed storage system). We'll add more storage options in the future, but not raw disk access.

newnewpdro 8y ago

The implication this article makes that "containers" are somehow further from the metal than sandboxed javascript is disingenuous.

zbentley 8y ago
How so? Context switching has a cost, and the solution outlined within seems to achieve similar functionality while not paying nearly as much. The same is true for quota/resource management (what cgroups etc. would provide you with containers on Linux). I haven't used this, just read the same article you have, but the claim seems reasonable.
- newnewpdro 8y ago
  You can run javascript in a container and its distance from the metal is no different than if you just ran the javascript outside of a container. Containers are just processes with limited visibility into the rest of the host, they're nothing like VMs. We've deliberately incurred the context switching costs of using multiple processes for decades because the hardware-enforced isolation of address spaces via the MMU is desirable. Of course you can gain efficiency by throwing away the multiprocess model and running separate security domains in the same address space of a single process, we're not breaking new ground here by going backwards.

z3t4 8y ago

This is cool. But why should I run stuff in a Cloud worker, when it can be run in the Browser's service worker !?

elithrar 8y ago
Different use-cases. You can do crypto operations in a hosted worker (sign/validate requests, auth clients), make caching decisions that don’t require you to consume (precious) client bandwidth, and make routing decisions based on both client properties (geo-location, auth state, etc) and server properties (backend uptime, latency, etc). A good example is HTTP middleware in your web framework of choice: there are things it does that can’t be done safely or correctly on the client, but that you may want to do at the edge before it hits your backend entirely.
aaimnr 8y ago
For all the reasons you use any kind of backend. To access authenticated resources, to persist data centrally, to share information between users, to hide your proprietary code...

lwansbrough 8y ago

This is awesome. I noticed the "In an Isolate universe you have to either write your code in Javascript (we use a lot of TypeScript), or a language which targets WebAssembly like Go or Rust" -- this is a very interesting statement! Being able to run wasm code means it could be possible to run .NET Core apps (really all I care about in the world right now) using such a system soon, thanks to work done for CoreRT (https://github.com/dotnet/corert https://github.com/dotnet/corert) Really really interested to see where this could lead.

zhobbs 8y ago

Fastly's CEO (a Cloudflare competitor) gave a pretty great tech talk on what it means to be isolated: https://www.youtube.com/watch?v=FkM1L8-qcjU https://www.youtube.com/watch?v=FkM1L8-qcjU Guessing we'll see a competitive product from Fastly in the near future.

whorleater 8y ago
It's important to note that for caching purposes, you can already run VCL (Varnish Cache Language) on Fastly's edge servers.

ilovecaching 8y ago

As someone who works for a large CDN and who has been working in the networking space for over two decades, the one thing that really bothers me about CF is how hyperbolic they are on their blog and twitter. >> Unlike essentially every other cloud computing platform I know of, it doesn’t use containers or virtual machines. This is light in comparison to their posts about QUIC, anycast geolocation, etc. They surely have done a lot of interesting work, but they'd lead you to believe they're hosting half the internet, and invented every advancement to CDNs in the last decade.

deleted 8y ago
[deleted]
zackbloom 8y ago
I'm sorry you feel that way. In general we feel like our biggest target with this language are the millions of people who wouldn't care about TLS 1.3, or QUIC, etc if we didn't make it clear how important they are. To us it's not about the people who know and love CDNs, it's all the people who don't, we're trying to speak to.

whoisjuan 8y ago

But this thing only runs JavaScript. The constant AWS bashing in this article doesn't make sense when the only fair comparison they can make here is AWS Lambda with a Node.js runtime against Cloudfare Workers.

zackbloom 8y ago
You can run any WebAssembly targeting language in a Worker.
- theOldManTheBoa 8y ago
  Okay, so now I have to build a pipeline, to get my runtime into WebAssembly. I have to sit around and make that work. And ultimately, what does that actually look like, when fully realized in code? A sprawling mess of compromises, or a full rewrite. Sounds great.
perbu 8y ago
If you plan on using Javascript on Lambda the bashing makes perfect sense. So if want to write serverless functions in Go or Python you go somewhere else. But if you, as most other do, write them in Javascript, then this is a relevant platform to consider.
luddy 8y ago
AWS Lambda@edge only supports the node.js runtime, so a comparison between workers and lambda@edge isn't so unreasonable; they have very similar execution models, I think.

liquid153 8y ago

So does this mean my function(s) must be written in JavaScript? Or can it run wasm assemblies.

geostyx 8y ago
Both! https://blog.cloudflare.com/webassembly-on-cloudflare-workers/ https://blog.cloudflare.com/webassembly-on-cloudflare-worker...

fuball63 8y ago

I'm working on an experimental function as a service based on CGI apps. It has a lot of advantages of the article: - Process isolation - Close to hardware - No cold start But it also has some advantages like: - Any language, including compiled languages - Local testing, backed by a standard I am still experimenting with the scaling potential; my biggest concern is memory requirements. Currently I'm writing the project's blog using the project, and then am going to do some performance tests. It's hosted on a 5 dollar digital ocean instance at bigcgi.com. [edited for formatting]

jchw 8y ago
How would this not suffer from similar issues to Lambda? The start times are going to be worse per request than application servers today because all of the initialization can no longer be amortized. Long before containers became the hot new thing, people were using FastCGI to amortize these costs, and importantly, Scale - CGI requires expensive process creation on every request. You can't take advantage of fast, usermode context switching like with Goroutines or event-based architectures like Node.js because each request is a process in old-school CGI. And how doesn't that put you to square 1 with isolation? Cloudflare is running multi-tenant loads; you ideally want to have fine grained control on resource utilization and access controls. With CGI, you pretty much have to reinvent Docker to get the same level of isolation... I'm not sure I follow how this is superior to other solutions except for that CGI is easier to test locally.
- fuball63 8y ago
  A fast-cgi implementation is something I've looked into if plain CGI is not fast enough. Initially I want to see what exactly the performance comparison is with plain CGI, and then iterate from there. As for resource utilization/constraints, it runs on freebsd and uses rctl to limit memory usage and number of processes. One thing I want to find out is how to balance user resource constraints with the total load of the shared server.
  - jchw 8y ago
    Oh, I see - so freebsd jails are used for this. At least for process isolation that seems like a solid approach. Still, I do wonder how much of the problem with containers is container overhead. To me a big difference is about what costs can be amortized. With CGI, pretty much every cost is paid at every request. With long running daemons, the per request overhead is removed. With Cloudflare's functions, the scheduling, request, and startup overhead are (theoretically) removed, leaving mostly just execution. With just CGI there's some win since you can drop the scheduling overhead, but I think you would probably lose that advantage as soon as you hit the upper limit where forking per request stops scaling. With FastCGI you can enable better scaling but since you now have to manage long running processes, you are officially in the scheduling business, though you could probably beat container scheduler like Kubernetes in terms of raw overhead. I don't know. Maybe this is a good idea, but I'll admit my first impression was mostly "isn't this just CGI as it always was?"

nickjj 8y ago

Really interesting article but the ending is a little weird. > This might mean Isolate-based Serverless is only for newer, more modern, applications in the immediate future. It sounds like you're implying unless your app is written with Node or Go / Rust then it must be legacy. That's not really fair to say. Plenty of modern apps are built with Python, Ruby and Elixir. I don't know if they are all webassembly compile targets, but in either case, you should probably rewrite that to be less "better write everything in Node or you're a dinosaur!".

deleted 8y ago
[deleted]

jeswin 8y ago

Do you have plans to open source this work? It'd be huge for p2p/decentralized apps. As of now, you can only decentralize data - this allows decentralized compute as well.

iovoid 8y ago
https://github.com/laverdet/isolated-vm https://github.com/laverdet/isolated-vm is similar, and used by a competitor that has a similar offer

sholladay 8y ago

So awesome to see this on the front page just a day after I was complaining about Docker on another HN thread. Seems like a very pragmatic system. Get some great benefits for a reasonably well defined and common use case (JavaScript apps that don't need to run external binaries), without doing anything crazy just to support apps that don't quite fit in the architecture. It might not work for everything, but for many apps this will be a very simple and low overhead solution. Kudos!

sriku 8y ago

Been exploring this idea in the app development context for a while now. I wished PNaCl had filled this role, but now think WebAssembly may take up this space instead as it has similar performance characteristics. The attraction of both these for us is that many languages can compile down to be run in wasm.

dblotsky 8y ago

> An Isolate-based system runs all of the code in a single process and uses its own mechanisms to ensure safe memory access. What property of this application allows it to share CPU time and memory more efficiently than the OS can?

nl 8y ago

There was a company Rackspace bought maybe 6 years ago that was building a semi-POSIX compatible layer on the v8 VM. They had Python running on it and it looked pretty interesting.

nl 8y ago
http://www.zerovm.org/ http://www.zerovm.org/ Not sure what progress has been made on it.
- bklaasen 8y ago
  Looks like none in the past four years: https://github.com/zerovm/zerovm https://github.com/zerovm/zerovm

ilaksh 8y ago

So I'm guessing that in order to use modules from npm you use WebPack? And what's available is the same as a Service Worker in Chrome. So you can use http fetch but there is no raw socket etc. Does it support WebRTC (not sure if there is a way to actually use that on the server but maybe there is some weird use case for communicating between Workers). Also wondering what options there are for files or databases etc. It sounds like the design is for them to handle individual requests, but just out of curiousity, how long can the workers keep running?

treelovinhippie 8y ago
Yep I've got an index.js file that creates a simple API gateway via a basic switch() on the url pathname. Then individual files for each function. Bundle them into a single script with webpack and copy that into the Workers UI (there's an API for deployment too... eg can use Serverless Framework). 1MB max size, max 5-50ms CPU time, max 128MB RAM: https://developers.cloudflare.com/workers/writing-workers/resource-limits https://developers.cloudflare.com/workers/writing-workers/re... That said I've got a worker script running a pass-through websocket to GraphQL origin server and it keeps the connection open. I'm doing authentication within the worker too. Long-term I can see ability to run absolutely everything there: microservices, GraphQL server (Apollo has a beta), auth, static SPA files, SSR etc. $0.50 per million calls ($5/mth minimum). And they intend to be within 10ms ping of 99% of the global population. If they can workout how to do databases on the edge (they're working on it), then I can see a future where you could build scalable apps that serve millions of users for maybe less than $100/mth across the entire stack.

mleonhard 8y ago

Worker execution is limited to 15s of wallclock time. What happens if the client has a slow network connection and takes >15s to receive the HTTP response of a worker?

zackbloom 8y ago
It's actually required to _start_ all requests within 15 seconds, they can take longer before completing.

ing33k 8y ago

This tech can be a game changer for applications where latency matters more than others. My question is about portability of this. If I spend enough time and port certain parts of my application to this , will it be just tired to CF workers runtime ? Is it possible to run workers on other clouds ?

mleonhard 8y ago

I read through nearly all of the docs looking for testing guidance. How can I include a CloudFlare Worker in my automated integration tests?

mleonhard 8y ago

Can I get an automatic email when my Workers begin timing out? Will there be logs or graphs to help investigate such issues?

throwaway487548 8y ago

What, BSD jails all over again?

chaitanya 8y ago

I can’t believe Cloudflare would run untrusted customer code side by side with that of other customers. V8 isolates sound great but did the Chromium team have this threat model in mind when designing them? Not that long ago Cloudflare was bitten by a nasty bug where their own parser mixed up HTTP responses from different customers https://bugs.chromium.org/p/project-zero/issues/detail?id=1139 https://bugs.chromium.org/p/project-zero/issues/detail?id=11... Cloudflare’s response to this incident did not inspire a lot of confidence. What I am trying to say is that I won’t trust their workers implementation unless a competent external security researcher audits it. Edit: Related discussion https://news.ycombinator.com/item?id=18417257 https://news.ycombinator.com/item?id=18417257

runeks 8y ago
I'd have to agree with this. It sounds to me like Cloudflare is sacrificing security for performance in a fairly unpredictable manner. I also think the "Disadvantages"-section of the article casually skips the comparison of security between docker containers and V8 isolates.
zackbloom 8y ago
What about our response was lacking to you? I can tell you from the inside that huge amounts of code are being moved to rust to prevent that type of vulnerability from ever happening again.
- chaitanya 8y ago
  > What about our response was lacking to you? Several observations recorded in the Project Zero report about CF's response were problematic: "I had a call with cloudflare, and explained that I was baffled why they were not sharing their notification with me." "They gave several excuses that didn't make sense, then asked to speak to me on the phone to explain. They assured me it was on the way and they just needed my PGP key. I provided it to them, then heard no further response." "I can already see that the (huge) list does not contain many pages that still have cached content from before the bug was fixed." "Cloudflare did finally send me a draft. It contains an excellent postmortem, but severely downplays the risk to customers." Granted, I have not been keeping up with what has changed at CF since then so maybe things are better. But the decisions taken wrt Workers doesn't inspire a lot of confidence. Even a Google Cloud engineer mentioned that Isolates probably aren't trustworthy enough to run untrusted code side-by-side https://news.ycombinator.com/item?id=18417257 https://news.ycombinator.com/item?id=18417257

neilwilson 8y ago

For quite a while now I've wondered why we do this. We take a physical computer and put a program on it that slices the machine up into multi-tenant abstractions called 'processes' so you can run more than one. Then somebody runs just one program on that machine in a process that uses all the machine that then slices the machine up into multi-tenant abstractions called 'X' (for various versions of X - isolates, containers, Erlang Actors, Database triggers). If the Unix process abstraction is no longer fit for all purposes, why don't we get around to de-layering the operating system so that the Unix process abstraction is just another 'Virtual Machine' sat on top of something more fundamental? Is it time for the return of the pure hypervisor?

runeks 8y ago
> If the Unix process abstraction is no longer fit for all purposes [...] Perhaps I'm misunderstanding you, but the Unix process abstraction was never meant to isolate processes from each other. It was designed to allow multiple processes to run on the same machine. On the other hand, the Unix OS was indeed designed to isolate itself from processes running on other Unix OS'es, which is exactly why we use the entire OS as the container of processes that need to be isolated.
blasdel 8y ago
You're asking for unikernels, which have had a recent renaissance: http://unikernel.org/projects/ http://unikernel.org/projects/ Some of the density advantages depended on Paravirtualization, which is quite difficult to make safe against Meltdown: https://xenbits.xen.org/xsa/advisory-254.html https://xenbits.xen.org/xsa/advisory-254.html

deleted 8y ago

[deleted]

xte 8y ago

Yes, "The Network is the Computer" (SUN's motto) and it's best implementation I know is Plan9 one. Which means me (user) at the center with my control on my system. Having anything on someone else computer it's not "The Network is the Computer" it's simply someone else computer. Also it can't scale, no matter how much you work on it, no matter what wonderful tech you create/integrate. Many now talk about edge computing because of that, and I fear it can succeed for a certain amount of time but still it can't scale. We are people, not puppet, we need to be autonomous and social, not a herd of sheep with very few shepherds.

craftoman 8y ago

Containers were always a crap. Everyone is bragging about speed and security. That's all bullshit, it's like jails for BSD. There are tons of exploits, same goes to speed. There is NOTHING comprared to bare metal, have you ever did any benchmark on applications cause my team did and find disturbing results enough to write an article and be king for one day. Docker is made for rock star developers, not rational system engineers.

outime 8y ago
It’s obvious that additional abstraction layers will add overhead. It’s also assumed that they add liabilities, no matter what you choose. So I’m not sure how your point is really applicable to container tech only.
- craftoman 8y ago
  Containers are great for personal use only, not for enterprise industries. I myself have a bunch of containers running but beside simplicity of deployment I don't find them useful. That's what they made for, to actually save deployment time, not make things fast or secure.
elithrar 8y ago
That is completely untrue. Containers (distinct from the Docker /daemon/) provide significant security gains. Try breaking https://contained.af/ https://contained.af/
- craftoman 8y ago
  I know it's kinda old but think about how many exploits are out there in the jungle. https://www.twistlock.com/labs-blog/escaping-docker-container-using-waitid-cve-2017-5123/ https://www.twistlock.com/labs-blog/escaping-docker-containe...

js4ever 8y ago

Cloudflare workers seems amazing and I would love to migrate few thousands of nodejs lambda I have to cf workers... But... I noticed the 1mb limit for the function size, most of my functions are between 1.5mb and 8mb depending on the npm packages required. Also execution time for my functions is between 200ms and 30sec. (Loading remote data, transform it, generate pdf,...) and workers are limited to 5-50ms!

js4ever 8y ago
I don't understand why I got a downvote... I'm really excited about cloudflare workers and hope they will overcome the actual limitations to make them usable for more use cases (including mine, this is why I have provided my metrics as a hint to cloudflare team)
zackbloom 8y ago
The time limits for Workers are actual CPU time, not clock time.
remyg 8y ago
Cloudflare Workers execution time is counted a little differently. When you call fetch() in a Worker and are waiting for remote data, Cloudflare doesn’t count that waiting towards the “execution time” limit. Other providers do. Note: I work at Cloudflare

rat9988 8y ago

Does the fact that a worker can run in one of the many data-centers of Cloudflare guarantee some sort of multi-regional redundancy/high-availability in case they have a problem with a region?

zackbloom 8y ago
Yes. One of our goals with this, not yet mentioned, is to get rid of the idea of availability zones or regions. Every worker runs in every data center. Any data center can be taken offline and traffic will be seemlessly rerouted at the BGP level.
- rat9988 8y ago
  This is great news! In my opinion, you should emphasize a bit more on it in your writings. It's one of the most important factors. it was for us the central discussion point when were designing a platform for our webapp. We may reevaluate Cloudflare for the next iterations if you can provide this multiple-regions high-availability for your k/v store.

hinkley 8y ago

The longer we go down this road, the more the sales pitches feel like Erlang.

miguelmota 8y ago

Can someone shine some light on how secure Workers are compared to containers that use cgroups and namespaces for virtual isolation?

ZoomStop 8y ago

> Even more importantly: Amazon is bad. It is monopolistic [...] Its owner should have his immoral hoard of wealth forcibly expropriated by the state before his power grows so great that all of society is warped by it. That is a heck of a statement to make.

ZoomStop 8y ago
This was a reply to a different article, sorry.