17 ms·

Cloudflare launches Workers Unbound, next evolution of its serverless platform

250 points by skolos 6y ago

pier25 6y ago
I've run into 3 big limitations when using Workers: 1) The CPU limit. 2) Not being able to use Node modules. 3) Not being able to add domains other than adding those to our CF account. SSL for SaaS solves this but, so far, it's only available to enterprise customers. The CPU limit was not so bad when considering Workers were not intended as a general use-case for serverless functions. Now that this has been lifted I feel the Workers environment limitations are going to be much more important. You can't, for example, use many Node packages in Workers since these are running in a custom V8 environment which resembles browser service workers. I say "resembles" because the API is not 100% identical. For example, you can use streams, but you don't get the full API.
- ctvo 6y ago
  This is a major dealbreaker that it needs to be called out earlier. Not only is this an interface you adhere to to use their service (incoming event, outgoing response), that type of coupling is fair and expected, but the underlying runtime is custom without full support for standard APIs?! What's the upgrade path? Can they port things over in a reasonable amount of time? Is it well documented what's supported and what isn't? Imagine developing against this and resolving these issues as they come up. Oof. I'll use Azure or AWS.
  - pier25 6y ago
    > Is it well documented what's supported and what isn't? No, not really. For example, I experimented a bit with streaming HTML but then hit a roadblock because ByteLengthQueuingStrategy wasn't available.
- jFriedensreich 6y ago
  A different runtime from nodejs is more a feature than an issue. The worker runtime is much closer to deno than to nodejs from a philosophy standpoint and i expect a lot of synergies between cf workers and deno in the future. the cf workers being as much compatible with the service worker api as possible makes them the only faas solution close to a web standard, so vendor lockin will only be an issue until compatible offerings appear. A killer argument for this approach is also that you can be sure you can run the cf worker code also in a browsers service worker (with minimal modification). This allows more flexible architectures and also more unified development between backend and frontend.
  - jFriedensreich 6y ago
    Also regarding the domains: cloudflare routes the requests to the edge centers based on dns anycast, so cloudflare workers cannot really be seperated from the dns functionality of cloudflare, see it as a faas offering inside your worldwide distributed dns. If that is not what you want, it is still possible to use cf workers with worker domains and use your own domain and dns setup
    - pier25 6y ago
      My point is not so much about the tech but actually that SSL for SaaS is out of reach for most startups or small tech companies.
      - jFriedensreich 6y ago
        ahhh, sorry i did not know "SSL for SaaS" was a product name for a specific feature. I totally agree, this would have been really nice to be able to offer my clients, but is currently not really accessible. There are a few things like this such as custom error page etc. Lets hope more enterprise offerings will be more accessible for smaller projects in the future...
  - pier25 6y ago
    I totally get that, but it's just a limitation that is not obvious at first.
    - jFriedensreich 6y ago
      true, cloudflare communicates that extremly well in talks they give about it and online presentations, but the documentation is often not as easy to read
- nyxtom 6y ago
  Apart from simple functions, seems like this service is very limited. Will wait until a more robust system is supported until then I suppose
  - pier25 6y ago
    It's absolutely fantastic for simple functions though. I don't think you can find anything comparable in any provider. Now it's even better with deploy to all PoPs and no cold starts.
    - ignoramous 6y ago
      Cold starts are unnoticeably low at 5ms but there absolutely are cold-starts.
      - kentonv 6y ago
        We found a new way to optimize away that 5ms. Details later this week. :)
      - pier25 6y ago
        Didn't CF just announce they have reduced cold starts to sub 1ms? Also, compared to the 10+ seconds I've experienced with Google I'd be happy with 5ms any time. :)
colinclerk 6y ago
Nice to see more and more pushed to the edge, and good that it's only the beginning of the week. I'm a little surprised they stuck with the isolates model when moving to include generalized compute. We found isolates to be ideal for a cache layer, but it doesn't have first class support for many languages: https://community.cloudflare.com/t/native-golang-support-for-workers/65896 https://community.cloudflare.com/t/native-golang-support-for... Very interested to see if they expand on their storage options throughout the week. Additional consistency guarantees in their KV offering would make it more competitive with Dynamo. I'd love to see a managed relational offering like Cockroach, or perhaps the addition of CockroachCloud to their bandwidth alliance. One point I'm disappointed about is that they list API Gateway and DNS Queries (per MM requests) at $0. This may be true if you're deploying on a single domain with Cloudflare, but if you're a SaaS and need SSL for custom domains, Cloudflare bumps you into their enterprise offering that costs a minimum of thousands per month, and (we found) netted out to about $5-10 per month per hostname: https://www.cloudflare.com/ssl-for-saas-providers/ https://www.cloudflare.com/ssl-for-saas-providers/ (I recognize this is a different way of metering, but listing both at $0 feels like they're arguing DNS & TLS termination cost nothing at Cloudflare, and that was far from our experience)
eastdakota 6y ago
Some more on how we think about edge computing and the serverless market: https://blog.cloudflare.com/cloudflare-workers-serverless-week/ https://blog.cloudflare.com/cloudflare-workers-serverless-we...
- anonfunction 6y ago
  Any plans to offer GPUs for Workers?
  - majke 6y ago
    What is your use case? In my experience it's hard to use them properly. I failed to use modern GPU's (V100's) effectively for even large computing tasks. I found good compiler producing AVX2 on many cores to be easier and cheaper.
    - anonfunction 6y ago
      We're using GPUs already on AWS for inference. The big problem is we have a worker pool of GPU servers and a task queue, leading to some latency if we don't have enough servers running and by the time the EC2 auto scaling group adds one the queue could be drained. Also we are seeing extra latency from requests originating from Asia since we currently have our servers located in a US region. So basically all the classic benefits of serverless and edge computing would apply, the difference being we would need some more drivers, python libraries and a GPU attached.
- rewq4321 6y ago
  Any insight into why bandwidth is so expensive?
  - mrkurt 6y ago
    If you're selling hosting, you can either sell CPU at close to cost and make money on bandwidth, or make your margins on CPU. If people are building things that don't stress the CPUs at all, you can load up servers and make ~$60-70/mo margins on CPUs. When they expect dedicated CPUs and memory, they're suddenly going to price shop across cloud providers and won't pay enough to make those same margins.
erikw 6y ago
The linked Techcrunch article is pretty light on actual content. The actual Cloudflare blogpost describes what this product is: "We are extending our CPU limits to allow customers to bring all of their workloads onto Workers, no matter how intensive." https://blog.cloudflare.com/introducing-workers-unbound/ https://blog.cloudflare.com/introducing-workers-unbound/
- nnx 6y ago
  Indeed... better link at https://news.ycombinator.com/item?id=23963877 https://news.ycombinator.com/item?id=23963877
- dang 6y ago
  Ok, changed to that from https://techcrunch.com/2020/07/27/cloudflare-launches-workers-unbound-the-next-evolution-of-its-serverless-platform/ https://techcrunch.com/2020/07/27/cloudflare-launches-worker.... Thanks!
marcrosoft 6y ago
Do workers support Go natively yet?
- sudhirj 6y ago
  No, the blog posts talks about using V8 isolates (V8 is a JavaScript engine). What CF does is support Rust via Web Assembly, and I think Go WASM might be supported. But they're pretty clear that they're not doing a process model, you'll have to submit code that runs inside V8.
  - dstaley 6y ago
    The sign-up page[1] mentions several languages that don't (as far as I know) compile to Web Assembly (at least not natively). [1] https://www.cloudflare.com/workers-unbound-beta/ https://www.cloudflare.com/workers-unbound-beta/
    - iampims 6y ago
      https://github.com/lsds/faasm https://github.com/lsds/faasm Looks like Python there is an existing python <-> wasm interop
  - marcrosoft 6y ago
    Ok, that’s a big nope for me and my use case. I’ll check back in a year or so.
    - saurik 6y ago
      The premise of how this service works so well is due to a feature JS has which Go doesn't, and which Go has no interest in adding, so you will likely be waiting forever.
minxomat 6y ago
LuaJIT support, please. Other than that some tighter consistency guarantees around KV would be nice. I’m PoCing a small game server on workers and the KV is working great for this so far (turn by turn, but still).
- majke 6y ago
  Awesome! I love Luajit! What specifically you want to do? HTTP game?
nnx 6y ago
>Data Transfer (per egress GB) $0.09 Surprising that Workers Unbound charges egress (first time egress is directly charged by Cloudflare?) and at this quite expensive AWS-like price.
jeffbee 6y ago
> Isolates are far more lightweight than containers, a central tenet of most other serverless providers’ architecture. Containers effectively run a virtual machine, and there’s a lot of overhead associated with them. Kill me, now. Containers are in no respect virtual machines. Cloudflare Workers, by contrast, literally are virtual machines: your code runs on V8.
- james412 6y ago
  An isolate is a v8 "virtual machine" running in-process with many other such machines, virtualization is provided by a userspace program A process is a "virtual machine" running on-host with many other such machines, virtualization is provided by the kernel A host is a "virtual machine" running on metal with many other such machines, virtualization is provided by the CPU Metal is a "virtual machine" running on microcode with up to 3 sets of sibling architectural state (did any vendor ever implement 8-way SMT?), virtualization is provided by the silicon It's turtles all the way down Even better if the isolate is itself running an emulator, in which case it's also turtles all the way up
  - namibj 6y ago
    Yes, 8-way SMT is available in scale-up POWER 9. But it just merges pairs of 4-way SMT cores instead of adding more threads to each core. The overall number of threads is not affected.
- kentonv 6y ago
  You are correct. However: - These days, it has become common to use the term "Virtual Machine" specifically to refer to hardware virtualization. The old meaning of the term, referring to language runtimes, is (sadly) now so uncommon as to be outright confusing to many people. - Most other Serverless environments technically do wrap their containers in virtual machines (like Firecracker), since plain containers aren't considered sufficiently secure on their own.
yadco 6y ago
If they make an aws efs like method of storage, someone might build something very interesting on it.
redm 6y ago
Note: If I come across as a hater, in my opinion, I am not. I'm a fan, a fan who is frustrated! We moved to Cloudflare from a larger CDN and used workers to duplicate the functionality otherwise not provided by Cloudflare. The initial results were great. As our workers became more complicated, especially when interacting with CloudFlares internal stack, the cracks started to show. Specifically, when you run into a problem, the documentation being too light to resolve corner case issues yourself, and support draws a big zero when it comes to Workers. Even as an Enterprise customer, it can take months to get a clear answer/resolution, and that's if you nag them. As a platform, workers have great promise, and Cloudflare is making strides. As with most things CloudFlare, they could spend more time improving documentation, and exposing details on their internal stacks so you can self-service and resolve your issues. What I find is that Cloudflare is on to the next thing before fully completing, polishing, documenting, the previous three things they started. For Workers, I'd like to see a trace tool built for Workers where you can debug what happened in a Live environment. Currently, they recommend outputting debug as JSON in a header. The linked article is worthless. See the blog post, as this poster mentioned: https://news.ycombinator.com/item?id=23965764 https://news.ycombinator.com/item?id=23965764
- kentonv 6y ago
  > I'd like to see a trace tool built for Workers where you can debug what happened in a Live environment. Does `wrangler tail` help with this? https://developers.cloudflare.com/workers/about/tips/debugging/#tail-production-logs-with-wrangler-tail https://developers.cloudflare.com/workers/about/tips/debuggi...
  - redm 6y ago
    What I'm looking for is a full stack trace of a request, and how it progressed through their platform, through pops, Argo, Caches, etc. Akamai and others have tools like this, and it makes it much easier to debug gremlins on the inside. From the docs: "If your Workers application is returning an 1101 error code, your code is throwing an exception. You can catch the exception in your code using a try/catch block:" That's great, but you end up just returning those details in a header or sending them somewhere else. We have to catch errors and send them to our backend for logging so we can debug them at a later point. This doesn't help you debug things like sub-requests from the Worker or how they interact with other Cloudflare features like Cache.
sudhirj 6y ago
One alternative that's available right now is Fly.io — Fly actually runs Docker containers at the edge, so you get a lot of the benefits including autoscaling up and down, your application following the sun across the world, etc. I'm using them for a couple of small production projects and wrote up a gRPC example, quite happy with the service so far.
- jeffbee 6y ago
  "At the edge" is going to mean different things on different clouds. Cloudflare has hundreds of points of presence. What's more edgy about fly.io that you don't get from Cloudflare, App Engine, or AWS Lambda?
  - mrkurt 6y ago
    Oh hello! (disclosure, I work on Fly.io). We're more like Fargate than Lambda, but Fly apps scale and balance across regions. I wouldn't really call it "more edgy", it's just built specifically for running app servers close to users (vs emulating a traditional single region datacenter). We actually started with a JS runtime like CloudFlare has, but it was wrong for our customers. They're better off just running Docker images. There's a lot more in our HN launch thread: https://news.ycombinator.com/item?id=22616857 https://news.ycombinator.com/item?id=22616857
    - rbflx 6y ago
      Sorry if this is somewhat unrelated to the main thread, but considering that someone working on Fly.io is here, I wanted to ask some questions that I couldn't find the answers to in your documentation. 1. What's the average cold start time when spinning up a new instance? For comparison, AWS Fargate often has cold starts of around 1 minute. 2. Is there a limit on the container size created by the Dockerfile? 3. Is there a limit on the number of concurrent instances a single user can run?
      - mrkurt 6y ago
        1. Cold start times are wildly variable. They can be <1s for optimized, fast booting docker images. We actually mask cold start time as much as possible, though, so you'll almost never see one. 2. There's no hard limit. We've had 8GB images running (that I know of). Cold starts can be pretty bad on those just because pulling down an 8gb filesystem is slow. 3. Also no hard limit. I'm curious what you're doing though! Feel free to email me: kurt at fly.io
blntechie 6y ago
I learned about Cloudflare Workers early this year and they definitely seem simpler than AWS Lambda + Gateway combo to deploy and rollout. Unless one is invested in AWS for other needs or need one of the language which Workers doesn’t support (Java?, Go?), it might be a fair option to consider.
- pier25 6y ago
  It Depends. You cannot run many Node libraries on Workers for example.
AnonC 6y ago
I know that Cloudflare people comment here. So can I go on a tangent and ask what’s holding up registering new domains through Cloudflare (posting on the Cloudflare blogs or community forums doesn’t get a response)? Cloudflare registrar was announced (and released) nearly two years ago, allowing people to transfer their domains to Cloudflare. It was declared then that registering new domains would be coming soon. But here we are nearly two years later and there’s no sign that this is coming this year either. Meanwhile, the company even went public through an IPO. What’s the holdup and why the radio silence? I’d actually prefer a blog post about this on the official site than a “what should we tell and what shouldn’t we tell” response here.
- deleted 6y ago
  [deleted]
- eastdakota 6y ago
  We’re thinking about this. What we don’t want are domain speculators buying domains cheap and then doing nothing with them. That’s all cost and hassle for us. We want to let you register domains that you’re serious about doing something with. We’re running a bunch of experiments to see if we can allow new registrations of domains people are serious about without opening the domain speculation floodgates.
  - Operyl 6y ago
    What about the .me TLD? I've been waiting on that one for a long time as well, and it was alluded in the past it was soon™.
  - bithavoc 6y ago
    Any ETA for .dev?
    - EatonZ 6y ago
      Been waiting for .dev too. Haven't been able to get any info from them as to when it will be supported ):
  - 6y ago
colinclerk 6y ago
(Crosspost from the original thread that didn't pick up traction: https://news.ycombinator.com/item?id=23963877 https://news.ycombinator.com/item?id=23963877 ) Nice to see more and more pushed to the edge, and good that it's only the beginning of the week. I'm a little surprised they stuck with the isolates model when moving to include generalized compute. We found isolates to be ideal for a cache layer, but it doesn't have first class support for many languages: https://community.cloudflare.com/t/native-golang-support-for.. https://community.cloudflare.com/t/native-golang-support-for.... Very interested to see if they expand on their storage options throughout the week. Additional consistency guarantees in their KV offering would make it more competitive with Dynamo. I'd love to see a managed relational offering like Cockroach, or perhaps the addition of CockroachCloud to their bandwidth alliance. One point I'm disappointed about is that they list API Gateway and DNS Queries (per MM requests) at $0. This may be true if you're deploying on a single domain with Cloudflare, but if you're a SaaS and need SSL for custom domains, Cloudflare bumps you into their enterprise offering that costs a minimum of thousands per month, and (we found) netted out to about $5-10 per month per hostname: https://www.cloudflare.com/ssl-for-saas-providers/ https://www.cloudflare.com/ssl-for-saas-providers/ (I recognize this is a different way of metering, but listing both at $0 feels like they're arguing DNS & TLS termination cost nothing at Cloudflare, and that was far from our experience)
- ignoramous 6y ago
  From https://cloudflare.com/plans https://cloudflare.com/plans, it looks like one could use custom SSL/TLS certs with their business plan which is $200 a month?
  - colinclerk 6y ago
    We looked into this and spoke to their sales team about it. We could bring our own certs for a single domain, but Cloudflare wouldn't accept traffic from our customer domains unless we purchased SSL for SaaS.
feniv 6y ago
Does this also remove the 30 scripts per account limit? I looked into using Cloudflare workers to power a cloud runtime for WASM (think thousands of dynamically generated WASM binaries serving traffic for different sub-domains), but the script limit and CPU limits were a major blocker. I've had great experiences with Cloudflare and would love to use workers if it opens up these limits. https://developers.cloudflare.com/workers/about/limits https://developers.cloudflare.com/workers/about/limits
- kentonv 6y ago
  The 30-script limit exists because, currently, we copy every script to every server on our edge upfront, hence the storage is rather expensive and we don't want people storing a bunch of scripts they aren't actually using. We'll likely improve this in the future by allowing you to have more scripts as long as you're OK with some of them being fetched from a central location on-demand (which might make them a little slower to start up). I don't have a timeline for when we'll implement this, but it is a common request.
  - yjftsjthsd-h 6y ago
    Any chance you could just charge per script or byte after 30 scripts?
saurik 6y ago
At one point, Cloudflare suggested they might open source some of their v8 work; does anyone know if that still might happen? (Even just the bindings for WebCrypto would be interesting.)
- kentonv 6y ago
  I'd love to open source our V8 API binding layer, which I think is a lot easier to use than the other solutions out there. But, to be honest, the main blocker has been finding time to work on it -- there's just way too much going on. Our WebCrypto implementation just a thin wrapper around BoringSSL, FWIW. On the topic of open source, I'd say about 10% of the coding we do for the Workers Runtime actually lands in Cap'n Proto / KJ, which has been open source all along: https://github.com/capnproto/capnproto https://github.com/capnproto/capnproto
rbflx 6y ago
Looks very interesting! Does anybody know whether this will remove the current maximum runtime limitation? As far as I can tell, workers have a maximum duration of 10ms on the free plan and 50ms on the paid one. I would assume that it does, considering that it's being compared to AWS Lambda, which has a timeout of 15 minutes.
- kentonv 6y ago
  Yes, this is all about removing those limits. Note that the current 10ms/50ms limit is on CPU execution time; it doesn't count time waiting for remote servers to respond.
crisscrosscrash 6y ago
I see CPU mentioned a bit, but nothing about memory. It seems like 128 MB isn't enough to run Nuxt.js (Vue server-side rendering), but it would be awesome to be able to run that (or Next.js for React) at the edge. I haven't actually tried yet on Workers, but they seem to recommend 512 MB memory for App Engine for example. Are Cloudflare's machine sizes unsuitable for being able to offer more memory as an option?
- eastdakota 6y ago
  We will allow in the future the ability to use larger memory allocations.
  - crisscrosscrash 6y ago
    Any rough guesses on when that could happen? Weeks, months, or next year? Depending on the plans, I'd consider waiting for a Workers-based solution for an upcoming project instead of working on a Cloud Run based deployment.
    - eastdakota 6y ago
      It’s a configuration change that I believe we can support on a per-user basis today. Encouraged Workers team to follow up here and see if we can get you setup on beta.
    - alyson-cabral 6y ago
      Will you sign up for the beta at https://www.cloudflare.com/workers-unbound-beta/ https://www.cloudflare.com/workers-unbound-beta/ linking to this post? Me or my team will follow-up directly to understand your use case and see if it's a good fit.
- austinpena 6y ago
  This is a genuine question, why run a database bound application at the edge? Why not just cache HTML on the edge when you can and run the application traditionally?
saurik 6y ago
Part of their defense against cpu side channel attacks was the narrow execution limits; did they decide those are unnecessary? (That was also how they prevented v8 from allocating tons of memory.)
- kentonv 6y ago
  > Part of their defense against cpu side channel attacks was the narrow execution limits; Some people have claimed narrow execution limits provide a defense, but we on the Workers team don't believe that's true and I don't think we've made that claim. Specifically, it's easy for an attacker to store state between requests and so continue an attack across many requests. In our current implementation, you can store that state in global variables, but even if we wiped the worker's state after every request, it would still be easy for an attacker to store their state remotely. We'll be posting more about Spectre later this week. > That was also how they prevented v8 from allocating tons of memory. No, we explicitly limit V8 memory usage independent of CPU time.
  - saurik 6y ago
    > No, we explicitly limit V8 memory usage independent of CPU time. Ok! I hadn't just gotten that from one your talks on Workers: you had said v8 doesn't really offer a useful hook to limit memory usage as it aborted the process rather than just stopping the isolate, and that the CPU resource limit was thereby an important part of the memory limitation (as with the exception of typed arrays, using memory in JavaScript requires code to actively set memory). If you did change this, it makes me all the more interested in the changes you are making in v8 ;P (though it is also possible these changes were actually just part of upstream and I failed to notice). https://www.infoq.com/presentations/cloudflare-v8/ https://www.infoq.com/presentations/cloudflare-v8/ (at 20m45s)
hashamali 6y ago
I see Go listed as a supported language. Is that through WASM build targets or something else?
rosywoozlechan 6y ago
Cloudflare should focus on getting their existing services working. I tried their 1.1.1.1 Warp VPN on Android as a paying subscriber and it just broke my internet connection most of the time.
- kyleCF 6y ago
  Hey rosywoozlechan I am the Product Manager for this app, can you file an in app bug with this name so we can look in to your issue? (look for little bug icon on main screen to file issue)
insomniacity 6y ago
Surprised nobody is commenting on the zero millisecond cold-start time: > The way the team engineered this is by queuing up the process while the two servers are still negotiating their TLS handshake. That's pretty cool. I'm trying to see a downside, given that presumably it won't spin up a function for traffic from IPs it knows are abusive.
- Ericson2314 6y ago
  Hehe and socket activation reaches the cloud.
ignoramous 6y ago
The private beta sign up form is here for ones interested in Workers Unbound: https://www.cloudflare.com/workers-unbound-beta/ https://www.cloudflare.com/workers-unbound-beta/ (disable adblockers to see the form). One key thing that sticks out is Cloudflare would charge for outgoing bandwidth at $0.09 per GB, a stark departure from unlimited bandwidth stance they're known for, especially wrt Workers Bundled [0]. A few questions, if anyone from Cloudflare is here: 0. Can we expect in Workers Unbound support for Websockets, WebRTC, HTTP Connect, and Server Sent Events? 1. Would there be support for protocols other than HTTP? Say, a raw TCP / UDP connection that is handed off by Spectrum to a Worker [1] (Spectrum here is redundant?)? 2. Inability to rate limit Workers in a cost effective way gives me sleepless nights [2]. The current rate limiting plans are too expensive when compared to Workers, almost 10x if expected good requests are to the tune of 10 million [3] (in my case good requests have potential to be much much higher). Any announcements due in this space? 3. Will the same isolate (Unbounded Worker), if kept running for long, be able to handle multiple connections/requests concurrently, or would each HTTP connection create a new isolate (that is, a new Unbounded Worker instance)? Thanks. [0] https://news.ycombinator.com/item?id=20791660 https://news.ycombinator.com/item?id=20791660 [1] https://news.ycombinator.com/item?id=21921821 https://news.ycombinator.com/item?id=21921821 [2] https://community.cloudflare.com/t/how-to-protect-cloudflare-worker-from-ddos/179017 https://community.cloudflare.com/t/how-to-protect-cloudflare... [3] https://support.cloudflare.com/hc/en-us/articles/115000272247 https://support.cloudflare.com/hc/en-us/articles/11500027224...
- kentonv 6y ago
  > Can we expect in Workers Unbound support for Websockets, WebRTC, HTTP Connect, and Server Sent Events? Definitely yes on WebSocket. In fact, the only reason we haven't rolled out WebSocket support already is because it's not very useful without long-running CPU. Workers Unbound fixes that so I'll be dusting off my old WebSocket implementation PR soon. I think Server Sent Events are just streaming HTTP? That should work today (but with the same caveat that CPU limits may cause trouble). WebRTC is a peer-to-peer (browser-to-browser) protocol. We don't currently have plans to implement it directly in Workers, though that's an interesting idea. By "HTTP connect", I assume you mean the CONNECT HTTP method, usually used to tunnel TLS connections through forward proxies? That's a request I haven't heard before, but it's interesting. I guess what you'd get, basically, is the ability to establish TCP-like connections that are addressed to HTTP URLs and connect over port 80/443? Is this commonly used for things other than forward proxies? > Would there be support for protocols other than HTTP? Say, a raw TCP / UDP connection that is handed off by Spectrum to a Worker [1]? Not part of the current plan but definitely something we'd like to do eventually. > Inability to rate limit Workers in a cost effective way gives me sleepless nights Yeah, our rate limiting product is not really intended to be used to rate-limit the whole site to control costs. It is more intended to, say, rate-limit your login form to prevent brute-force password guessing. That said, we do have layer 7 DDoS protections, and those run in front of your worker. If an attack gets past them and hits your worker, I'd encourage you to raise a support ticket asking for compensation for the attack traffic that we failed to block. I am not personally in a position to promise that we'd refund you but I believe it has happened in the past. > Will the same isolate (Unbounded Worker), if kept running for long, be able to handle multiple connections/requests concurrently, JavaScript is inherently single-threaded, so an isolate can only be executing code on behalf of one request at a time. That said, it is already the case that multiple concurrent requests may be handled by the same isolate (one request may be executing while another is e.g. waiting for a response from a remote server). But today you can't really take advantage of that, because you have no control over exactly which isolate receives any particular request, no any way to communicate between neighboring isolates. This is definitely something we're working on but nothing to announce at this time.
devwastaken 6y ago
Has the status changed on time synchronization on endpoints? Using workers to deliver time over http would work really well if the servers they're hosted on are guaranteed to be through standard NTP.
- kentonv 6y ago
  Hmm, all our servers should have accurate clocks. Have you experienced otherwise?
- ignoramous 6y ago
  Workers don't expose accurate time afaik to mitigate Meltdown/Spectre [0], but wouldn't their free-to-use NTP server work for your usecase? https://www.cloudflare.com/time/ https://www.cloudflare.com/time/ [0] https://developers.cloudflare.com/workers/about/security/ https://developers.cloudflare.com/workers/about/security/
  - kentonv 6y ago
    Workers can read the clock, but the clock doesn't advance while the worker is executing, which prevents it from using the clock to measure its own execution time. For a service that just returns the current time, that shouldn't make a difference.
  - devwastaken 6y ago
    Using an ntp server voids the point of using workers over http to browsers. Workers are at the endpoint in the world closest to the user, which is less latency, so you can guarantee time better.
manigandham 6y ago
The data transfer pricing is a big letdown considering Cloudflare has always has free transfer. When transfer is so expensive, it makes it harder to switch from other clouds that have more than just compute capacity, especially since you might be paying double to transfer between cloud->CF->user
a2tech 6y ago
They should work on reliability before new niche features. I work with another developer on his clients sites and he’s a Cloudflare fan. Almost every complaint and failure we’ve had reported has come from Cloudflare errors. Not issues with our stuff, issues with Cloudflare. I use cloudfront with a different set of clients with semi-high visability sites and have never had an issue stemming from it.
abrookewood 6y ago
Isn't this statement incorrect? "Isolates are far more lightweight than containers ... Containers effectively run a virtual machine, and there’s a lot of overhead associated with them" Everything I have read suggests containers (being based on CGroups) add virtually no overhead at all (in the vicinity of 1% at worse from memory).
- throwawaythekey 6y ago
  Containers are very lightweight compared to a vm, but each FAAS container is required to run its own instance of v8. This implies some start up time (tens of ms?) and some memory use (10's of mb?). My understanding of isolates is they are more or less a container, but at the v8 level instead of OS. This makes spinning up a function more akin to opening a new tab vs opening a new browser instance.
  - abrookewood 6y ago
    Thanks for the explanation. I get that this approach is faster than containers, but was mainly nitpicking over the statement that containers ARE VMs.
tapirl 6y ago
It looks Cloudflare Workers and AWS Lambda are just re-implementations of Google App Engine. It is a sad that Google half gave up App Engine, by switching to a bad pricing scheme and not putting enough energy in developing GAE and further innovating in this area.

250 points by skolos 6y ago

I've run into 3 big limitations when using Workers: 1) The CPU limit. 2) Not being able to use Node modules. 3) Not being able to add domains other than adding those to our CF account. SSL for SaaS solves this but, so far, it's only available to enterprise customers. The CPU limit was not so bad when considering Workers were not intended as a general use-case for serverless functions. Now that this has been lifted I feel the Workers environment limitations are going to be much more important. You can't, for example, use many Node packages in Workers since these are running in a custom V8 environment which resembles browser service workers. I say "resembles" because the API is not 100% identical. For example, you can use streams, but you don't get the full API.

ctvo 6y ago
This is a major dealbreaker that it needs to be called out earlier. Not only is this an interface you adhere to to use their service (incoming event, outgoing response), that type of coupling is fair and expected, but the underlying runtime is custom without full support for standard APIs?! What's the upgrade path? Can they port things over in a reasonable amount of time? Is it well documented what's supported and what isn't? Imagine developing against this and resolving these issues as they come up. Oof. I'll use Azure or AWS.
- pier25 6y ago
  > Is it well documented what's supported and what isn't? No, not really. For example, I experimented a bit with streaming HTML but then hit a roadblock because ByteLengthQueuingStrategy wasn't available.
jFriedensreich 6y ago
A different runtime from nodejs is more a feature than an issue. The worker runtime is much closer to deno than to nodejs from a philosophy standpoint and i expect a lot of synergies between cf workers and deno in the future. the cf workers being as much compatible with the service worker api as possible makes them the only faas solution close to a web standard, so vendor lockin will only be an issue until compatible offerings appear. A killer argument for this approach is also that you can be sure you can run the cf worker code also in a browsers service worker (with minimal modification). This allows more flexible architectures and also more unified development between backend and frontend.
- jFriedensreich 6y ago
  Also regarding the domains: cloudflare routes the requests to the edge centers based on dns anycast, so cloudflare workers cannot really be seperated from the dns functionality of cloudflare, see it as a faas offering inside your worldwide distributed dns. If that is not what you want, it is still possible to use cf workers with worker domains and use your own domain and dns setup
  - pier25 6y ago
    My point is not so much about the tech but actually that SSL for SaaS is out of reach for most startups or small tech companies.
    - jFriedensreich 6y ago
      ahhh, sorry i did not know "SSL for SaaS" was a product name for a specific feature. I totally agree, this would have been really nice to be able to offer my clients, but is currently not really accessible. There are a few things like this such as custom error page etc. Lets hope more enterprise offerings will be more accessible for smaller projects in the future...
- pier25 6y ago
  I totally get that, but it's just a limitation that is not obvious at first.
  - jFriedensreich 6y ago
    true, cloudflare communicates that extremly well in talks they give about it and online presentations, but the documentation is often not as easy to read
nyxtom 6y ago
Apart from simple functions, seems like this service is very limited. Will wait until a more robust system is supported until then I suppose
- pier25 6y ago
  It's absolutely fantastic for simple functions though. I don't think you can find anything comparable in any provider. Now it's even better with deploy to all PoPs and no cold starts.
  - ignoramous 6y ago
    Cold starts are unnoticeably low at 5ms but there absolutely are cold-starts.
    - kentonv 6y ago
      We found a new way to optimize away that 5ms. Details later this week. :)
    - pier25 6y ago
      Didn't CF just announce they have reduced cold starts to sub 1ms? Also, compared to the 10+ seconds I've experienced with Google I'd be happy with 5ms any time. :)

colinclerk 6y ago

Nice to see more and more pushed to the edge, and good that it's only the beginning of the week. I'm a little surprised they stuck with the isolates model when moving to include generalized compute. We found isolates to be ideal for a cache layer, but it doesn't have first class support for many languages: https://community.cloudflare.com/t/native-golang-support-for-workers/65896 https://community.cloudflare.com/t/native-golang-support-for... Very interested to see if they expand on their storage options throughout the week. Additional consistency guarantees in their KV offering would make it more competitive with Dynamo. I'd love to see a managed relational offering like Cockroach, or perhaps the addition of CockroachCloud to their bandwidth alliance. One point I'm disappointed about is that they list API Gateway and DNS Queries (per MM requests) at $0. This may be true if you're deploying on a single domain with Cloudflare, but if you're a SaaS and need SSL for custom domains, Cloudflare bumps you into their enterprise offering that costs a minimum of thousands per month, and (we found) netted out to about $5-10 per month per hostname: https://www.cloudflare.com/ssl-for-saas-providers/ https://www.cloudflare.com/ssl-for-saas-providers/ (I recognize this is a different way of metering, but listing both at $0 feels like they're arguing DNS & TLS termination cost nothing at Cloudflare, and that was far from our experience)

eastdakota 6y ago

Some more on how we think about edge computing and the serverless market: https://blog.cloudflare.com/cloudflare-workers-serverless-week/ https://blog.cloudflare.com/cloudflare-workers-serverless-we...

anonfunction 6y ago
Any plans to offer GPUs for Workers?
- majke 6y ago
  What is your use case? In my experience it's hard to use them properly. I failed to use modern GPU's (V100's) effectively for even large computing tasks. I found good compiler producing AVX2 on many cores to be easier and cheaper.
  - anonfunction 6y ago
    We're using GPUs already on AWS for inference. The big problem is we have a worker pool of GPU servers and a task queue, leading to some latency if we don't have enough servers running and by the time the EC2 auto scaling group adds one the queue could be drained. Also we are seeing extra latency from requests originating from Asia since we currently have our servers located in a US region. So basically all the classic benefits of serverless and edge computing would apply, the difference being we would need some more drivers, python libraries and a GPU attached.
rewq4321 6y ago
Any insight into why bandwidth is so expensive?
- mrkurt 6y ago
  If you're selling hosting, you can either sell CPU at close to cost and make money on bandwidth, or make your margins on CPU. If people are building things that don't stress the CPUs at all, you can load up servers and make ~$60-70/mo margins on CPUs. When they expect dedicated CPUs and memory, they're suddenly going to price shop across cloud providers and won't pay enough to make those same margins.

erikw 6y ago

The linked Techcrunch article is pretty light on actual content. The actual Cloudflare blogpost describes what this product is: "We are extending our CPU limits to allow customers to bring all of their workloads onto Workers, no matter how intensive." https://blog.cloudflare.com/introducing-workers-unbound/ https://blog.cloudflare.com/introducing-workers-unbound/

nnx 6y ago
Indeed... better link at https://news.ycombinator.com/item?id=23963877 https://news.ycombinator.com/item?id=23963877
dang 6y ago
Ok, changed to that from https://techcrunch.com/2020/07/27/cloudflare-launches-workers-unbound-the-next-evolution-of-its-serverless-platform/ https://techcrunch.com/2020/07/27/cloudflare-launches-worker.... Thanks!

marcrosoft 6y ago

Do workers support Go natively yet?

sudhirj 6y ago
No, the blog posts talks about using V8 isolates (V8 is a JavaScript engine). What CF does is support Rust via Web Assembly, and I think Go WASM might be supported. But they're pretty clear that they're not doing a process model, you'll have to submit code that runs inside V8.
- dstaley 6y ago
  The sign-up page[1] mentions several languages that don't (as far as I know) compile to Web Assembly (at least not natively). [1] https://www.cloudflare.com/workers-unbound-beta/ https://www.cloudflare.com/workers-unbound-beta/
  - iampims 6y ago
    https://github.com/lsds/faasm https://github.com/lsds/faasm Looks like Python there is an existing python <-> wasm interop
- marcrosoft 6y ago
  Ok, that’s a big nope for me and my use case. I’ll check back in a year or so.
  - saurik 6y ago
    The premise of how this service works so well is due to a feature JS has which Go doesn't, and which Go has no interest in adding, so you will likely be waiting forever.

minxomat 6y ago

LuaJIT support, please. Other than that some tighter consistency guarantees around KV would be nice. I’m PoCing a small game server on workers and the KV is working great for this so far (turn by turn, but still).

majke 6y ago
Awesome! I love Luajit! What specifically you want to do? HTTP game?

nnx 6y ago

>Data Transfer (per egress GB) $0.09 Surprising that Workers Unbound charges egress (first time egress is directly charged by Cloudflare?) and at this quite expensive AWS-like price.

jeffbee 6y ago

> Isolates are far more lightweight than containers, a central tenet of most other serverless providers’ architecture. Containers effectively run a virtual machine, and there’s a lot of overhead associated with them. Kill me, now. Containers are in no respect virtual machines. Cloudflare Workers, by contrast, literally are virtual machines: your code runs on V8.

james412 6y ago
An isolate is a v8 "virtual machine" running in-process with many other such machines, virtualization is provided by a userspace program A process is a "virtual machine" running on-host with many other such machines, virtualization is provided by the kernel A host is a "virtual machine" running on metal with many other such machines, virtualization is provided by the CPU Metal is a "virtual machine" running on microcode with up to 3 sets of sibling architectural state (did any vendor ever implement 8-way SMT?), virtualization is provided by the silicon It's turtles all the way down Even better if the isolate is itself running an emulator, in which case it's also turtles all the way up
- namibj 6y ago
  Yes, 8-way SMT is available in scale-up POWER 9. But it just merges pairs of 4-way SMT cores instead of adding more threads to each core. The overall number of threads is not affected.
kentonv 6y ago
You are correct. However: - These days, it has become common to use the term "Virtual Machine" specifically to refer to hardware virtualization. The old meaning of the term, referring to language runtimes, is (sadly) now so uncommon as to be outright confusing to many people. - Most other Serverless environments technically do wrap their containers in virtual machines (like Firecracker), since plain containers aren't considered sufficiently secure on their own.

yadco 6y ago

If they make an aws efs like method of storage, someone might build something very interesting on it.

redm 6y ago

Note: If I come across as a hater, in my opinion, I am not. I'm a fan, a fan who is frustrated! We moved to Cloudflare from a larger CDN and used workers to duplicate the functionality otherwise not provided by Cloudflare. The initial results were great. As our workers became more complicated, especially when interacting with CloudFlares internal stack, the cracks started to show. Specifically, when you run into a problem, the documentation being too light to resolve corner case issues yourself, and support draws a big zero when it comes to Workers. Even as an Enterprise customer, it can take months to get a clear answer/resolution, and that's if you nag them. As a platform, workers have great promise, and Cloudflare is making strides. As with most things CloudFlare, they could spend more time improving documentation, and exposing details on their internal stacks so you can self-service and resolve your issues. What I find is that Cloudflare is on to the next thing before fully completing, polishing, documenting, the previous three things they started. For Workers, I'd like to see a trace tool built for Workers where you can debug what happened in a Live environment. Currently, they recommend outputting debug as JSON in a header. The linked article is worthless. See the blog post, as this poster mentioned: https://news.ycombinator.com/item?id=23965764 https://news.ycombinator.com/item?id=23965764

kentonv 6y ago
> I'd like to see a trace tool built for Workers where you can debug what happened in a Live environment. Does `wrangler tail` help with this? https://developers.cloudflare.com/workers/about/tips/debugging/#tail-production-logs-with-wrangler-tail https://developers.cloudflare.com/workers/about/tips/debuggi...
- redm 6y ago
  What I'm looking for is a full stack trace of a request, and how it progressed through their platform, through pops, Argo, Caches, etc. Akamai and others have tools like this, and it makes it much easier to debug gremlins on the inside. From the docs: "If your Workers application is returning an 1101 error code, your code is throwing an exception. You can catch the exception in your code using a try/catch block:" That's great, but you end up just returning those details in a header or sending them somewhere else. We have to catch errors and send them to our backend for logging so we can debug them at a later point. This doesn't help you debug things like sub-requests from the Worker or how they interact with other Cloudflare features like Cache.

sudhirj 6y ago

One alternative that's available right now is Fly.io — Fly actually runs Docker containers at the edge, so you get a lot of the benefits including autoscaling up and down, your application following the sun across the world, etc. I'm using them for a couple of small production projects and wrote up a gRPC example, quite happy with the service so far.

jeffbee 6y ago
"At the edge" is going to mean different things on different clouds. Cloudflare has hundreds of points of presence. What's more edgy about fly.io that you don't get from Cloudflare, App Engine, or AWS Lambda?
- mrkurt 6y ago
  Oh hello! (disclosure, I work on Fly.io). We're more like Fargate than Lambda, but Fly apps scale and balance across regions. I wouldn't really call it "more edgy", it's just built specifically for running app servers close to users (vs emulating a traditional single region datacenter). We actually started with a JS runtime like CloudFlare has, but it was wrong for our customers. They're better off just running Docker images. There's a lot more in our HN launch thread: https://news.ycombinator.com/item?id=22616857 https://news.ycombinator.com/item?id=22616857
  - rbflx 6y ago
    Sorry if this is somewhat unrelated to the main thread, but considering that someone working on Fly.io is here, I wanted to ask some questions that I couldn't find the answers to in your documentation. 1. What's the average cold start time when spinning up a new instance? For comparison, AWS Fargate often has cold starts of around 1 minute. 2. Is there a limit on the container size created by the Dockerfile? 3. Is there a limit on the number of concurrent instances a single user can run?
    - mrkurt 6y ago
      1. Cold start times are wildly variable. They can be <1s for optimized, fast booting docker images. We actually mask cold start time as much as possible, though, so you'll almost never see one. 2. There's no hard limit. We've had 8GB images running (that I know of). Cold starts can be pretty bad on those just because pulling down an 8gb filesystem is slow. 3. Also no hard limit. I'm curious what you're doing though! Feel free to email me: kurt at fly.io

blntechie 6y ago

I learned about Cloudflare Workers early this year and they definitely seem simpler than AWS Lambda + Gateway combo to deploy and rollout. Unless one is invested in AWS for other needs or need one of the language which Workers doesn’t support (Java?, Go?), it might be a fair option to consider.

pier25 6y ago
It Depends. You cannot run many Node libraries on Workers for example.

AnonC 6y ago

I know that Cloudflare people comment here. So can I go on a tangent and ask what’s holding up registering new domains through Cloudflare (posting on the Cloudflare blogs or community forums doesn’t get a response)? Cloudflare registrar was announced (and released) nearly two years ago, allowing people to transfer their domains to Cloudflare. It was declared then that registering new domains would be coming soon. But here we are nearly two years later and there’s no sign that this is coming this year either. Meanwhile, the company even went public through an IPO. What’s the holdup and why the radio silence? I’d actually prefer a blog post about this on the official site than a “what should we tell and what shouldn’t we tell” response here.

deleted 6y ago
[deleted]
eastdakota 6y ago
We’re thinking about this. What we don’t want are domain speculators buying domains cheap and then doing nothing with them. That’s all cost and hassle for us. We want to let you register domains that you’re serious about doing something with. We’re running a bunch of experiments to see if we can allow new registrations of domains people are serious about without opening the domain speculation floodgates.
- Operyl 6y ago
  What about the .me TLD? I've been waiting on that one for a long time as well, and it was alluded in the past it was soon™.
- bithavoc 6y ago
  Any ETA for .dev?
  - EatonZ 6y ago
    Been waiting for .dev too. Haven't been able to get any info from them as to when it will be supported ):
- 6y ago

colinclerk 6y ago

(Crosspost from the original thread that didn't pick up traction: https://news.ycombinator.com/item?id=23963877 https://news.ycombinator.com/item?id=23963877 ) Nice to see more and more pushed to the edge, and good that it's only the beginning of the week. I'm a little surprised they stuck with the isolates model when moving to include generalized compute. We found isolates to be ideal for a cache layer, but it doesn't have first class support for many languages: https://community.cloudflare.com/t/native-golang-support-for.. https://community.cloudflare.com/t/native-golang-support-for.... Very interested to see if they expand on their storage options throughout the week. Additional consistency guarantees in their KV offering would make it more competitive with Dynamo. I'd love to see a managed relational offering like Cockroach, or perhaps the addition of CockroachCloud to their bandwidth alliance. One point I'm disappointed about is that they list API Gateway and DNS Queries (per MM requests) at $0. This may be true if you're deploying on a single domain with Cloudflare, but if you're a SaaS and need SSL for custom domains, Cloudflare bumps you into their enterprise offering that costs a minimum of thousands per month, and (we found) netted out to about $5-10 per month per hostname: https://www.cloudflare.com/ssl-for-saas-providers/ https://www.cloudflare.com/ssl-for-saas-providers/ (I recognize this is a different way of metering, but listing both at $0 feels like they're arguing DNS & TLS termination cost nothing at Cloudflare, and that was far from our experience)

ignoramous 6y ago
From https://cloudflare.com/plans https://cloudflare.com/plans, it looks like one could use custom SSL/TLS certs with their business plan which is $200 a month?
- colinclerk 6y ago
  We looked into this and spoke to their sales team about it. We could bring our own certs for a single domain, but Cloudflare wouldn't accept traffic from our customer domains unless we purchased SSL for SaaS.

feniv 6y ago

Does this also remove the 30 scripts per account limit? I looked into using Cloudflare workers to power a cloud runtime for WASM (think thousands of dynamically generated WASM binaries serving traffic for different sub-domains), but the script limit and CPU limits were a major blocker. I've had great experiences with Cloudflare and would love to use workers if it opens up these limits. https://developers.cloudflare.com/workers/about/limits https://developers.cloudflare.com/workers/about/limits

kentonv 6y ago
The 30-script limit exists because, currently, we copy every script to every server on our edge upfront, hence the storage is rather expensive and we don't want people storing a bunch of scripts they aren't actually using. We'll likely improve this in the future by allowing you to have more scripts as long as you're OK with some of them being fetched from a central location on-demand (which might make them a little slower to start up). I don't have a timeline for when we'll implement this, but it is a common request.
- yjftsjthsd-h 6y ago
  Any chance you could just charge per script or byte after 30 scripts?

saurik 6y ago

At one point, Cloudflare suggested they might open source some of their v8 work; does anyone know if that still might happen? (Even just the bindings for WebCrypto would be interesting.)

kentonv 6y ago
I'd love to open source our V8 API binding layer, which I think is a lot easier to use than the other solutions out there. But, to be honest, the main blocker has been finding time to work on it -- there's just way too much going on. Our WebCrypto implementation just a thin wrapper around BoringSSL, FWIW. On the topic of open source, I'd say about 10% of the coding we do for the Workers Runtime actually lands in Cap'n Proto / KJ, which has been open source all along: https://github.com/capnproto/capnproto https://github.com/capnproto/capnproto

rbflx 6y ago

Looks very interesting! Does anybody know whether this will remove the current maximum runtime limitation? As far as I can tell, workers have a maximum duration of 10ms on the free plan and 50ms on the paid one. I would assume that it does, considering that it's being compared to AWS Lambda, which has a timeout of 15 minutes.

kentonv 6y ago
Yes, this is all about removing those limits. Note that the current 10ms/50ms limit is on CPU execution time; it doesn't count time waiting for remote servers to respond.

crisscrosscrash 6y ago

I see CPU mentioned a bit, but nothing about memory. It seems like 128 MB isn't enough to run Nuxt.js (Vue server-side rendering), but it would be awesome to be able to run that (or Next.js for React) at the edge. I haven't actually tried yet on Workers, but they seem to recommend 512 MB memory for App Engine for example. Are Cloudflare's machine sizes unsuitable for being able to offer more memory as an option?

eastdakota 6y ago
We will allow in the future the ability to use larger memory allocations.
- crisscrosscrash 6y ago
  Any rough guesses on when that could happen? Weeks, months, or next year? Depending on the plans, I'd consider waiting for a Workers-based solution for an upcoming project instead of working on a Cloud Run based deployment.
  - eastdakota 6y ago
    It’s a configuration change that I believe we can support on a per-user basis today. Encouraged Workers team to follow up here and see if we can get you setup on beta.
  - alyson-cabral 6y ago
    Will you sign up for the beta at https://www.cloudflare.com/workers-unbound-beta/ https://www.cloudflare.com/workers-unbound-beta/ linking to this post? Me or my team will follow-up directly to understand your use case and see if it's a good fit.
austinpena 6y ago
This is a genuine question, why run a database bound application at the edge? Why not just cache HTML on the edge when you can and run the application traditionally?

saurik 6y ago

Part of their defense against cpu side channel attacks was the narrow execution limits; did they decide those are unnecessary? (That was also how they prevented v8 from allocating tons of memory.)

kentonv 6y ago
> Part of their defense against cpu side channel attacks was the narrow execution limits; Some people have claimed narrow execution limits provide a defense, but we on the Workers team don't believe that's true and I don't think we've made that claim. Specifically, it's easy for an attacker to store state between requests and so continue an attack across many requests. In our current implementation, you can store that state in global variables, but even if we wiped the worker's state after every request, it would still be easy for an attacker to store their state remotely. We'll be posting more about Spectre later this week. > That was also how they prevented v8 from allocating tons of memory. No, we explicitly limit V8 memory usage independent of CPU time.
- saurik 6y ago
  > No, we explicitly limit V8 memory usage independent of CPU time. Ok! I hadn't just gotten that from one your talks on Workers: you had said v8 doesn't really offer a useful hook to limit memory usage as it aborted the process rather than just stopping the isolate, and that the CPU resource limit was thereby an important part of the memory limitation (as with the exception of typed arrays, using memory in JavaScript requires code to actively set memory). If you did change this, it makes me all the more interested in the changes you are making in v8 ;P (though it is also possible these changes were actually just part of upstream and I failed to notice). https://www.infoq.com/presentations/cloudflare-v8/ https://www.infoq.com/presentations/cloudflare-v8/ (at 20m45s)

hashamali 6y ago

I see Go listed as a supported language. Is that through WASM build targets or something else?

rosywoozlechan 6y ago

Cloudflare should focus on getting their existing services working. I tried their 1.1.1.1 Warp VPN on Android as a paying subscriber and it just broke my internet connection most of the time.

kyleCF 6y ago
Hey rosywoozlechan I am the Product Manager for this app, can you file an in app bug with this name so we can look in to your issue? (look for little bug icon on main screen to file issue)

insomniacity 6y ago

Surprised nobody is commenting on the zero millisecond cold-start time: > The way the team engineered this is by queuing up the process while the two servers are still negotiating their TLS handshake. That's pretty cool. I'm trying to see a downside, given that presumably it won't spin up a function for traffic from IPs it knows are abusive.

Ericson2314 6y ago
Hehe and socket activation reaches the cloud.

ignoramous 6y ago

The private beta sign up form is here for ones interested in Workers Unbound: https://www.cloudflare.com/workers-unbound-beta/ https://www.cloudflare.com/workers-unbound-beta/ (disable adblockers to see the form). One key thing that sticks out is Cloudflare would charge for outgoing bandwidth at $0.09 per GB, a stark departure from unlimited bandwidth stance they're known for, especially wrt Workers Bundled [0]. A few questions, if anyone from Cloudflare is here: 0. Can we expect in Workers Unbound support for Websockets, WebRTC, HTTP Connect, and Server Sent Events? 1. Would there be support for protocols other than HTTP? Say, a raw TCP / UDP connection that is handed off by Spectrum to a Worker [1] (Spectrum here is redundant?)? 2. Inability to rate limit Workers in a cost effective way gives me sleepless nights [2]. The current rate limiting plans are too expensive when compared to Workers, almost 10x if expected good requests are to the tune of 10 million [3] (in my case good requests have potential to be much much higher). Any announcements due in this space? 3. Will the same isolate (Unbounded Worker), if kept running for long, be able to handle multiple connections/requests concurrently, or would each HTTP connection create a new isolate (that is, a new Unbounded Worker instance)? Thanks. [0] https://news.ycombinator.com/item?id=20791660 https://news.ycombinator.com/item?id=20791660 [1] https://news.ycombinator.com/item?id=21921821 https://news.ycombinator.com/item?id=21921821 [2] https://community.cloudflare.com/t/how-to-protect-cloudflare-worker-from-ddos/179017 https://community.cloudflare.com/t/how-to-protect-cloudflare... [3] https://support.cloudflare.com/hc/en-us/articles/115000272247 https://support.cloudflare.com/hc/en-us/articles/11500027224...

kentonv 6y ago
> Can we expect in Workers Unbound support for Websockets, WebRTC, HTTP Connect, and Server Sent Events? Definitely yes on WebSocket. In fact, the only reason we haven't rolled out WebSocket support already is because it's not very useful without long-running CPU. Workers Unbound fixes that so I'll be dusting off my old WebSocket implementation PR soon. I think Server Sent Events are just streaming HTTP? That should work today (but with the same caveat that CPU limits may cause trouble). WebRTC is a peer-to-peer (browser-to-browser) protocol. We don't currently have plans to implement it directly in Workers, though that's an interesting idea. By "HTTP connect", I assume you mean the CONNECT HTTP method, usually used to tunnel TLS connections through forward proxies? That's a request I haven't heard before, but it's interesting. I guess what you'd get, basically, is the ability to establish TCP-like connections that are addressed to HTTP URLs and connect over port 80/443? Is this commonly used for things other than forward proxies? > Would there be support for protocols other than HTTP? Say, a raw TCP / UDP connection that is handed off by Spectrum to a Worker [1]? Not part of the current plan but definitely something we'd like to do eventually. > Inability to rate limit Workers in a cost effective way gives me sleepless nights Yeah, our rate limiting product is not really intended to be used to rate-limit the whole site to control costs. It is more intended to, say, rate-limit your login form to prevent brute-force password guessing. That said, we do have layer 7 DDoS protections, and those run in front of your worker. If an attack gets past them and hits your worker, I'd encourage you to raise a support ticket asking for compensation for the attack traffic that we failed to block. I am not personally in a position to promise that we'd refund you but I believe it has happened in the past. > Will the same isolate (Unbounded Worker), if kept running for long, be able to handle multiple connections/requests concurrently, JavaScript is inherently single-threaded, so an isolate can only be executing code on behalf of one request at a time. That said, it is already the case that multiple concurrent requests may be handled by the same isolate (one request may be executing while another is e.g. waiting for a response from a remote server). But today you can't really take advantage of that, because you have no control over exactly which isolate receives any particular request, no any way to communicate between neighboring isolates. This is definitely something we're working on but nothing to announce at this time.

devwastaken 6y ago

Has the status changed on time synchronization on endpoints? Using workers to deliver time over http would work really well if the servers they're hosted on are guaranteed to be through standard NTP.

kentonv 6y ago
Hmm, all our servers should have accurate clocks. Have you experienced otherwise?
ignoramous 6y ago
Workers don't expose accurate time afaik to mitigate Meltdown/Spectre [0], but wouldn't their free-to-use NTP server work for your usecase? https://www.cloudflare.com/time/ https://www.cloudflare.com/time/ [0] https://developers.cloudflare.com/workers/about/security/ https://developers.cloudflare.com/workers/about/security/
- kentonv 6y ago
  Workers can read the clock, but the clock doesn't advance while the worker is executing, which prevents it from using the clock to measure its own execution time. For a service that just returns the current time, that shouldn't make a difference.
- devwastaken 6y ago
  Using an ntp server voids the point of using workers over http to browsers. Workers are at the endpoint in the world closest to the user, which is less latency, so you can guarantee time better.

manigandham 6y ago

The data transfer pricing is a big letdown considering Cloudflare has always has free transfer. When transfer is so expensive, it makes it harder to switch from other clouds that have more than just compute capacity, especially since you might be paying double to transfer between cloud->CF->user

a2tech 6y ago

They should work on reliability before new niche features. I work with another developer on his clients sites and he’s a Cloudflare fan. Almost every complaint and failure we’ve had reported has come from Cloudflare errors. Not issues with our stuff, issues with Cloudflare. I use cloudfront with a different set of clients with semi-high visability sites and have never had an issue stemming from it.

abrookewood 6y ago

Isn't this statement incorrect? "Isolates are far more lightweight than containers ... Containers effectively run a virtual machine, and there’s a lot of overhead associated with them" Everything I have read suggests containers (being based on CGroups) add virtually no overhead at all (in the vicinity of 1% at worse from memory).

throwawaythekey 6y ago
Containers are very lightweight compared to a vm, but each FAAS container is required to run its own instance of v8. This implies some start up time (tens of ms?) and some memory use (10's of mb?). My understanding of isolates is they are more or less a container, but at the v8 level instead of OS. This makes spinning up a function more akin to opening a new tab vs opening a new browser instance.
- abrookewood 6y ago
  Thanks for the explanation. I get that this approach is faster than containers, but was mainly nitpicking over the statement that containers ARE VMs.

tapirl 6y ago

It looks Cloudflare Workers and AWS Lambda are just re-implementations of Google App Engine. It is a sad that Google half gave up App Engine, by switching to a bad pricing scheme and not putting enough energy in developing GAE and further innovating in this area.