4 ms·
We are talking about two alternative architectures, Cloudflare Workers and Fastly Compute@Edge, solving the same problem: how to run server-side untrusted code.
by sradman 6y ago
We are talking about two alternative architectures, Cloudflare Workers and Fastly Compute@Edge, solving the same problem: how to run server-side untrusted code. Cloudflare runs a sandboxed V8 runtime in-process with its Nginx servers while Fastly chose a Function-as-Service platform using Lucet compiled WebAssembly modules with minimal runtime and fast startup. Fastly’s Varnish servers invoke FaaS modules and it sounds like Shopify's Ruby centric platform is better suited to this architecture.
- kentonv 6y ago> Cloudflare runs a sandboxed V8 runtime in-process with its Nginx servers Maybe nitpicking, but that's not quite right. The Workers Runtime is a separate process from nginx and is inside a heavy second-layer sandbox separating it from the rest of the system. Multiple Workers Runtime instances exist on each machine to serve different tiers of customers, and each instance may additionally create further subprocesses to provide extra sandboxing adaptively. Here's a diagram: https://blog.cloudflare.com/mitigating-spectre-and-other-security-threats-the-cloudflare-workers-security-model/#architecturaloverview https://blog.cloudflare.com/mitigating-spectre-and-other-sec... (In that diagram, the "Inbound/Outbound HTTP Proxy" boxes are, at least at present, nginx, but the big middle box is a new server architecture written from scratch.)
- sradman 6y agoThat is not nitpicking at all. Definitely not in-process. Thanks for pointing that out.
- robertlagrant 6y agoAah, that's why Fastly's involved. Thanks!