The post links to this: https://blog.cloudflare.com/mitigating-spectre-and-other-security-threats-the-cloudflare-workers-security-model/ https://blog.cloudflare

The post links to this: https://blog.cloudflare.com/mitigating-spectre-and-other-security-threats-the-cloudflare-workers-security-model/ https://blog.cloudflare.com/mitigating-spectre-and-other-sec... so the answer is, a lot of things: * v8 isolates * private processes for debugging/inspection * "cordoned" V8 runtimes organized by level of trust (guards against V8 zero-days for one) * linux namespacing as an outer sandbox layer, blocking fs and network access * explicitly allowed capability-based security ...etc.