4 ms·

Sandstorm without self hosting has no interest though. (Edit: see below, where the creator states it _can_ be run locally) Buzz looks like a more reasonable di

by mosura 2mo ago

Sandstorm without self hosting has no interest though. (Edit: see below, where the creator states it _can_ be run locally) Buzz looks like a more reasonable direction than this does.

hobofan 2mo ago
Yes, just like SaaS was a limitation to it's utility, PaaS is still a limitation, just on a different level.
kentonv 2mo ago
What do you mean? This is 100% open source and self-hostable! https://github.com/cloudflare/cloudflare-os https://github.com/cloudflare/cloudflare-os It runs on the open source Workers Runtime: https://github.com/cloudflare/workerd https://github.com/cloudflare/workerd You can run it at home if you want. There's even a Home Assistant Gatekeeper.
- blehn 2mo ago
  I'd say better to not call it Cloudflare in that case
  - kentonv 2mo ago
    The idea is actually supposed to be that Cloudflare OS is Cloudflare's internal instance, but when you deploy it for your own company, you call it "<your company> OS". The product name and logo are configurable in the admin settings. Yeah it's a little cheesy. Sorry.
- mosura 2mo ago
  So you can run it off the public internet with no sneaky external dependency on cloudflare, slack etc? And it would be functionally the same? With the same performance if you put enough hardware there? If so cool, and that should have been clearly in the announcement, because as it sounded it is “I am a sucker, lock me in!”
  - kentonv 2mo ago
    > So you can run it off the public internet with no sneaky external dependency on cloudflare, slack etc? Yes. It even supports ollama and works decently well with some local LLMs. > And it would be functionally the same? With the same performance if you put enough hardware there? Honestly it is faster running locally. > If so cool, and that should have been clearly in the announcement, We had so many things we wanted to say, it was hard to fit them all into one story. The blog post is for an enterprise audience. My tweet thread is for the hacker audience.
    - mosura 2mo ago
      That is actually cool. Maybe it is my bubble, but the experience people are having with Anthropic particularly is motivating a big “get this stuff back under control” effort so while it may not be strategically optimal for Cloudflare the local hosting would prove more valuable to enterprises than maybe a few years back, even if presented as a backup plan.
    - edaemon 2mo ago
      Neat! How does that work with the AI Gateway portion? I see some references in the code but at a quick glance I can't tell if you can configure it to skip AI Gateway.
      - kentonv 2mo ago
        Use of Cloudflare AI Gateway is optional. In the default configuration, you just plop your Anthropic/OpenAI/Gemini/Workers AI/ollama API keys into the UI and it talks to each provider directly. That said, I would recommend AI Gateway, it has a lot of nice features. :)
  - upcoming-sesame 2mo ago
    You're not alone The name "cloudflare-os" by itself made me think this was heavily based on Cloudflare
- nolist_policy 2mo ago
  Do you have a store/list of public blueprints like sandstorm?
  - kentonv 2mo ago
    Not yet, but that's an obvious direction to take things. :) I'm really excited by the idea that this platform makes it safe to use blueprints that someone else vibe coded, without worrying about whether they checked it for security bugs, etc. Basically if the app works, it works. So yeah, there absolutely should be a marketplace so everyone can try everyone else's stuff. BTW there are three blueprints installed automatically (docs, slides, sheets).
    - runtime_terror 2mo ago
      Couldn't the blueprint exfiltrate incoming data to an external location for example?
      - ocdtrekkie 2mo ago
        Blueprints shouldn't (if I know anything about Kenton) have access to the Internet/external locations without you granting it permission to.
      - kentonv 2mo ago
        The blueprint is just code, it does not include data or capabilities. It's, I suppose, possible that the agent added secrets to the code itself. Not, like, API keys -- the agent never sees those. But it could have extracted sensitive info and put it into code, perhaps? We can implement restrictions on exporting blueprints from workspaces that have seen sensitive secrets, though this might be more annoying than useful. It's a tricky balance.
    - mlrtime 2mo ago
      Another request for Home lab geeks: A Proxmox installer script. I tried going through the wizard to install, it would be nice if there was a proxmox container or vm to spin up quickly and test rather than npm or cloudflare account (which requires a $5/month workers plan).
- andersonpico 2mo ago
  Thank you for your work over the years, sandstorm is a really interesting and inspiring piece of software. I'll certainly try to self-host CloudflareOS.
benatkin 2mo ago
There is also qm with smol machines. I found this out the long way, by looking at the contributors to qm at https://github.com/yc-software/qm https://github.com/yc-software/qm where I found BinSquare, the founder of smol machines. Then I found a tweet about a public instance of it where I could try out having it code something agentically - I'm in the replies here: https://x.com/binsquares/status/2083305704274976819 https://x.com/binsquares/status/2083305704274976819 I guess the lock-in is to Cloudflare Workers, which is limited to JavaScript. I would in fact look into projects that are built around MicroVMs and WebAssembly. It seems Buzz would be happy to use smolmachines, or whatever. You'd have to roll your own permission system, but smolmachines would at least take care of being able to use stuff within an app, by offering persistent, portable containers. Actually I think now I can finally say why this sandstorm.io with Cloudflare OS has lock-in. The promise is "you can pretty much go wild" and that you can hand it off to non-technical people to do that. Much as you squint, there is not a sophisticated access control system available to self-hosted users. There's a framework for building a sophisticated access control system, but that isn't the same as having something open source that you can self-host and let non technical users go wild. However, this is cool. I just agree with you that Buzz sounds more interesting to me as someone who was into Sandstorm.
- runtime_terror 2mo ago
  Workers also supports Python, Rust and anything via WebAssembly (Go, C, etc)
  - benatkin 2mo ago
    Ah, that changes the amount of work and the reward in the equation for attempting to self-host Cloudflare OS. And I knew that I could run WebAssembly manually inside of JavaScript, but it seems to be runnable directly too. What would help me to know further is how Cloudflare OS integrates its access control in that open source project, and if it is conveniently available to WebAssembly, Python, or Rust workers.

by mosura 2mo ago

Sandstorm without self hosting has no interest though. (Edit: see below, where the creator states it _can_ be run locally) Buzz looks like a more reasonable direction than this does.

hobofan 2mo ago

Yes, just like SaaS was a limitation to it's utility, PaaS is still a limitation, just on a different level.

kentonv 2mo ago

What do you mean? This is 100% open source and self-hostable! https://github.com/cloudflare/cloudflare-os https://github.com/cloudflare/cloudflare-os It runs on the open source Workers Runtime: https://github.com/cloudflare/workerd https://github.com/cloudflare/workerd You can run it at home if you want. There's even a Home Assistant Gatekeeper.

blehn 2mo ago
I'd say better to not call it Cloudflare in that case
- kentonv 2mo ago
  The idea is actually supposed to be that Cloudflare OS is Cloudflare's internal instance, but when you deploy it for your own company, you call it "<your company> OS". The product name and logo are configurable in the admin settings. Yeah it's a little cheesy. Sorry.
mosura 2mo ago
So you can run it off the public internet with no sneaky external dependency on cloudflare, slack etc? And it would be functionally the same? With the same performance if you put enough hardware there? If so cool, and that should have been clearly in the announcement, because as it sounded it is “I am a sucker, lock me in!”
- kentonv 2mo ago
  > So you can run it off the public internet with no sneaky external dependency on cloudflare, slack etc? Yes. It even supports ollama and works decently well with some local LLMs. > And it would be functionally the same? With the same performance if you put enough hardware there? Honestly it is faster running locally. > If so cool, and that should have been clearly in the announcement, We had so many things we wanted to say, it was hard to fit them all into one story. The blog post is for an enterprise audience. My tweet thread is for the hacker audience.
  - mosura 2mo ago
    That is actually cool. Maybe it is my bubble, but the experience people are having with Anthropic particularly is motivating a big “get this stuff back under control” effort so while it may not be strategically optimal for Cloudflare the local hosting would prove more valuable to enterprises than maybe a few years back, even if presented as a backup plan.
  - edaemon 2mo ago
    Neat! How does that work with the AI Gateway portion? I see some references in the code but at a quick glance I can't tell if you can configure it to skip AI Gateway.
    - kentonv 2mo ago
      Use of Cloudflare AI Gateway is optional. In the default configuration, you just plop your Anthropic/OpenAI/Gemini/Workers AI/ollama API keys into the UI and it talks to each provider directly. That said, I would recommend AI Gateway, it has a lot of nice features. :)
- upcoming-sesame 2mo ago
  You're not alone The name "cloudflare-os" by itself made me think this was heavily based on Cloudflare
nolist_policy 2mo ago
Do you have a store/list of public blueprints like sandstorm?
- kentonv 2mo ago
  Not yet, but that's an obvious direction to take things. :) I'm really excited by the idea that this platform makes it safe to use blueprints that someone else vibe coded, without worrying about whether they checked it for security bugs, etc. Basically if the app works, it works. So yeah, there absolutely should be a marketplace so everyone can try everyone else's stuff. BTW there are three blueprints installed automatically (docs, slides, sheets).
  - runtime_terror 2mo ago
    Couldn't the blueprint exfiltrate incoming data to an external location for example?
    - ocdtrekkie 2mo ago
      Blueprints shouldn't (if I know anything about Kenton) have access to the Internet/external locations without you granting it permission to.
    - kentonv 2mo ago
      The blueprint is just code, it does not include data or capabilities. It's, I suppose, possible that the agent added secrets to the code itself. Not, like, API keys -- the agent never sees those. But it could have extracted sensitive info and put it into code, perhaps? We can implement restrictions on exporting blueprints from workspaces that have seen sensitive secrets, though this might be more annoying than useful. It's a tricky balance.
  - mlrtime 2mo ago
    Another request for Home lab geeks: A Proxmox installer script. I tried going through the wizard to install, it would be nice if there was a proxmox container or vm to spin up quickly and test rather than npm or cloudflare account (which requires a $5/month workers plan).
andersonpico 2mo ago
Thank you for your work over the years, sandstorm is a really interesting and inspiring piece of software. I'll certainly try to self-host CloudflareOS.

benatkin 2mo ago

There is also qm with smol machines. I found this out the long way, by looking at the contributors to qm at https://github.com/yc-software/qm https://github.com/yc-software/qm where I found BinSquare, the founder of smol machines. Then I found a tweet about a public instance of it where I could try out having it code something agentically - I'm in the replies here: https://x.com/binsquares/status/2083305704274976819 https://x.com/binsquares/status/2083305704274976819 I guess the lock-in is to Cloudflare Workers, which is limited to JavaScript. I would in fact look into projects that are built around MicroVMs and WebAssembly. It seems Buzz would be happy to use smolmachines, or whatever. You'd have to roll your own permission system, but smolmachines would at least take care of being able to use stuff within an app, by offering persistent, portable containers. Actually I think now I can finally say why this sandstorm.io with Cloudflare OS has lock-in. The promise is "you can pretty much go wild" and that you can hand it off to non-technical people to do that. Much as you squint, there is not a sophisticated access control system available to self-hosted users. There's a framework for building a sophisticated access control system, but that isn't the same as having something open source that you can self-host and let non technical users go wild. However, this is cool. I just agree with you that Buzz sounds more interesting to me as someone who was into Sandstorm.

runtime_terror 2mo ago
Workers also supports Python, Rust and anything via WebAssembly (Go, C, etc)
- benatkin 2mo ago
  Ah, that changes the amount of work and the reward in the equation for attempting to self-host Cloudflare OS. And I knew that I could run WebAssembly manually inside of JavaScript, but it seems to be runnable directly too. What would help me to know further is how Cloudflare OS integrates its access control in that open source project, and if it is conveniently available to WebAssembly, Python, or Rust workers.