Cloudflare OS
Introduction
Cloudflare OS is the internal productivity platform Cloudflare open-sourced in August 2026, built by the engineers behind Workers and Durable Objects. It answers a specific enterprise problem: how do you let non-technical employees build and run their own AI-powered apps without leaking corporate data, running up unbounded LLM bills, or creating shadow IT?
Its answer inverts centralised SaaS. Instead of one shared application, every user runs private, sandboxed instances of micro-applications (“Gadgets”), and every outbound capability passes through a capability-based security proxy (“Gatekeeper”).
Key Contributions
Architecture
A monorepo with cleanly separated layers:
packages/
├── router/ # Public ingress worker (frontend, /api/*, /gatekeeper/*)
├── workshop-backend/ # The kernel — User & Workspace Durable Objects, Overseer, AI routing
├── workshop-frontend/ # React SPA (Vite, Kumo UI, Monaco editor)
├── workshop-shared/ # RPC interface definitions, shared Cap'n Web types
└── gatekeeper-*/ # Per-integration proxies: GitHub, Google, Supabase, Slack, Context, MCP
Three ideas carry the design:
- Stateful edge execution — workspace state, sessions, and chat history live inside Durable Objects (
UserDurableObject,WorkspaceDurableObject), not a central database. - Dynamic Worker facets — a Gadget’s server logic is compiled into a Worker script on the fly.
- Code-Mode agent engine — instead of emitting JSON tool calls, the coding agent writes TypeScript that runs inside the workspace execution context. See Model Context Protocol (MCP) for the tool-call convention this departs from.
The lock-in profile
| Layer | Coupling | Why |
|---|---|---|
| Runtime engine | Low (theoretical) | workerd, Cloudflare’s open-source C++ V8 runtime; runs locally via pnpm run-local |
| State & storage | Critical | Built on Durable Objects, KV namespaces, R2 |
| Sandboxing | Critical | Dynamic Workers and Durable Object facets |
| Auth & ingress | Medium | Password auth works locally; production expects Cloudflare Access |
| AI billing | Medium | Cloudflare AI Gateway (CF_AI_GATEWAY) for token tracking, routing, credit billing |
Self-hosting on plain Linux/Docker is technically possible and currently impractical. workerd runs the codebase locally, but a multi-node production cluster means hand-writing Cap’n Proto config (workerd.capnp) to replicate Durable Object storage and Dynamic Worker isolation. The repo’s own docs say deploy-to-your-own-server is “COMING SOON”.
Enterprise readiness: strong security, weak administration
- Data privacy & isolation — excellent. Zero-trust sandboxes per gadget mean no ambient credentials to exfiltrate.
- Capability security — excellent. Gatekeepers include action-simulation queues for human-in-the-loop approval.
- AI cost gateway — good. Token tracking and model routing via AI Gateway.
- Internationalisation — weak. Hardcoded English strings in the React shell, no i18n framework. Translating the shell means editing core components, which guarantees merge conflicts on every upstream pull.
- Enterprise directory — weak. Users are isolated
UserDurableObjectinstances; no RBAC admin dashboard, no LDAP/AD sync without Cloudflare Access in front. - Team budgets — weak. Per-user daily call limits only (
DAILY_LLM_CALL_LIMIT=100); no departmental dollar budgets. - On-prem/Docker deploy — experimental.
The adopt-or-build decision
Adopt or fork if your infrastructure is already standardised on Workers / Durable Objects / R2, your goal is giving non-technical staff a secure AI coding agent, and you want capability security with human-in-the-loop approval.
Build your own if you must run on standard Docker/Kubernetes/on-prem, need real i18n, need LDAP/AD and departmental budgets, or prefer a vendor-neutral TypeScript stack (Next.js + Postgres + Qdrant + Vercel AI SDK or Portkey as the gateway).
The verdict is genuinely two-sided: the capability-security paradigm for sandboxing AI-generated software is the strong part; the tight coupling to Cloudflare’s serverless primitives is what makes it hard to adopt outside that ecosystem.
Related
- Serverless Architecture — the execution model Workers and Durable Objects belong to
- Model Context Protocol (MCP) — the standard tool-call path, which Code Mode replaces with generated TypeScript
- Vector Databases and pgvector in Production — Qdrant in the recommended build-your-own stack
- AI Model Routing — what an AI gateway does for cost and model selection
- Cloud Security — zero-trust and capability-based access as security posture
- API Gateway — Gatekeepers as per-integration proxies with rate and budget control
- Coding Agents and AI Tools — parent topic
References
- Cloudflare OS, is it worth? — Emre Yılmaz, 2026-08-11