One argument I could bring is that despite all its claims, OpenAI still had to switch from containers to MicroVMs because its agents under test still managed to break out from their containers. Is the security model of a Sandstorm grain so much better that agents wouldn't figure out how to break out of it?
But honestly, it didn't work well, because of cold start times and memory usage. It's bad enough when a server takes seconds to start, but if every document you open has a long startup time and uses hundreds of MB of RAM, it's really painful.
Cloudflare OS doesn't use containers. It uses Dynamic Workers, which are 100x more efficient: https://blog.cloudflare.com/dynamic-workers/
So the stuff I have been building in Workers for the past 9 years turns out to be the thing that Sandstorm needed all along. What a coincidence. :)
I'm making a whole new language to get around the problem you're talking about: it brings no runtime at all. One of my targets is a Sandstorm like system I've been slowly working on, but I'd love for it to be a fit for the actual Sandstorm successor.
It's using Workers (capital W) and the core Cloudflare primitives.
I don't feel safe building on this or touching this.
I'd be happier if a startup or neutral party built this in a more agnostic way.
Sometimes you just can't advance the state of the art while also maintaining broad compatibility.
It's all open source, though. You can run the whole stack on your own machine.
I 100% understand the hustle. I do the same thing. I just don't trust a giant like Cloudflare that has done several things to weaken the open web and establish a position that is all too powerful. I don't want to give them an iota of support. Even using open source buys into their mindshare, distribution, ecosystem, and eventual supremacy and lock-in.
I'd buy this from a smaller company for sure. Just not from Google, AWS, Cloudflare.
If this was a YC startup I'd have given you my credit card info already.
I don't know what your stock in Cloudflare is like, but your upside would be way bigger building this externally. You'd probably raise an extremely large seed round.
Consider launching your own startup. Don't give Cloudflare all the upside.
Edit: I didn't realize you'd already responded. Was clarifying my position and wishes for this to not be something made by Cloudflare.
Workers is my startup-within-Cloudflare. It won't make me a billionaire, but it has still made me more money than I actually know what to do with, while being able to delegate all the stuff I don't like doing to other parts of the company that already do it quite well.
I have a lot of influence here. The CEO and CTO listen to me. E.g. I made my argument this all needed to be open source and self hostable, and they agreed enthusiastically.
I don't think I could build this better as a separate company.
I'll check it out.
I'm still anxious about the Cloudflare angle (and that's hard to shake), but beggars can't be choosers. You've legitimately built something cool and done a fantastic job spearheading that.
Thank you for the kind and well stated response. Sounds like you've had a lot of fun building this too.
There’s not much point in preventing hyper visor escape style exploits if the agent can just SSH or psql log in to an adjacent container. Likewise there are near infinite ways to do weird things with the network to make stuff happen in another less controlled environment (eg sign up for AWS free account, make VM, do everything on that VM where controls don’t apply).
There are tools to do this, but I’ve never seen anyone package them up in a way that was pleasant to interact with. It’s got the SELinux problem of being useful, but annoying enough that everyone just disables it the second it gets in the way. It’s surprisingly hard to manage what should be able to connect to what as you start scaling out the number of things on the network. Whoops, you forgot that random software embeds its own DNS over HTTPS resolver so the normal DNS profile won’t work and everything crashed kind of issues.
We're already contending with users wanting to hook up every SaaS MCP to every other SaaS platform and then slap AI on top. Having a controlled sandbox for that would hugely simplify things.
Linux containers are meant to be used by those with significant software engineering skills. Sandstorm was designed to be used, once installed by someone else, by grandma.
The article posted buries the lead. Cloudflare OS reads like almost any other AI knowledge base until midway when apps are introduced and then becomes overly technical with a code snippet.
My tweet thread, and the GitHub readme, is really the presentation intended for the HN crowd. The blog post is for a different audience.
No one? Like literally, I don't understand a thing of what the blog post is saying. It's vague to the point of meaning nothing. Every piece of text I've seen that explains CloudflareOS is clear except the blog post.
I don’t like offering criticism without a solution, but I’m not really motivated to come up with one here. It looks like employees may read this, so maybe someone will see the feedback.
TL;DR; jgc stopped editing the blog, and AI slop took over:
> Today, after more than 13 years at the company, I am joining Cloudflare’s board of directors and retiring from my full-time position as CTO.
> ...
> I wrote for, and edited, the Cloudflare Blog for many, many years
I sometimes wonder who AI marketing is really for. The people who would benefit from eliminating repetitive work, or other technical people who want to see interesting AI demos.. A lot of product launches end up looking like "Here's a prompt that bootstraps X," when the bigger story is that the prompt replaces an hour of repetitive work that nobody wanted to do in the first place.
What gets buried is the "lede". It is a really unusual thing — a deliberate, engineered misspelling of "lead" that leaked into broader use:
https://www.merriam-webster.com/wordplay/bury-the-lede-versu...
(Not meant as a nit-pick — it's just something that adds really fascinating historical colour to a useful expression, that people often mistakenly re-correct)
In my head there are corrections that are rude that I don't do, because I genuinely think authentic writing matters more and more, and because I am absolutely not above reproach where grammar and spelling is concerned.
Then there are things I think people would want to know, that are either in the intellectual-you-have-a-little-bit-of-pinach-in-your-teeth territory or in the "cool fact" territory, or somewhere hazy in between.
I figured if one is going to correctly use an expressive phrase like "bury the lede" that they've perhaps only ever heard someone say, they would absolutely want to know about the spelling quirk, because it fully makes it better.
Other people obviously read it differently and the downvote was a useful signal.
Since "lead" (as in beginning of a story) and "lead" (as in metal) were frequently used in print newsrooms, the spelling of one changed over time to reduce confusion.
There were a number of other language convolutions in newsrooms, such as "slug" which meant a piece of hot metal, and so was useful for describing a spent bullet, the very short text that served as a title for a particular story, and a section of metal letters on the printing press.
/Worked for two major newspaper companies back when printing newspapers was akin to printing money.
When the story was complete, the notification varied from newspaper to newspaper, but very often they followed the AP's convention of writing "-30-" which I have always believed was something the AP print wire actually (and surprisingly) adopted from the broadcast side, because broadcast stories were ideally 30 seconds long.
Buzz looks like a more reasonable direction than this does.
https://github.com/cloudflare/cloudflare-os
It runs on the open source Workers Runtime:
https://github.com/cloudflare/workerd
You can run it at home if you want. There's even a Home Assistant Gatekeeper.
And it would be functionally the same? With the same performance if you put enough hardware there?
If so cool, and that should have been clearly in the announcement, because as it sounded it is “I am a sucker, lock me in!”
Yes. It even supports ollama and works decently well with some local LLMs.
> And it would be functionally the same? With the same performance if you put enough hardware there?
Honestly it is faster running locally.
> If so cool, and that should have been clearly in the announcement,
We had so many things we wanted to say, it was hard to fit them all into one story.
The blog post is for an enterprise audience. My tweet thread is for the hacker audience.
Maybe it is my bubble, but the experience people are having with Anthropic particularly is motivating a big “get this stuff back under control” effort so while it may not be strategically optimal for Cloudflare the local hosting would prove more valuable to enterprises than maybe a few years back, even if presented as a backup plan.
In the default configuration, you just plop your Anthropic/OpenAI/Gemini/Workers AI/ollama API keys into the UI and it talks to each provider directly.
That said, I would recommend AI Gateway, it has a lot of nice features. :)
I'm really excited by the idea that this platform makes it safe to use blueprints that someone else vibe coded, without worrying about whether they checked it for security bugs, etc. Basically if the app works, it works. So yeah, there absolutely should be a marketplace so everyone can try everyone else's stuff.
BTW there are three blueprints installed automatically (docs, slides, sheets).
It's, I suppose, possible that the agent added secrets to the code itself. Not, like, API keys -- the agent never sees those. But it could have extracted sensitive info and put it into code, perhaps?
We can implement restrictions on exporting blueprints from workspaces that have seen sensitive secrets, though this might be more annoying than useful. It's a tricky balance.
I guess the lock-in is to Cloudflare Workers, which is limited to JavaScript. I would in fact look into projects that are built around MicroVMs and WebAssembly. It seems Buzz would be happy to use smolmachines, or whatever. You'd have to roll your own permission system, but smolmachines would at least take care of being able to use stuff within an app, by offering persistent, portable containers.
Actually I think now I can finally say why this sandstorm.io with Cloudflare OS has lock-in. The promise is "you can pretty much go wild" and that you can hand it off to non-technical people to do that. Much as you squint, there is not a sophisticated access control system available to self-hosted users. There's a framework for building a sophisticated access control system, but that isn't the same as having something open source that you can self-host and let non technical users go wild.
However, this is cool. I just agree with you that Buzz sounds more interesting to me as someone who was into Sandstorm.
This can only be correct when the application can’t affect anything outside the sandbox. Which would significantly restrict useful applications.
https://x.com/KentonVarda/status/2084990302784307363
-------------
Of course, personal apps are more useful if they can connect to external services. Cloudflare OS introduces a "connector" system we call Gatekeepers. This is sort of like MCP (and MCP is supported as a kind of Gatekeeper), but with a lot more:
* Instead of exposing tools, a Gatekeeper exposes a Cap'n Web RPC API. That makes it appropriate for use by both agents (via code mode) and Gadgets.
* Gatekeepers integrate with the Cloudflare OS UI to provide inline audit logging and human-in-the-loop approvals for all side-effecting actions.
* When an action requires approval, the agent does not need to stop and wait for it. A Gatekeeper will simulate the outcome, allowing the agent to keep running and queue up more work. You can then approve everything in a batch at the end. Hopefully, this means you no longer feel the need to turn on auto-approve! (But you still can if you want.)
We have already built Gatekeepers for a huge number of services, from GitHub to Home Assistant. We've found, with the right skills, AI can basically crank these things out for any given API, solving the chicken-and-egg ecosystem problem. We are working on a "software factory" of sorts where you can input the API docs for your favorite service and get a well-written Gatekeeper. That's not quite ready yet -- so for now use the ones we provide or use the write-gatekeeper skill to write your own. You can add your own Gatekeepers to your personal deployment.
When you share a Gadget, we verify that anyone you share with also has direct permission to access each of the resources it is connected to (via the Gatekeeper system). Hence, no security bug in the Gadget itself could accidentally grant people access to things they don't already have.
And if you want real life examples, every single LLM provider has gotten insane amounts of data shared to them, even if you have to approve.
Can you say more about how you simulate outcomes of approvals? For example, if I need an approval to be granted permission to read a document, how could it simulate the document contents?
Reads are, however, limited to only the resources you have explicitly attached.
Moreover, since agents and gadgets run in a sandbox with essentially no access to the outside world except via approved channels (Gatekeepers), it's essentially not possible for the agent to leak secrets it has seen unless you approve a later write.
In fact, the system actually keeps track of everything the agent / gadget has observed to know if it is "tained", and can use that to flag later actions as dangerous, e.g. due to prompt injection or possible leaking of secrets. (This is still evolving, but all the groundwork is there.)
(Of course, this assumes you trust the LLM provider itself not to steal secrets from your prompts. Most LLM providers offer zero-data-retention options, but if you don't trust them you can also use a local LLM. We support ollama and will support others in time.)
This is what allowed us to connect Cloudflare OS to our own sensitive internal data sources, containing things like customer data, revenue info, etc. Once you connect to one of those, the system enforces no data can be shared out of it.
That said, the policies are a bit blunt right now, maybe overly restrictive. We're going to be evolving it further.
This was a great summation.
Let me introduce you to scrapling+MCP--the closest I've come.
Stealthed, controllable browser gives you an API to arbitrary web things
You can't modify it, but you can extend it which imo is the next best thing
adb (Android) is close albeit a bit more tedious. It's fun watching an LLM take screenshots, read them, then send input events back to the phone.
If you have a rooted Android, you _can_ modify the apps. Xposed, ReVanced, et al subject to Play Integrity's ever growing pervasiveness
> I'm a web developer, but I can't really use my skills to provide an open source web app the way I'd like to. I'd like to build a small server-side budgeting app that people can use from their computers or phones to record expenses, but there's no way I can ask people to find a web host that lets them run rails, or set up a heroku account or whatever.
> So my only alternative would be to run the service myself, but then I'm storing other people's data, I have to worry about scaling if lots of people use it, and user accounts, and all this stuff.
> The idea of sandstorm is folks run this platform on their personal servers, and then it lets you browse an app store like interface and one-click install these server side apps. So I'd bundle up my budgeting rails app as a sandstorm package, and if someone wants to track their expenses from a variety of devices, they install the app. Now they're running it so the data is theirs, there's no scaling issues, and user authentication is provided by sandstorm.
It was a beautiful thing that tried to thread the needle between personal, self-hosted software and cloud-based "software as a service". I've long thought that "federated" software is the sweetspot, since it allows people to control software in more natural organizational units like families or communities, without being centrally controlled or devolving into the craziness that is "decentralized".
However, while the functionality of Cloudflare OS may be Sandstorm-inspired, I feel like it doesn't really have its soul. What a difference a decade makes! Here's another comment[1] from me 10 years ago about why I loved sandstorm, which begins:
> Oh no! I really believe sandstorm (or something like it) is what we need the future to be. Rather than having everything get sucked up into Google, Facebook, Apple, or these other few centralized services, imagine where everyone has a personal (or family, or church group or whatever) server, and they can one-click install their email apps, their document apps, etc.
These days Cloudflare has become one of the "Google, Facebook, Apple" that I mentioned. I'm still a fan of Cloudflare generally, and with kentonv behind this I absolutely have to try it out, but it doesn't have the open source, community-oriented charm that I think Sandstorm had.
edit: Oh, I didn't read far enough down the tweet chain:
> I am so proud to say, we are making this whole thing open source, Apache 2.0 license, no catch.
Hooray! Sandstorm's back on the menu, boys! This really does make me happy. I never should have doubted, ha.
> I liked Kenton's take on this: https://x.com/KentonVarda/status/2084990137180590572
What particular feature/capability made you think this?
I do not disagree but i am curios. Lets have a discussion instead of just throwing feel good vibes around...
Yep, that's precisely the vision I formulated some months ago: https://manuel.kiessling.net/2025/11/04/what-if-software-shi...
How is this different than the capabilities which cowork by claude / chat gpt desktop apps now a days give in terms of core capabilities.
The fact that you can maybe fetch bugs from jira and present in the way you want is true for any of the agentic orchestrators, so is it really the USP ?
One difference I found against other orchestrators was that they work on a per seat billing model. Example if you have 10 team members who want access to a shared agent infrastructure, you would end up paying 10 * 20$ = 200$ per month while in this case it is probably just the AI and infrastructure bill that you have to spend, which probably might cross 200 dollars as well.