This is really interesting. I built a similar product (not released yet), but it uses Kubernetes as the infrastructure layer instead of Cloudflare OS. I guess all these years later I am left with the same existential question that plagued Sandstorm. What is its relevance in the context of Linux containers? This is not a rhetorical question, is there a real benefit for a Sandstorm grain over a docker style Linux container? Does a containerized process not have all the same benefits of a Sandstorm grain, with the added benefit of not requiring any modifications of the containerized software?

One argument I could bring is that despite all its claims, OpenAI still had to switch from containers to MicroVMs because its agents under test still managed to break out from their containers. Is the security model of a Sandstorm grain so much better that agents wouldn't figure out how to break out of it?

That should have been the announcement.

The article posted buries the lead. Cloudflare OS reads like almost any other AI knowledge base until midway when apps are introduced and then becomes overly technical with a code snippet.

Sandstorm without self hosting has no interest though. (Edit: see below, where the creator states it _can_ be run locally)

Buzz looks like a more reasonable direction than this does.

> the sandbox is so secure that you can pretty much go wild -- the AI cannot introduce a significant security bug.

This can only be correct when the application can’t affect anything outside the sandbox. Which would significantly restrict useful applications.

Thank you. The tweet values the readers time. The blog post. Dear lord. So much noise.

This was a great summation.

>This doesn't work in the cloud Software-as-a-Service model, because you are not running your own copy of the app.

Let me introduce you to scrapling+MCP--the closest I've come.

Stealthed, controllable browser gives you an API to arbitrary web things

You can't modify it, but you can extend it which imo is the next best thing

adb (Android) is close albeit a bit more tedious. It's fun watching an LLM take screenshots, read them, then send input events back to the phone.

If you have a rooted Android, you _can_ modify the apps. Xposed, ReVanced, et al subject to Play Integrity's ever growing pervasiveness

https://xcancel.com/KentonVarda/status/2084990137180590572

> What if, when you wanted a new feature in the software you are using, you could just prompt your agent to add it?

Yep, that's precisely the vision I formulated some months ago: https://manuel.kiessling.net/2025/11/04/what-if-software-shi...

Oh, wow! This is a lot clearer to me. I've long had a soft spot in my heart about Sandstorm. Here's a comment[0] I made 11 years ago about what Sandstorm was, to me:

> I'm a web developer, but I can't really use my skills to provide an open source web app the way I'd like to. I'd like to build a small server-side budgeting app that people can use from their computers or phones to record expenses, but there's no way I can ask people to find a web host that lets them run rails, or set up a heroku account or whatever.

> So my only alternative would be to run the service myself, but then I'm storing other people's data, I have to worry about scaling if lots of people use it, and user accounts, and all this stuff.

> The idea of sandstorm is folks run this platform on their personal servers, and then it lets you browse an app store like interface and one-click install these server side apps. So I'd bundle up my budgeting rails app as a sandstorm package, and if someone wants to track their expenses from a variety of devices, they install the app. Now they're running it so the data is theirs, there's no scaling issues, and user authentication is provided by sandstorm.

It was a beautiful thing that tried to thread the needle between personal, self-hosted software and cloud-based "software as a service". I've long thought that "federated" software is the sweetspot, since it allows people to control software in more natural organizational units like families or communities, without being centrally controlled or devolving into the craziness that is "decentralized".

However, while the functionality of Cloudflare OS may be Sandstorm-inspired, I feel like it doesn't really have its soul. What a difference a decade makes! Here's another comment[1] from me 10 years ago about why I loved sandstorm, which begins:

> Oh no! I really believe sandstorm (or something like it) is what we need the future to be. Rather than having everything get sucked up into Google, Facebook, Apple, or these other few centralized services, imagine where everyone has a personal (or family, or church group or whatever) server, and they can one-click install their email apps, their document apps, etc.

These days Cloudflare has become one of the "Google, Facebook, Apple" that I mentioned. I'm still a fan of Cloudflare generally, and with kentonv behind this I absolutely have to try it out, but it doesn't have the open source, community-oriented charm that I think Sandstorm had.

edit: Oh, I didn't read far enough down the tweet chain:

> I am so proud to say, we are making this whole thing open source, Apache 2.0 license, no catch.

Hooray! Sandstorm's back on the menu, boys! This really does make me happy. I never should have doubted, ha.

[0] https://news.ycombinator.com/item?id=10237821

[1] https://news.ycombinator.com/item?id=13589471

You should probably add a disclaimer you work at Cloudflare yourself?

> I liked Kenton's take on this: https://x.com/KentonVarda/status/2084990137180590572

https://archive.vn/wvgxq

Damn, this is a pretty big deal!

I don't get it

How is this different than the capabilities which cowork by claude / chat gpt desktop apps now a days give in terms of core capabilities.

The fact that you can maybe fetch bugs from jira and present in the way you want is true for any of the agentic orchestrators, so is it really the USP ?

One difference I found against other orchestrators was that they work on a per seat billing model. Example if you have 10 team members who want access to a shared agent infrastructure, you would end up paying 10 * 20$ = 200$ per month while in this case it is probably just the AI and infrastructure bill that you have to spend, which probably might cross 200 dollars as well.

This is 100% open source and self-hostable.

https://github.com/cloudflare/cloudflare-os

It runs on top of our open source runtime.

https://github.com/cloudflare/workerd

Cloudflare seems mature enough at this point that if you're willing to accept any kind of vendor lock-in, then accepting it through them is likely acceptable. I won't say they're on-par with the big cloud providers, but if they offer the services you need and you'd be willing to lock-in with AWS, etc., then they should be considered.

If you're generally opposed to any vendor lock-in, then Cloudflare is definitely a hard sell. Many of their services are pretty specific to their ecosystem and I imagine trying to keep things portable would be infeasible any many scenarios. Granted, this is true in a provider like AWS, too, if you were depending heavily on their proprietary, managed services. But there's definitely value in knowing that you can stick to "generic" services as much as possible in AWS and be able to move away relatively easily.

Cloudflare is definitely becoming a "real" cloud provider (I'd say their release of R2, for me, pushed them into the "serious contender" category), but they focus on pretty specific features that aren't very portable. This Cloudflare OS service is a good example of that. If it is exactly what you need, then it is worth checking out and taking on the risk of vendor lock-in. But if you're doing something where long-term planning and portability is important, then you'll have a hard time warranting even considering them.

Yes. Be locked in. It's better to go 100% and only pay the switch costs if you have to.

Developing abstractions to let you switch technologies has 2 costs: The actual development, and not fully utilizing a specific technology. Lots of people prefer pain in small doses because it can be rationalized as eventual payoff.

There are degrees of this decision, of course, but I would say most folks worry too much about this particular champagne problem.

No, you’re not too paranoid. It has already proven both in the software and hardware world what vendor lock-in can lead to.

Also check out Bunny.net.

I feel exactly the same. The CF services I do use are DNS and R2. I'd be curious if there's a guide somewhere that lists their services through the lens of lock-in. For example, R2 is somewhat S3 compatible so it's less risky to use because I can swap providers.

They also provide cover to those doing the dirty stuff which drives the need for their other products.

Not remotely paranoid.

Cloudflare is hit or miss there.

They move pretty quick so they tend to ship a lot of product very quickly that have a lot of potentials. But they are very much MVPs, and you'll hit a lot of limitations that aren't always obvious at first blush. And then it can take years before they mature, at which point they'll pour a ton of resources and they'll go from useless to top tier in like 2 months.

It's really hard to tell.

The Vite plugin for Cloudflare Worker was one of those. It was really rough at first and I wasted hundreds of hours getting stuff working as advertised. And then in a week they fixed all the bugs.

AI Gateway is another. We used it at first because it seemed to check all the boxes, and turns out it had tons of limitations and almost none of the features of other offerings, with very few updates months+. And then recently they basically added all the features it was missing in a few weeks/months and now its good.

Agent SDK too, it was always behind with outdated dependencies and missing features all other agent frameworks had. And then one day they started iterating super fast and now its legitimately good.

You can never tell reading the docs, so you have to try it, curse because you only find the limitations once you're running the thing for real in production, abandon it, then a few months later its everything you could ever want.

I have a love hate relationship with Cloudflare. Mostly love, but still.

Yeah, with love the words "open source" mean a lot less here (de facto, of course not de jure) when the resulting open source product is entirely contingent on Cloudflare's PaaS.

And I think they suffer a little a little bit from their infrastructure being _comparatively_ unique. As providers go, they're on the harder end to replace with something else if you were to ever want to retarget your workloads.

Not at all too paranoid. Just like people figured out even with elastic everything, compute from Spot instances and all the other things we're supposed to do in AWS, the data out charges between AZ's and Region's still more than made up the cost savings for true resiliency. People are going to figure out relatively similar pricing traps in Cloudflare that are difficult to design around.

If you run an unindexed D1 query, then you get dinged for every row read. If you didn't properly perform scalability testing in non-production, then you'll never know this until you get a bill that you dissect to find out 5 million rows read for a 5 row result, if you even dig that far in the billing.

If you do not use the WebSocket Hibernation API with Durable Objects, then when you spin up a DO and hold open thousands of client WebSockets, you are being billed continuously for the entire time those connections are open—even if zero messages are being sent.

If you keep optimizing for payload size like many do by default but not event frequency (like poll a Worker every second instead of keeping a single stream open), it will show up unpleasantly in the billing.

If you treat KV like a transactional database keeping state, then be aware writes are expensive compared to reads. Pumping high-frequency write traffic into KV will result in exorbitant write operation costs and eventual consistency headaches. High-frequency state mutations belong in Durable Objects, not KV.

Batch your data to minimize request count, aggressively index your SQL queries to minimize row scans, and hibernate your idle persistent connections whenever you can. Doing all this will make your solutions cost efficient, but very locked into their ecosystem.

Cloudflare is just another corporation with greed in their eyes and if you don't design yourself to their puzzle than you're not welcomed.

This is an extra wall in walled garden land; another one you will need to jump if you want to break free. Another stab at gatekeeping the upcoming Ai era of the internet. It's no different to the playbook of Google, Apple, and Facebook of the 00's. So, no, you're not paranoid.

In the terms of security: My firefox on FreeBSD instantly triggers endless loops of "prove your human" on their turnstile. I can't use old handhelds of android and a single VPN triggers all. Anything that they don't see as "secure" you're denied from.

What is stopping Cloudflare from deeming your LLM as unsafe?

Scenario: You're ready to launch, you come up with the next best innovation for the next generation of Ai internet. Revolutionary and you're about to launch, blast off; wait. You're denied your launch because it threatens their service. The former: they like your idea more-so and clone it to become theirs.

Stories of above have all been posted on HN before. Startups have been sabotaged by rug-pulling of cloud providers. It is early-vendor lock-in and at it's best. Google & Co would be jealous; if they were not in bed with.

This will turn in to a netting of: Your Ai isn't using our service, so your Ai isn't allowed to interact with ours.

What does Cloudflare offer as a service? A turnstile to the Internet of Things and the difference this time is that you get to self-host your own corner on their patch of land with their ticket prices and access policy of.

Remember folks, no corporation gives a rat's ass about you. Internally, or externally, you're just another sheep to extract wool from.

If this succeeds, it's going to be in spite of its branding and marketing.

An operating system manages access to shared hardware (disk, CPU, memory, networking, display, etc. on a single machine OS). MS-DOS mainly handled shared access to disk via a file system abstraction, hence the name. The naming of Cloudflare OS makes sense to me.

It's a thing chatgpt comes up with, like em dashes or the worde 'delve'. High clanker/vibecoder signal

The key is the fine-grained instances (gadgets).

E.g. if you're using a slide editor app, each slide deck you create is its own instance of the app, whose code can be independently modified.

The slide content and the code are kept together and sandboxed together.

Adding HIPPA data to the app is no different to adding it to the slide content. I suppose whether or not that is OK depends on a lot of things, but the same things apply to traditional PowerPoint. The fact that the code is modifiable doesn't change the situation, since those modifications are sandboxed and constrained to that one slide deck.

From the GitHub page:

    This is not a traditional computer operating system. We use the term "operating system" in two senses:

    - An operating system for the company to be productive with AI, in a way that is safe, so that the security team can sleep at night.
    - An operating system for AI workloads, analogous to the sense in which a traditional operating system manages compute workloads.

Mostly to get trolls to retweet and complain about it for free advertising. It's working. ;)

Because it sounds impressive to clueless people ($).

I agree, it has now become a cliche buzzword that product managers slap on boring non-technical things to make them sound important.

Isn’t there even a bug tracker that some company calls an ‘issue OS’ or something absurd?

I think because the idea of an "agent operating system" is starting to feel more and more inevitable. Since I can use AI to:

  - Pull information from external sources
  - Transform and/or augment that information
  - Publish information

Because AI enables a new layer more akin to an actual OS. But also because I imagine they all want all the things running through them and an OS is the widest net they can cast in that direction.

Cause they’re trying to build an ecosystem

Same reason why grifters adopted web3 when Web 3.0 was already an established term.

Andy Jassy et al didn't quite name it that, but AWS was being thought of internally as "Internet OS".

It's better than "harness."

Because the English language evolves.

Indeed, at this point it's one of the most devalued terms in software. Every week I'm reading about some product calling itself "the Operating System for XYZ." It seems like it's what you do when "platform" just feels too modest. To me, if it's not bootable, calling your product an OS just reeks of marketing sleight of hand.

In some sense, it is. Sandstorm called itself an OS too. Arcan calls itself an Overlay-OS.

I think for any platform for general purpose computing that provides an application model that programs are written to target, it's close enough I don't mind. Ie: it makes sense for some end-user software to have a target for Windows, Linux, Sandstorm, etc.

& from the other side- what does Debian add that lets it call itself an OS? A set environment and package manager that software is specifically packaged for.

The same question is bothering me

This is just if you don't want to host it yourself, no?

The real question is, can Cloudflare become a equal or better OpenAI / Claude provider, while offering a vastly more robust platform than either?

I think the answer is yes, simply because both OAI and Anthropic leverage CF for their hosting today.

I used to meme back in 2008 (when Google docs first was becoming big) that "The problem has always been the sandbox". The problem Chrome and Firefox solved was the Sandbox - you can browse some random code across the web without worrying about getting hacked. The same problem has arisen today but now with AI agents.

There is likely to be huge winners in the AI space simply based on who can create the best way to contain AI agents and "expose AI value" safely.

So, that means even more pressure on OpenAI and Anthropic. I really don’t see how they will stay competitive long term. Cloudflare can offers way better product by integrating with the rest of their platform and offering a variety of models, including open models they host themselves

Yep, a pre-wrapped Codex for enterprise. Seems like the logical evolution from setting up an MCP.

https://github.com/cloudflare/cloudflare-os#cloudflare-os-an...

This is not a traditional computer operating system. We use the term "operating system" in two senses:

An operating system for the company to be productive with AI, in a way that is safe, so that the security team can sleep at night. An operating system for AI workloads, analogous to the sense in which a traditional operating system manages compute workloads.

It's open source, but it is so incredibly tied to their platform, that there is no vendor portability, which has made almost every of their product launches post-Workers kind of meh.

That's why this is open source.

https://github.com/cloudflare/cloudflare-os

You're supposed to customize it.

Also it features a whole system for adding your own skills and context.

Not a bad marketing strategy. Vendor lock in matters a lot less to some people than it does to me.

OH! I get it. OS = "open source"!

Is Chrome?

https://github.com/cloudflare/cloudflare-os

It's an operating system, so perhaps you need the ISO...

Or they can just transition to Cloudflare OS and keep their domain-specific data proprietary, which is where the money is in the first place.

This is the middle of Cloudflare's "Agents Week"... and I believe they had an Agents Week last year. We're like... at least a year or two into Cloudflare being in the AI party. ;)

Stay away, I had bad experience myself, I'm sure there is something better out there. For me I ended up asking Claude to build a custom RAG pipeline, took an afternoon and is 10x faster.