cloudflare

Bilingual

Agent needs a computer, not a container – introducing Cloudflare/computer
2 months ago
- Cloudflare introduces @cloudflare/computer, an agent runtime providing a computer-like environment for agents, handling compute across isolates, containers, or browsers.
- The package addresses scalability challenges of container-only agent systems by using lightweight isolates for most tasks, with containers only when necessary.
- Key features: a shared filesystem across isolates and containers, support for code and bash execution, and AI SDK-compatible tools for file manipulation.
- Workspace is the core, a virtual filesystem backed by SQLite, with isolate and container backends for executing tasks.
- Goal: agents use containers for less than 10% of work, with isolates handling the rest, improving efficiency and scalability.
I Finally Found a Use for IPv6
2 months ago
- IPv6 provides a massive number of addresses (e.g., a /64 subnet with 18.4 quintillion addresses) that can be used to assign unique IPv6 addresses to individual services on a single server.
- Using IPv6 with Cloudflare allows each service to listen on its own IPv6 address, while Cloudflare handles IPv4 to IPv6 translation for users without IPv6 support, eliminating the need for a reverse proxy for routing.
- This method reduces single points of failure compared to using a reverse proxy, as each service has its own address and can fail independently.
- Ephemeral environments can be deployed by assigning random IPv6 addresses via the Cloudflare API in CI/CD pipelines, with low collision risk.
- Docker’s IPv6 support is a major drawback, requiring workarounds like using '--network host' (which sacrifices security isolation) or 'macvlan' networks (which may lack IPv4 outbound connectivity).
- Docker 28.0 has added experimental IPv6-only network support, and Podman is noted for better IPv6 compatibility, suggesting gradual improvement in container IPv6 support.
GA4 vs. Cloudflare dashboard shows how much traffic isn't being tracked
2 months ago
- GA4 often misses a significant portion of traffic due to ad blockers, bots, consent banners, and Safari’s tracking protections.
- Cloudflare captures all requests passing through its edge, while GA4 only counts pageviews when JavaScript executes and reports back.
- The author built a dashboard using Papercrane and Claude Code to directly compare Cloudflare requests vs. GA4 pageviews for the top 10 landing pages.
- Key filters for fair comparison include requestSource 'eyeball', edgeResponseStatus 200, method GET, and exact clientRequestPath.
- Results showed GA4 recorded about 48% of Cloudflare requests across the top 10 landing pages over seven days.
- Page-by-page ratios varied widely, with some pages near parity and others above 1.0, indicating edge cases like bots or path mismatches.
- Caveats include that requests are not pageviews, paths can differ between systems, and GA4's session-scoped dimensions affect comparisons.
- The dashboard serves as a directional signal, not a definitive census, and is useful for spotting anomalies like bot swarms or broken instrumentation.
- The entire build took about 10 minutes and can be replicated on any site using the provided prompts and instructions.
Cloudflare Internal DNS is now generally available – The Cloudflare Blog
2 months ago
- Cloudflare Internal DNS, combining authoritative and recursive resolution for private networks, is now generally available on the same global network used for public DNS and Zero Trust services.
- It consolidates public and private DNS into a single platform with one API, audit trail, and policy engine, eliminating the need for separate systems and reducing drift and outages.
- Key features include simplifying split-horizon DNS via DNS Views, extending Zero Trust enforcement to DNS queries, and replacing legacy hardware with Cloudflare's global infrastructure.
- The system handles queries by routing them through Gateway Resolver, which applies Resolver Policies that direct traffic to specific Internal Authoritative DNS views or block queries, with optional fallback to public resolution.
- Changes propagate quickly through a unified write path (API, dashboard, or Terraform), replicating across Cloudflare's network and invalidating caches in seconds.
- Setup involves creating an internal zone, a DNS view, and a Gateway resolver policy, with support for various connectivity methods like Cloudflare One Client, DoH, DoT, and standard DNS.
- Internal DNS integrates with the Cloudflare Connectivity Cloud, enabling consistent resolution across remote users, branches, and clouds, and paving the way for tighter integration between DNS, networking, and Zero Trust policy.
Another Entry in the "Stuff Im Glad Im Not Responsible for" Ledger
2 months ago
- On July 3, 2026, a broken DNSSEC key rollover by the Albanian operator AKEP caused validation failures for the .al TLD, making sites unreachable for validating resolvers like Cloudflare's 1.1.1.1.
- Cloudflare implemented a Negative Trust Anchor (NTA) to temporarily suspend DNSSEC validation and restore resolution, similar to a previous .de incident, but NTAs previously lacked transparency about bypassed validation.
- During the .al incident, 1.1.1.1 introduced a new Extended DNS Error (EDE) code (EDE 33) to signal when an NTA is applied, providing clients with visibility that DNSSEC validation was bypassed.
- The incident highlights that TLD-level DNSSEC failures can affect all domains under that TLD, and EDE 33 helps close the transparency gap by informing users when responses are not DNSSEC-validated.
- The EDE 33 code is part of an Internet-Draft submitted to the IETF DNSOP Working Group, with support from tools like kdig, aiming to standardize disclosure of NTAs in DNS responses.
IDPFlare – Identity Provider Built for Cloudflare
2 months ago
- IdpFlare is a self-hosted Identity Provider that can be deployed on Cloudflare Workers.
- It offers OAuth 2.0, OpenID Connect, SAML 2.0, social logins, MFA, an admin dashboard, and management APIs.
- Deployment is quick using Git, Wrangler commands, and npm, with live hosting on a custom domain.
- It features fully customizable UI, integration with email services, webhooks, and audit logs.
- Running on Cloudflare's edge ensures low latency and scalability, with costs as low as free tier usage.
- IdpFlare is a one-time purchase of $40 for full source code, avoiding SaaS fees and lock-in.
What's the story behind the names of Cloudflare's name servers? (2013)
2 months ago
- CloudFlare provides two custom name server domains (e.g., bob.ns.cloudflare.com and lola.ns.cloudflare.com) to new users for DNS setup.
- The naming system (using 101 common names like Bob and Lola) was created to prevent users from guessing sequential server names, ensuring accurate verification of authoritative DNS records during sign-up.
- Initially, 100 names (50 male, 50 female) were used, allowing 2,500 combinations; later, a 101st name ("Woz") was added after inspiration from a ninja drawing resembling Steve Wozniak.
- The name server domains serve for initial verification; afterward, requests are handled by a global, load-balanced infrastructure across 23 data centers, supporting fast and robust DNS services.
- Artistic ninja drawings were commissioned for each name server, adding personality, and early team members and investors were allowed to choose their namesake ninjas.
Cloudflare Meerkat - Globally distributed consensus
2 months ago
- Cloudflare needs a distributed consensus service for global control-plane state management, ensuring strong consistency and availability despite network unpredictability.
- Raft-based systems suffer in wide-area networks due to leader dependency and timeout issues, leading to availability problems during leader failures or network degradation.
- Meerkat is Cloudflare's new consensus service using the QuePaxa algorithm, allowing all replicas to perform writes without timeouts, improving fault tolerance and availability.
- Meerkat guarantees linearizability for applications like a key-value store, ensuring all reads see prior writes even across distributed replicas, using a consensus log to synchronize events.
- QuePaxa provides higher availability than Raft by eliminating required leaders, avoiding leader election delays, and handling concurrent proposals constructively in unreliable networks.
- Meerkat has latency limitations due to consensus round-trips but optimizes performance through batching, replica placement control, and optional stale reads for non-critical data.
- The service is experimental and internal-only for now, designed for infrequently written control-plane data, with future blog posts planned on its implementation and verification.
We found a bug in the hyper HTTP library
3 months ago
- The Images service, built in Rust on Workers, runs on every machine in Cloudflare's edge network and uses the hyper HTTP library.
- In 2025, the Images binding was rearchitected for a more direct connection, but later intermittent failures occurred for larger images with truncated responses.
- The bug was a race condition in hyper where a slow reader could cause a premature socket shutdown, losing data; it was fixed with a four-line code change.
- Investigation involved distributed tracing, strace syscall analysis, and a custom test to reproduce the bug, leading to a targeted fix in hyper's poll_shutdown.
- The fix was contributed upstream to hyper, stabilizing the binding and enabling expanded functionality, including support for hosted images.
Monetization Gateway: Charge for any resource behind Cloudflare via x402
3 months ago
- Cloudflare announces the Monetization Gateway, enabling customers to charge for assets like web pages, datasets, APIs, or MCP tools.
- It provides a control plane for payment policies and access controls, handling verification and enforcement at the edge, with payments settling in stablecoins via the x402 protocol.
- The web's traditional ad/subscription model is breaking as AI agents become dominant users, driving need for usage-based pricing for requests, tokens, or outcomes.
- Usage-based billing has been difficult historically due to high implementation costs, but stablecoins enable low-fee, sub-second micropayments suitable for agents.
- The Monetization Gateway simplifies usage-based billing by integrating payment validation into requests, offloading metering and settlement from the origin.
- x402 is an open protocol for payments over HTTP, using the 402 status code for payment gating, allowing small, account-less transactions ideal for machine payments.
- Features include charging for specific REST verbs, variable pricing, and intercepting unauthenticated calls, managed via dashboard, API, or Terraform.
- It initially supports stablecoin payments, allowing agents to pay without signup or API keys, and can integrate with identity verification like Web Bot Auth.
- The goal is an agent-first Internet where software pays for resources automatically, monetizing currently free or underpriced API calls and tool invocations.
- A waitlist is open for Cloudflare customers to join early access for monetizing web assets with usage-based pricing.

cloudflare

Agent needs a computer, not a container – introducing Cloudflare/computer

I Finally Found a Use for IPv6

GA4 vs. Cloudflare dashboard shows how much traffic isn't being tracked

Cloudflare Internal DNS is now generally available – The Cloudflare Blog

Another Entry in the "Stuff Im Glad Im Not Responsible for" Ledger

IDPFlare – Identity Provider Built for Cloudflare

What's the story behind the names of Cloudflare's name servers? (2013)

Cloudflare Meerkat - Globally distributed consensus

We found a bug in the hyper HTTP library

Monetization Gateway: Charge for any resource behind Cloudflare via x402