Cloudflare OS is a new open-source platform from Cloudflare for running AI agents alongside user-facing apps and connectors to external systems. The blog post pitched it as a productivity layer for companies, but most technically minded readers only understood the product after reading Kenton Varda’s explanation and the GitHub README. The key idea is not “another enterprise chat app.” It is a revived Sandstorm-style model where each app instance, like a single document or slide deck, runs in its own lightweight sandbox. That means access control can be enforced at the platform level, and users can modify their own copy of an app with AI without exposing other users or the wider system.
That architecture is what made people take it seriously. Sandstorm tried something similar a decade ago with containers, but commenters and Varda said the old model was too heavy for per-document isolation because of cold starts and memory use. Cloudflare OS instead uses
Workers and
Durable Objects, which makes fine-grained app instances practical enough to feel like a real product instead of a research idea. The security story then extends outward through “
Gatekeepers,” Cloudflare’s connector layer for services like GitHub and Home Assistant. Gatekeepers gate reads and writes, keep audit trails, support human approval for side effects, and can mark data as sensitive enough that once an agent sees it, later outbound actions are blocked or flagged.
Two other points landed hard. First, despite the name, this is not locked to Cloudflare’s hosted service in the narrow sense many assumed. It is Apache 2.0 licensed, runs on the open-source
workerd runtime, supports local models through
ollama, and Varda repeatedly said it can run entirely on your own servers with no hidden Cloudflare dependency. Second, that self-hosting story is promising but not finished. The same comments that reassured people on lock-in also exposed missing production examples, rough docs, and current scaling limits for self-hosted Durable Objects until pending work lands.
The dominant reaction mixed real excitement with heavy skepticism. Excitement came from the sense that Cloudflare may have found a concrete architecture for enterprise agents that is safer than bolting
MCP tools onto a chatbot. Skepticism came from three places: the vague launch post, broad distrust of Cloudflare as a platform company, and the fear that letting every employee customize software creates a future SharePoint mess of bespoke apps nobody can maintain. The naming also got dragged. A lot of people saw “OS” as pure marketing. That complaint never really displaced the more substantive conclusion, though, which is that Cloudflare shipped something more ambitious than a branded chat frontend and then did a poor job saying so.
blog.cloudflare.com