71–80 of 95 posts
There is an open question about how file persistence works. The docs claim they persist the filesystem even when they move the container to an idle state but its unclear exactly what that means - https://github.com/cloudflare/sandbox-sdk/issues/102
My one annoyance with cloudflare. Everything is JavaScript. Every example, all the things. But I guess that's catering to their audience. Over the past year you could definitely seem them shift their services more inline with other cloud providers because that's the inevitable requirement to penetrate enterprise and a broader audience. But part of that should require opening up to a bigger audience from a language pe…
Does this relate to workerd in any way or is it something else entirely?
My one annoyance with cloudflare. Everything is JavaScript. Every example, all the things. But I guess that's catering to their audience. Over the past year you could definitely seem them shift their services more inline with other cloud providers because that's the inevitable requirement to penetrate enterprise and a broader audience. But part of that should require opening up to a bigger audience from a language pe…
This code has to run inside their Worker's platform; _technically_ you can compile Go to WASM and get it to run; but practically it is Javascript only.
Earlier quoted context omitted.
Serously, what flexibility? I coud easily spin-up a firecracker VM on-demand and put it behind an API. It boots up in under 200 milliseconds. and I get to control it however I wish to. And also, all costs are under my control. I compared the costs with instances purchased from Hetzner or Contabo here: https://news.ycombinator.com/item?id=45613653 Bottomline: by doing this small stuff myself, I can save 35 times more.
In my case, it is ignorance. I am not familiar with how to wield firecracker VMs and manage their lifecycle without putting a hole in my pocket. These sandbox services(e2b, Daytona, Vercel, etc.) package them in an intuitive SDK for me to consume in my application. Since the sandboxing is not the main differentiator for me, I am okay to leverage the external providers to fill in for me. That said, I will be grateful…
For guide, just follow their official docs. I did those again today, literally copy-pasted shell commands one after the other, and voila.. had firecracker vm running and booting a full-fledge ubuntu vm.
It was sooo damn fast that when it started, at that moment I thought that my terminal had crashed because it's prompt changed. But nop. It was just that fast that even while literally looking at it I was not able to catch when it actually did boot-up.
By the way, two open-source projects already exist:
1. NodeJS: https://github.com/apocas/firecrackerode
2. Python: https://github.com/Okeso/python-firecracker
The pricing with such offerings is the biggest throwoff. This one comes out to be more than $58/month for just 1vCpu and 1GiB RAM when used continuously. Compare this with instances from Hetzner or Contabo or the likes. They are 35+ times cheaper. This means my total usage across entire month on cloudflare sandbox cannot cross even one single day of non-stop usage, just to break-even with hetzner/contabo/others.
Cloudflare bills by CPU time. You'll come up on top if you have very irregular traffic as Hetzner bills you 24/7 for your instance.
As I calculated and mentioned before, if that occasional usage ends up being more than a day in total, dedicated instances end up cheaper.
The pricing with such offerings is the biggest throwoff. This one comes out to be more than $58/month for just 1vCpu and 1GiB RAM when used continuously. Compare this with instances from Hetzner or Contabo or the likes. They are 35+ times cheaper. This means my total usage across entire month on cloudflare sandbox cannot cross even one single day of non-stop usage, just to break-even with hetzner/contabo/others.
That's like comparing any serverless offering to a continuously running host. Continuously running means you're doing it wrong / it's a bad fit. But yes the ratio is somewhat extreme.
The pricing with such offerings is the biggest throwoff. This one comes out to be more than $58/month for just 1vCpu and 1GiB RAM when used continuously. Compare this with instances from Hetzner or Contabo or the likes. They are 35+ times cheaper. This means my total usage across entire month on cloudflare sandbox cannot cross even one single day of non-stop usage, just to break-even with hetzner/contabo/others.
It's interesting to also compare this to getting a bare metal instance and provisioning microVMs on it using Firecracker. (Obviously something you shouldn't roll yourself in most cases.) You can get a bare metal AX162 from Hetzner for 200 EUR/mo, with 48 cores and 128GB of RAM. For 4:1 virtual:physical oversubscription, you could run 192 guests on such a machine, yielding a cost of 200/192 = 1.04 EUR/mo, and giving e…
Looks like there's one feature missing from this that I care about: I'd like more finely grained control over what outbound internet connections code running on the box can make. As far as I can tell it's all or nothing right now: this.ctx.container.start({ enableInternet: false, }); I want to run untrusted code (from users or LLMs) in these containers, and I'd like to avoid someone malicious using my container to la…
This simple feature bumps up the complexity of such a firewall by several orders of magnitude, which is why no similar runtime (like Deno) offers it. Networking as a whole can easily be controlled by the OS or any intermediate layer. For controlling access to specific sites you need to either filter it at the DNS level, which can be trivially bypassed, or bake something into the application binary itself. But if you…
My uneducated question, why not BPF? It's the actual original use case. Declare a filter rule (using any DSL you like), enforce it within the sandbox, move processing to the "real" firewall/kernel where applicable, etc.