81–90 of 95 posts
There is an open question about how file persistence works. The docs claim they persist the filesystem even when they move the container to an idle state but its unclear exactly what that means - https://github.com/cloudflare/sandbox-sdk/issues/102
Sandbox is built on top of their Durable Objects; the underlying storage is $0.20/ GB-month.
Earlier quoted context omitted.
This code has to run inside their Worker's platform; _technically_ you can compile Go to WASM and get it to run; but practically it is Javascript only.
Python for Workers is coming eventually. https://developers.cloudflare.com/workers/languages/python/ https://blog.cloudflare.com/python-workers/
My one annoyance with cloudflare. Everything is JavaScript. Every example, all the things. But I guess that's catering to their audience. Over the past year you could definitely seem them shift their services more inline with other cloud providers because that's the inevitable requirement to penetrate enterprise and a broader audience. But part of that should require opening up to a bigger audience from a language pe…
This code has to run inside their Worker's platform; _technically_ you can compile Go to WASM and get it to run; but practically it is Javascript only.
Earlier quoted context omitted.
You can restrict outbound network to HTTP using the outbound worker mentioned elsewhere in the thread and filter the domain name of the outbound request against a whitelist of domains you control. The DNS resolution of the domain happens within the CF network stack that you have no control over and that can’t be overwritten in anyway meaning if you restrict outbound to Google.com, there’s no way for that request to e…
When you say that the filter would disallow connecting directly to IP addresses, how would that work? When I open a tcp connection, there's no reference to any domain name. Do you think CF would proactively resolve all the domain names in my whitelist (repeatedly, in case the IPs change) and check the IP I'm connecting to against the list of IPs those domains would resolve to? That sounds like a very brittle solution…
Earlier quoted context omitted.
You can restrict outbound network to HTTP using the outbound worker mentioned elsewhere in the thread and filter the domain name of the outbound request against a whitelist of domains you control. The DNS resolution of the domain happens within the CF network stack that you have no control over and that can’t be overwritten in anyway meaning if you restrict outbound to Google.com, there’s no way for that request to e…
Can I send a UDP packet to a server on port 53 and receive a packet back?
Who's the designer? I assume the same as agents.cloudflare.com, finally something that looks creative and not based on purple gradients
Can I run claude code or codex inside this
Earlier quoted context omitted.
This simple feature bumps up the complexity of such a firewall by several orders of magnitude, which is why no similar runtime (like Deno) offers it. Networking as a whole can easily be controlled by the OS or any intermediate layer. For controlling access to specific sites you need to either filter it at the DNS level, which can be trivially bypassed, or bake something into the application binary itself. But if you…
The most convincing implementation I've seen of this so far is to lock down access to just a single IP address, then run an HTTP proxy server at that IP address which can control what sites can be proxied to. Then inject HTTP_PROXY and HTTPS_PROXY environment variables so tools running in the sandbox know what to use.