Cloudflare needed to run untrusted customer code in 155 data centers without containers, so it borrowed the isolation mechanism Chrome uses to keep browser tabs apart.

Two years before this post, Cloudflare had a problem it stated bluntly: it was limited in how many features and options it could build in-house, and it needed a way for customers to build for themselves. That meant running customer code on Cloudflare’s own servers, spread across a little over a hundred data centers at the time — 155 by the time they wrote it up.

The bar was set by what those servers already do. Cloudflare sits in front of ten million sites and processes millions and millions of requests per second. Whatever ran customer code had to run untrusted code securely, with low overhead, and very, very quickly.

Three requirements, all binding at once. Untrusted, because the whole point was letting customers ship code without a human reviewing it. Cheap, because the overhead would be paid per-script and per-location. And everywhere, because a platform that only runs in one region is not a Cloudflare product — a Lambda, by contrast, runs in a single availability zone, in a single region, in a single data center.

That last requirement is what quietly killed most of the field. Any per-tenant cost gets multiplied by 155.

Traditional virtualization and container technologies like Kubernetes would have been exceptionally expensive for everyone involved. Running thousands of Kubernetes pods in a single location is resource intensive; doing it in 155 locations is worse. Scaling them with a management system is easier than without one, but Cloudflare describes it as far from trivial.

The costs are structural, not incidental. A process-per-tenant model pays a context switch — moving one process’s memory out and the next one’s in — that can take as much as 100 microseconds, and multiplied across all the Node, Python, and Go processes on a typical serverless host, that overhead means not all of a CPU’s power actually goes to running customer code. It pays cold starts, because auto-scaling a containerized process takes between 500 milliseconds and 10 seconds, and a Lambda handles one request at a time, so every additional concurrent request cold-starts another one. And it pays memory: a basic Node Lambda running no real code consumes 35 MB.

What Cloudflare settled on was V8 Isolates — the technology the Google Chrome team built to power JavaScript in the browser. Isolates are lightweight contexts that group variables with the code allowed to mutate them. A single process can run hundreds or thousands of them, switching between them seamlessly, and one Isolate cannot access another’s memory.

Because the runtime is shared, Cloudflare pays the overhead of a JavaScript runtime once and then runs essentially limitless scripts with almost no individual overhead. Because everything runs in one process with V8’s own memory-safety mechanisms, there are no expensive context switches — the machine spends virtually all its time running customer code. And because Isolates were designed to start fast enough that several spin up just to load a web page, an Isolate starts in about 5 milliseconds. That does not reduce the cold-start problem; it removes the thing that caused it.

Cloudflare is explicit that no technology is magical. An Isolate-based system cannot run arbitrary compiled code — process-level isolation lets a Lambda spin up any binary it needs, and Isolates do not. You either write JavaScript (Cloudflare uses a lot of TypeScript) or a language that targets WebAssembly, like Go or Rust. If you cannot recompile your processes, you cannot run them here, which may confine Isolate-based serverless to newer applications, or mean legacy systems move only their most latency-sensitive components across.

There is a second dependency they name openly: running many customers’ code in one process demands security work that Cloudflare says would not have been productive to build themselves, requiring an astronomical amount of testing, fuzzing, penetration testing, and bounties. The only reason the model was possible at all is that V8 is open source and perhaps the most heavily security-tested software on earth. Cloudflare adds its own layers, including protections against timing attacks, but calls V8 the real wonder underneath.

The cheapest isolation boundary is the one someone else already spent a decade hardening — Cloudflare’s platform is fast because it stopped paying for a process per tenant, and viable because it did not have to invent the sandbox that replaced it.