{"slug": "workerd", "name": "workerd", "category": "dev-libs", "category_name": "Libraries and frameworks", "description": "", "recommenders": 5, "commenters": 15, "warners": 3, "score": 3.503, "rising": -0.31, "first": "2025-11-10", "latest": "2026-10-09", "why": "My go-to solution is to make ad-hoc proxies with workerd that work just the way i need", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 5, "neutral": 5, "compare": 2, "warn": 5}, "spark": [0, 1, 0, 0, 0, 2, 0, 0, 1, 0, 1, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "My go-to solution is to make ad-hoc proxies with workerd that work just the way i need", "kind": "", "icon": true, "domain": null, "github_repo": "github.com/cloudflare/workerd", "official_url": "https://github.com/cloudflare/workerd", "pricing": "", "aliases": ["workerd"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 800410368, "item_id": 50025648, "url": "https://news.ycombinator.com/item?id=50025648", "by": "kentonv", "date": "2026-10-09", "version": null, "stance": "recommend", "quote": "People really do run it in production without using Cloudflare at all", "excerpt": "> since it push on semantics that can only be run on Cloudflare infrastructure No, workerd and its semantics are not exclusive to Cloudflare infrastructure. People really do run it in production without using Cloudflare at all (I really wish I was allowed to say who because one of the users is hilariously ironic...). Ryan's and Bert's core focus at Cloudflare is going to be making the self-hosting story better. This ", "context": "", "use_case": "JavaScript server runtime", "switched_from": "", "story": "Cloudflare acquires Deno"}, {"id": 796404002, "item_id": 49775250, "url": "https://news.ycombinator.com/item?id=49775250", "by": "mwcampbell", "date": "2026-09-20", "version": null, "stance": "recommend", "quote": "I guess workerd addressed that", "excerpt": "I'm actually curious about why you didn't spend yours on reviving Sandstorm. If the terms of your employment with Cloudflare prevent you from doing that, then that makes sense. Or do you believe you've been building Sandstorm's true successor at Cloudflare? For a while the Workers platform didn't satisfy the self-hosted part, but I guess workerd addressed that. For what it's worth, if I had $10 million, I currently t", "context": "", "use_case": "", "switched_from": "", "story": "We built our house for LAN parties (2024)"}, {"id": 786985121, "item_id": 49186570, "url": "https://news.ycombinator.com/item?id=49186570", "by": "kentonv", "date": "2026-08-05", "version": null, "stance": "recommend", "quote": "But workerd can be used directly without wrangler, and is production-capable", "excerpt": "wrangler is a development tool. You wouldn't want to run dev mode in production. But workerd can be used directly without wrangler, and is production-capable in that format. Unfortunately we did not have time to put together example configs for this before launch (I wish we could have delayed, it was out of my hands), but we will be doing so soon. Mentioned in the readme here: https://github.com/cloudflare/cloudflare", "context": "", "use_case": "Self-hosted Workers runtime", "switched_from": "", "story": "Cloudflare OS: an open platform for agents, apps, and work"}, {"id": 782301606, "item_id": 48893850, "url": "https://news.ycombinator.com/item?id=48893850", "by": "westurner", "date": "2026-07-13", "version": null, "stance": "recommend", "quote": "that's probably more optimal for agent sessions.", "excerpt": "(Years ago I had puppet and cobbler provisioning VMs over PXE and then iPXE. FWIU foreman is more actively maintained than cobbler, which is built on Django web framework.) Vagrant manages VMs and virtual networks, in Ruby. ansible-molecule creates, converges, and destroys VM(s) and containers, in order to test ansible playbooks and ansible roles in clean build roots. podman machine manages VMs: - podman-container-to", "context": "", "use_case": "lightweight agent sandboxing", "switched_from": "", "story": "Show HN: Clawk \u2013 Give coding agents a disposable Linux VM, not your laptop"}, {"id": 774965952, "item_id": 48435372, "url": "https://news.ycombinator.com/item?id=48435372", "by": "kentonv", "date": "2026-06-07", "version": null, "stance": "recommend", "quote": "You can definitely run workerd in production on your own machines", "excerpt": "Yes, the Cloudflare Workers Runtime is open source: https://github.com/cloudflare/workerd You can definitely run workerd in production on your own machines and some people do. The biggest catch is that workerd's implementation of Durable Objects currently doesn't work across multiple machines, but I'm working on fixing that: https://github.com/cloudflare/workerd/pull/6780", "context": "", "use_case": "self-hosted Workers runtime", "switched_from": "", "story": "Show HN: Kyushu \u2013 A self-hostable WASM sandbox for JavaScript workers"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 800404450, "item_id": 50025278, "url": "https://news.ycombinator.com/item?id=50025278", "by": "syrusakbary", "date": "2026-10-09", "version": null, "stance": "warn", "quote": "Somehow I don't believe that Cloudflare doubling down on their own runtime -workerd", "excerpt": "I'm happy that the Deno team found a suitable home. Cloudflare is likely the best place for them to land. I believe they will do great things together. However, I'm a bit concerned that there are very few independent Node.js runtimes: Anthropic acquired Bun, and now Deno will not be developed further. Somehow I don't believe that Cloudflare doubling down on their own runtime -workerd, which will be likely migrated to", "context": "", "use_case": "", "switched_from": "", "story": "Cloudflare acquires Deno"}, {"id": 753104385, "item_id": 47069024, "url": "https://news.ycombinator.com/item?id=47069024", "by": "westurner", "date": "2026-02-18", "version": null, "stance": "warn", "quote": ">> WARNING: workerd is not a hardened sandbox", "excerpt": "Flatpak manifests include a list of ACLs per app. Flatseal is one way to change the permissions granted to a flatpak. Restarting an app is required for permissions changes to take effect. Audit2allow and desbma/shh can generate policies. systrack, list-syscalls.rb, \"B-Side: Binary-Level Static System Call Identification\"; https://news.ycombinator.com/item?id=46726677 /? which linux lsm's allow online policy changes: ", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: CSL-Core \u2013 Formally Verified Neuro-Symbolic Safety Engine for AI"}, {"id": 743843569, "item_id": 46490223, "url": "https://news.ycombinator.com/item?id=46490223", "by": "simonw", "date": "2026-01-04", "version": null, "stance": "warn", "quote": "here's the workerd one https://github.com/cloudflare/workerd?tab=readme-ov-file#warning-workerd-is-not-a-hardened-sandbox", "excerpt": "The challenge with V8 is finding a wrapper for it that doesn't come with a big warning NOT to use it as a sandbox for untrusted code - here's the workerd one https://github.com/cloudflare/workerd?tab=readme-ov-file#warning-workerd-is-not-a-hardened-sandbox and here's the PyMiniRacer section: https://bpcreech.com/PyMiniRacer/architecture/#security-goals I looked at GraalVM but was put off by the licensing situation: h", "context": "", "use_case": "", "switched_from": "", "story": "JavaScript engines zoo \u2013 Compare every JavaScript engine"}, {"id": 743840112, "item_id": 46490007, "url": "https://news.ycombinator.com/item?id=46490007", "by": "buremba", "date": "2026-01-04", "version": null, "stance": "warn", "quote": "There is a big \"WARNING: This is a beta. Work in progress\" message in https://github.com/cloudflare/workerd", "excerpt": "There is a big \"WARNING: This is a beta. Work in progress\" message in https://github.com/cloudflare/workerd Specifically, half of the services operate locally, and the other half require CF services. I mainly use Claude Code to develop, and it often struggles to replicate the local environment, so I had to create another worker in CF for my local development. Initially, the idea was to use CF for my side projects as ", "context": "", "use_case": "", "switched_from": "", "story": "OpenWorkers: Self-Hosted Cloudflare Workers in Rust"}]}], "who": [], "tags": [], "use_cases": ["self-hosted workers runtime", "javascript server runtime", "workers runtime", "lightweight agent sandboxing", "custom ad-hoc proxies", "cloudflare workers runtime"], "compared": [{"slug": "cloudflare-workers", "name": "Cloudflare Workers", "co": 5, "switched_from": 0, "switched_to": 0}, {"slug": "deno", "name": "Deno", "co": 3, "switched_from": 0, "switched_to": 0}, {"slug": "v8", "name": "V8", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "celld", "name": "celld", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "bun", "name": "Bun", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "durable-objects", "name": "Durable Objects", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [{"id": 800331792, "item_id": 50020737, "url": "https://news.ycombinator.com/item?id=50020737", "by": "kentonv", "date": "2026-10-09", "version": null, "stance": "recommend", "quote": "workerd has also had granular sandboxing all along", "excerpt": "workerd has also had granular sandboxing all along... I actually coined the term \"code mode\" in this blog post: https://blog.cloudflare.com/code-mode/", "context": "", "use_case": "Sandboxed code execution runtime", "switched_from": "", "story": "Cloudflare acquires Deno"}, {"id": 800323200, "item_id": 50020200, "url": "https://news.ycombinator.com/item?id=50020200", "by": "kentonv", "date": "2026-10-09", "version": null, "stance": "recommend", "quote": "create one first-class open source self-hostable runtime for Workers and Durable Objects", "excerpt": "Please be sure to read the post on Cloudflare's blog, it's not just fluff: https://blog.cloudflare.com/deno-joins-cloudflare/ TL;DR: Ryan and co. will be merging celld with workerd to create one first-class open source self-hostable runtime for Workers and Durable Objects. In the post I explain in the post why, contrary to what you might think, this is good business for Cloudflare and we're very excited about it.", "context": "", "use_case": "", "switched_from": "", "story": "Cloudflare acquires Deno"}, {"id": 797054816, "item_id": 49815926, "url": "https://news.ycombinator.com/item?id=49815926", "by": "kentonv", "date": "2026-09-23", "version": null, "stance": "neutral", "quote": "I would accept a PR to increase the constant to 1M", "excerpt": "Sorry, this is a bug. It dates back to when Workers only supported 50ms CPU time limits. Back then 100k iterations was enough to exceed the 50ms budget. Now that the limit is 5 minutes this is pretty silly, but since PBKDF2 is considered obsolete and not often used in new code, I guess fixing it never really came up. I would accept a PR to increase the constant to 1M, or higher with a good argument (but most recommen", "context": "", "use_case": "Cloudflare Workers runtime", "switched_from": "", "story": "PBKDF2 has a 100k-iteration ceiling in Cloudflare Workers"}, {"id": 787064960, "item_id": 49191560, "url": "https://news.ycombinator.com/item?id=49191560", "by": "kentonv", "date": "2026-08-05", "version": null, "stance": "recommend", "quote": "workerd stand-alone is designed to work well at small-medium scale.", "excerpt": "workerd stand-alone is designed to work well at small-medium scale. If we open sourced Cloudflare's production scheduler, nobody would be able to use it because it is explicitly designed for HUGE, globe-spanning scale. Well, nobody except our direct competitors. But the goal with workerd is actually that it should be pretty easy to run, about as easy as Node. Stateless workloads should scale trivially (just add more ", "context": "works on Cloudflare's workerd", "use_case": "", "switched_from": "", "story": "Cloudflare OS: an open platform for agents, apps, and work"}, {"id": 786950352, "item_id": 49184397, "url": "https://news.ycombinator.com/item?id=49184397", "by": "kentonv", "date": "2026-08-05", "version": null, "stance": "recommend", "quote": "Durable Objects are fully supported by workerd", "excerpt": "It's the same code. The only thing it doesn't include is the global scheduling and orchestration, but you don't actually want that locally. (And honestly... that stuff is a bit of a beast.) Durable Objects are fully supported by workerd (and Cloudflare OS uses them extensively). There is, however, one catch currently: Durable Objects don't scale out well without the global scheduling. For running Cloudflare OS for on", "context": "", "use_case": "", "switched_from": "", "story": "Cloudflare OS: an open platform for agents, apps, and work"}, {"id": 786940609, "item_id": 49183788, "url": "https://news.ycombinator.com/item?id=49183788", "by": "kentonv", "date": "2026-08-05", "version": null, "stance": "neutral", "quote": "It runs on top of our open source runtime.", "excerpt": "This is 100% open source and self-hostable. https://github.com/cloudflare/cloudflare-os It runs on top of our open source runtime. https://github.com/cloudflare/workerd", "context": "", "use_case": "", "switched_from": "", "story": "Cloudflare OS: an open platform for agents, apps, and work"}], "threads": [{"url": "https://news.ycombinator.com/item?id=49182996", "title": "Cloudflare OS: an open platform for agents, apps, and work", "mentions": 6}, {"url": "https://news.ycombinator.com/item?id=50019911", "title": "Cloudflare acquires Deno", "mentions": 5}, {"url": "https://news.ycombinator.com/item?id=45876308", "title": "Head in the Zed Cloud", "mentions": 4}, {"url": "https://news.ycombinator.com/item?id=46454693", "title": "OpenWorkers: Self-Hosted Cloudflare Workers in Rust", "mentions": 3}, {"url": "https://news.ycombinator.com/item?id=46486978", "title": "JavaScript engines zoo \u2013 Compare every JavaScript engine", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=49815651", "title": "PBKDF2 has a 100k-iteration ceiling in Cloudflare Workers", "mentions": 1}], "sentiment_by_month": {"2025-11": {"neutral": 1, "warn": 1}, "2025-12": {"recommend": 1}, "2026-01": {"compare": 1, "neutral": 1, "warn": 2}, "2026-02": {"warn": 1}, "2026-03": {"neutral": 1}, "2026-04": {"recommend": 2}, "2026-05": {}, "2026-06": {}, "2026-07": {"recommend": 1}, "2026-08": {"neutral": 1, "compare": 1}, "2026-09": {"recommend": 1}, "2026-10": {"neutral": 1, "warn": 1}}, "versions": [], "version_unnamed": 0, "family_ref": null, "runs_on": null, "lines": [], "quotes": [{"id": 800410368, "item_id": 50025648, "url": "https://news.ycombinator.com/item?id=50025648", "by": "kentonv", "date": "2026-10-09", "version": null, "stance": "recommend", "quote": "People really do run it in production without using Cloudflare at all", "excerpt": "> since it push on semantics that can only be run on Cloudflare infrastructure No, workerd and its semantics are not exclusive to Cloudflare infrastructure. People really do run it in production without using Cloudflare at all (I really wish I was allowed to say who because one of the users is hilariously ironic...). Ryan's and Bert's core focus at Cloudflare is going to be making the self-hosting story better. This ", "context": "", "use_case": "JavaScript server runtime", "switched_from": "", "story": "Cloudflare acquires Deno"}, {"id": 800404450, "item_id": 50025278, "url": "https://news.ycombinator.com/item?id=50025278", "by": "syrusakbary", "date": "2026-10-09", "version": null, "stance": "warn", "quote": "Somehow I don't believe that Cloudflare doubling down on their own runtime -workerd", "excerpt": "I'm happy that the Deno team found a suitable home. Cloudflare is likely the best place for them to land. I believe they will do great things together. However, I'm a bit concerned that there are very few independent Node.js runtimes: Anthropic acquired Bun, and now Deno will not be developed further. Somehow I don't believe that Cloudflare doubling down on their own runtime -workerd, which will be likely migrated to", "context": "", "use_case": "", "switched_from": "", "story": "Cloudflare acquires Deno"}, {"id": 800328993, "item_id": 50020562, "url": "https://news.ycombinator.com/item?id=50020562", "by": "bennett_dev", "date": "2026-10-09", "version": null, "stance": "neutral", "quote": "letting the Deno team focus on making workerd self-hosting easier", "excerpt": "From CloudFlare's side (https://blog.cloudflare.com/deno-joins-cloudflare/) is seems celld was the main point of this - letting the Deno team focus on making workerd self-hosting easier.", "context": "", "use_case": "", "switched_from": "", "story": "Cloudflare acquires Deno"}, {"id": 796404002, "item_id": 49775250, "url": "https://news.ycombinator.com/item?id=49775250", "by": "mwcampbell", "date": "2026-09-20", "version": null, "stance": "recommend", "quote": "I guess workerd addressed that", "excerpt": "I'm actually curious about why you didn't spend yours on reviving Sandstorm. If the terms of your employment with Cloudflare prevent you from doing that, then that makes sense. Or do you believe you've been building Sandstorm's true successor at Cloudflare? For a while the Workers platform didn't satisfy the self-hosted part, but I guess workerd addressed that. For what it's worth, if I had $10 million, I currently t", "context": "", "use_case": "", "switched_from": "", "story": "We built our house for LAN parties (2024)"}, {"id": 787038928, "item_id": 49189933, "url": "https://news.ycombinator.com/item?id=49189933", "by": "jitl", "date": "2026-08-05", "version": null, "stance": "compare", "quote": "what is the difference between celld and Cloudflare Workers open source version workerd?", "excerpt": "what is the difference between celld and Cloudflare Workers open source version workerd? https://github.com/cloudflare/workerd", "context": "", "use_case": "self-hosted Workers runtime", "switched_from": "", "story": "Celld: Self-hosted, distributed Durable Objects"}, {"id": 786985121, "item_id": 49186570, "url": "https://news.ycombinator.com/item?id=49186570", "by": "kentonv", "date": "2026-08-05", "version": null, "stance": "recommend", "quote": "But workerd can be used directly without wrangler, and is production-capable", "excerpt": "wrangler is a development tool. You wouldn't want to run dev mode in production. But workerd can be used directly without wrangler, and is production-capable in that format. Unfortunately we did not have time to put together example configs for this before launch (I wish we could have delayed, it was out of my hands), but we will be doing so soon. Mentioned in the readme here: https://github.com/cloudflare/cloudflare", "context": "", "use_case": "Self-hosted Workers runtime", "switched_from": "", "story": "Cloudflare OS: an open platform for agents, apps, and work"}, {"id": 786952304, "item_id": 49184519, "url": "https://news.ycombinator.com/item?id=49184519", "by": "orakmoya", "date": "2026-08-05", "version": null, "stance": "neutral", "quote": "which are open sourced", "excerpt": "which are open sourced [1]. I tried deploying it and had Deepseek v4 Flash create a dumb whiteboarding app. [1] https://github.com/cloudflare/workerd", "context": "", "use_case": "Workers runtime", "switched_from": "", "story": "Cloudflare OS: an open platform for agents, apps, and work"}, {"id": 786939105, "item_id": 49183694, "url": "https://news.ycombinator.com/item?id=49183694", "by": "kentonv", "date": "2026-08-05", "version": null, "stance": "neutral", "quote": "It runs on the open source Workers Runtime", "excerpt": "What do you mean? This is 100% open source and self-hostable! https://github.com/cloudflare/cloudflare-os It runs on the open source Workers Runtime: https://github.com/cloudflare/workerd You can run it at home if you want. There's even a Home Assistant Gatekeeper.", "context": "", "use_case": "", "switched_from": "", "story": "Cloudflare OS: an open platform for agents, apps, and work"}, {"id": 782301606, "item_id": 48893850, "url": "https://news.ycombinator.com/item?id=48893850", "by": "westurner", "date": "2026-07-13", "version": null, "stance": "recommend", "quote": "that's probably more optimal for agent sessions.", "excerpt": "(Years ago I had puppet and cobbler provisioning VMs over PXE and then iPXE. FWIU foreman is more actively maintained than cobbler, which is built on Django web framework.) Vagrant manages VMs and virtual networks, in Ruby. ansible-molecule creates, converges, and destroys VM(s) and containers, in order to test ansible playbooks and ansible roles in clean build roots. podman machine manages VMs: - podman-container-to", "context": "", "use_case": "lightweight agent sandboxing", "switched_from": "", "story": "Show HN: Clawk \u2013 Give coding agents a disposable Linux VM, not your laptop"}, {"id": 774965952, "item_id": 48435372, "url": "https://news.ycombinator.com/item?id=48435372", "by": "kentonv", "date": "2026-06-07", "version": null, "stance": "recommend", "quote": "You can definitely run workerd in production on your own machines", "excerpt": "Yes, the Cloudflare Workers Runtime is open source: https://github.com/cloudflare/workerd You can definitely run workerd in production on your own machines and some people do. The biggest catch is that workerd's implementation of Durable Objects currently doesn't work across multiple machines, but I'm working on fixing that: https://github.com/cloudflare/workerd/pull/6780", "context": "", "use_case": "self-hosted Workers runtime", "switched_from": "", "story": "Show HN: Kyushu \u2013 A self-hostable WASM sandbox for JavaScript workers"}, {"id": 764769248, "item_id": 47798078, "url": "https://news.ycombinator.com/item?id=47798078", "by": "switz", "date": "2026-04-16", "version": null, "stance": "recommend", "quote": "Workers runtime is open source and permissively licensed fwiw", "excerpt": "Workers runtime is open source and permissively licensed fwiw https://github.com/cloudflare/workerd", "context": "", "use_case": "", "switched_from": "", "story": "Cloudflare's AI Platform: an inference layer designed for agents"}, {"id": 763683168, "item_id": 47730198, "url": "https://news.ycombinator.com/item?id=47730198", "by": "jFriedensreich", "date": "2026-04-11", "version": null, "stance": "recommend", "quote": "My go-to solution is to make ad-hoc proxies with workerd that work just the way i need", "excerpt": "There are tons that are all too simple or too complex or made for mesh networking in k8, or too slow and made for debugging. My go-to solution is to make ad-hoc proxies with workerd that work just the way i need and compile to a \"binary\". It used to be annoying to write capnp by hand but now you just point an agent at worker.capnp and tell it what you need. The output is concise enough to be nice for proper reviewing", "context": "", "use_case": "custom ad-hoc proxies", "switched_from": "", "story": "NanoClaw's Architecture Is a Masterclass in Doing Less"}, {"id": 757183521, "item_id": 47323970, "url": "https://news.ycombinator.com/item?id=47323970", "by": "westurner", "date": "2026-03-10", "version": null, "stance": "neutral", "quote": "willswire/union is a Kubernetes Helm chart for self-hosting cloudflare/workerd", "excerpt": "> The core idea: treat your own resource budget as a health signal, just like you'd treat a downstream service's error rate. This is more state. The deployed app is then more stateful and thus more complex. If there is more complexity, there are probably more failure cases. But resource budget quota signals are a good feature, I think. Apps should throttle down when approaching their resource quotas. What is the serv", "context": "", "use_case": "", "switched_from": "", "story": "SHOW HN: A usage circuit breaker for Cloudflare Workers"}, {"id": 753104385, "item_id": 47069024, "url": "https://news.ycombinator.com/item?id=47069024", "by": "westurner", "date": "2026-02-18", "version": null, "stance": "warn", "quote": ">> WARNING: workerd is not a hardened sandbox", "excerpt": "Flatpak manifests include a list of ACLs per app. Flatseal is one way to change the permissions granted to a flatpak. Restarting an app is required for permissions changes to take effect. Audit2allow and desbma/shh can generate policies. systrack, list-syscalls.rb, \"B-Side: Binary-Level Static System Call Identification\"; https://news.ycombinator.com/item?id=46726677 /? which linux lsm's allow online policy changes: ", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: CSL-Core \u2013 Formally Verified Neuro-Symbolic Safety Engine for AI"}, {"id": 743858368, "item_id": 46491148, "url": "https://news.ycombinator.com/item?id=46491148", "by": "simonw", "date": "2026-01-04", "version": null, "stance": "warn", "quote": "", "excerpt": "Right - I trust workerd in the context of Cloudflare because I know it has a team of people who's job it is to keep it secure who are on-call 24/7. The problem I have is that I'm just one person and I don't want to be on call 24/7 ready to react to sandbox escapes, so I'm hoping I can find a solution that someone else built where they are willing to say \"this is safe: you can feed in a string of untrusted JavaScript ", "context": "", "use_case": "", "switched_from": "", "story": "JavaScript engines zoo \u2013 Compare every JavaScript engine"}, {"id": 743843569, "item_id": 46490223, "url": "https://news.ycombinator.com/item?id=46490223", "by": "simonw", "date": "2026-01-04", "version": null, "stance": "warn", "quote": "here's the workerd one https://github.com/cloudflare/workerd?tab=readme-ov-file#warning-workerd-is-not-a-hardened-sandbox", "excerpt": "The challenge with V8 is finding a wrapper for it that doesn't come with a big warning NOT to use it as a sandbox for untrusted code - here's the workerd one https://github.com/cloudflare/workerd?tab=readme-ov-file#warning-workerd-is-not-a-hardened-sandbox and here's the PyMiniRacer section: https://bpcreech.com/PyMiniRacer/architecture/#security-goals I looked at GraalVM but was put off by the licensing situation: h", "context": "", "use_case": "", "switched_from": "", "story": "JavaScript engines zoo \u2013 Compare every JavaScript engine"}, {"id": 743840112, "item_id": 46490007, "url": "https://news.ycombinator.com/item?id=46490007", "by": "buremba", "date": "2026-01-04", "version": null, "stance": "warn", "quote": "There is a big \"WARNING: This is a beta. Work in progress\" message in https://github.com/cloudflare/workerd", "excerpt": "There is a big \"WARNING: This is a beta. Work in progress\" message in https://github.com/cloudflare/workerd Specifically, half of the services operate locally, and the other half require CF services. I mainly use Claude Code to develop, and it often struggles to replicate the local environment, so I had to create another worker in CF for my local development. Initially, the idea was to use CF for my side projects as ", "context": "", "use_case": "", "switched_from": "", "story": "OpenWorkers: Self-Hosted Cloudflare Workers in Rust"}, {"id": 743296112, "item_id": 46456007, "url": "https://news.ycombinator.com/item?id=46456007", "by": "rozenmd", "date": "2026-01-01", "version": null, "stance": "neutral", "quote": "the Cloudflare Workers runtime is already open source", "excerpt": "Probably worth pointing out that the Cloudflare Workers runtime is already open source: https://github.com/cloudflare/workerd", "context": "", "use_case": "Cloudflare Workers runtime", "switched_from": "", "story": "OpenWorkers: Self-Hosted Cloudflare Workers in Rust"}, {"id": 743296048, "item_id": 46456003, "url": "https://news.ycombinator.com/item?id=46456003", "by": "tbrockman", "date": "2026-01-01", "version": null, "stance": "compare", "quote": "Any notable differences between the respective runtimes themselves?", "excerpt": "Cool project, great work! Forgive the uninformed questions, but given that `workerd` (https://github.com/cloudflare/workerd) is \"open-source\" (in terms of the runtime itself, less so the deployment model), is the main distinction here that OpenWorkers provides a complete environment? Any notable differences between the respective runtimes themselves? Is the intention to ever provide a managed offering for scalability", "context": "", "use_case": "", "switched_from": "", "story": "OpenWorkers: Self-Hosted Cloudflare Workers in Rust"}, {"id": 738687249, "item_id": 46167953, "url": "https://news.ycombinator.com/item?id=46167953", "by": "som", "date": "2025-12-05", "version": null, "stance": "recommend", "quote": "you can probably also self host workerd itself which is open source", "excerpt": "I use CloudFlare a lot for \"self hosting\" .. but I also run an old pi from home with Bun in place of workers. Suprisingly compatible and low lift. Not exactly \"without CloudFlare\", but for true compat you can probably also self host workerd itself which is open source: github.com/cloudflare/workerd", "context": "", "use_case": "self-hosting Cloudflare Workers", "switched_from": "", "story": "Show HN: Pbnj \u2013 A minimal, self-hosted pastebin you can deploy in 60 seconds"}, {"id": 736169059, "item_id": 46010566, "url": "https://news.ycombinator.com/item?id=46010566", "by": "yencabulator", "date": "2025-11-21", "version": null, "stance": "neutral", "quote": "so there is secret sauce that is not part of workerd", "excerpt": "I think it's pretty well understood that Cloudflare does not actually deploy a VM/container/etc per tenant, but you guys are relying on something like detecting bad behavior and isolating or punishing tenants that try to use attacks in the style of rowhammer: https://developers.cloudflare.com/workers/reference/security-model/ -- so there is secret sauce that is not part of workerd, and one cannot get the same platfor", "context": "", "use_case": "", "switched_from": "", "story": "Head in the Zed Cloud"}, {"id": 736149376, "item_id": 46009336, "url": "https://news.ycombinator.com/item?id=46009336", "by": "yencabulator", "date": "2025-11-21", "version": null, "stance": "warn", "quote": "It doesn't have the same security properties.", "excerpt": "It's also worth noting that workerd is only a part of the Cloudflare Workers stack. It doesn't have the same security properties. https://github.com/cloudflare/workerd#warning-workerd-is-not-a-hardened-sandbox (I know you know this, but frankly you should add a disclaimer when you comment about CF or Capnp. It's too convenient for you to leave out the cons.)", "context": "", "use_case": "", "switched_from": "", "story": "Head in the Zed Cloud"}, {"id": 734157009, "item_id": 45884813, "url": "https://news.ycombinator.com/item?id=45884813", "by": "hobofan", "date": "2025-11-10", "version": null, "stance": "neutral", "quote": "Cloudflare provides an open source version of their Workers runtime", "excerpt": "FYI: Cloudflare provides an open source version of their Workers runtime[0], so the lock-in isn't as strong as it once was. [0]: https://github.com/cloudflare/workerd", "context": "", "use_case": "", "switched_from": "", "story": "Head in the Zed Cloud"}, {"id": 734112689, "item_id": 45882043, "url": "https://news.ycombinator.com/item?id=45882043", "by": "kentonv", "date": "2025-11-10", "version": null, "stance": "recommend", "quote": "The Cloudflare Workers runtime is open source: https://github.com/cloudflare/workerd", "excerpt": "The Cloudflare Workers runtime is open source: https://github.com/cloudflare/workerd People can and do use this to run Workers on hosting providers other than Cloudflare.", "context": "", "use_case": "run Workers on other hosts", "switched_from": "", "story": "Head in the Zed Cloud"}]}