Containers at the edge: it’s not what you think, or maybe it is

Containers Drift Back to the Edge — For Some Jobs

Cloudflare built its reputation on a simple proposition: run your code as close to the user as possible. The company’s Workers platform uses V8 isolates to make that happen, treating the network as a single computer with a fine-grained unit of compute. Containers, the argument went, were too heavy for that job. Today, Cloudflare is revising that story.

The company is now exploring container support at the edge. It’s a notable pivot, and one that says less about a change of heart on isolates than it does about the boundaries of the model. Some workloads simply are not meant to be distributed.

Where Isolates Excel — And Where They Don’t

Isolates are the right model for distributed workloads. Spinning one up to handle a single HTTP request at an ideal location takes milliseconds — less than a TLS handshake. That granularity is what makes network-wide scheduling practical. Containers and virtual machines need traffic concentrated on a few instances to be economical, because their overhead prevents that kind of fine-grained placement.

But not every application wants to be spread across a fleet. A modern single-player 3D game, for example, can generate dozens of gigabytes of data per second, all of it converging into a single, ordered stream of video frames. That work cannot be sharded across the network; it needs a single machine with minimal latency. Isolates offer no advantage for that case.

Legacy code is a separate problem. Existing codebases carry tooling and dependencies that were never designed for isolate runtimes. Porting a complex system means substantial effort, and in some cases is outright impossible — GPU access, for one, may not exist in an isolate environment. That ecosystem gap will close over time, but not overnight.

Necessity as a Parent

Cloudflare’s own products pushed the company into containers before this announcement. Browser Isolation, which runs Chromium on Cloudflare’s network and streams rendered graphics back to client machines, needed exactly this kind of support.

Chromium is a large, established codebase that cannot realistically run inside isolates today — and V8, the engine underneath Workers, is itself part of Chromium; it is not designed to nest inside itself. A browser also isn't a distributed workload: it is complex but serves a single user, with no need for infinite horizontal scaling. The engineering team deployed a container engine at the edge to run Chromium, quietly setting up the infrastructure this week's announcement is built on.

Other Internal Uses

“Edge” doesn’t have to mean all 200+ data centers at all times. Cloudflare has used containers on the edge for non-latency-sensitive tasks, running them only in off-peak locations. The scheduler for scheduled Workers, for example, runs on an internal container service. With no end user waiting on a response, batch jobs can run where it’s night and traffic is low.

CI builds are a natural fit for the same pattern. Web traffic has daily cycles, and off-peak compute sits idle. Running builds in those locations maximizes resource utilization, though not for the reasons a casual observer might expect.

Migration for Latency Is a Bad Trade

If your containerized web app is slow in one region, moving it to the edge won’t automatically fix it. A Node.js or Django app in a container still suffers from high per-container overhead — hundreds of milliseconds or more at cold start — wherever the container sits. The network latency you save by moving geographically closer to the user is negligible next to that overhead.

Even for warmed-up containers, the economics question is blunt: will you pay a premium to keep an entire distributed footprint running when your current one or two data centers already serve your traffic?

State management adds another burden. Running a legacy server stack in 200+ locations is materially different from running it in two. Workers and Durable Objects were designed to abstract those challenges away — with “the network is the computer” becoming more than a slogan. Classical stacks in containers won’t get those abstractions for free.

Container support, then, is aimed at a narrow class of applications that can’t yet fit the isolate model. Distributed systems, small request workloads, and any app that can be rebuilt for the edge-first model should still reach for Workers. Containers are a complement for code that is too big, too legacy-bound, or too sequential in its output to be sharded globally.

Cloudflare is inviting interested enterprises to sign up for early access to the container service, currently limited to its enterprise plans. The initial rollout will reveal how wide that narrow class of applications really is.