I'm attempting to understand the networking behavior for containers. Currently my container exposes

I'm attempting to understand the networking behavior for containers. Currently my container exposes a zero trust tunnel with a custom dns name tied to a cloudflare zone. Attempting to access the webserver running within the container is running very very slow (feels equivalent to dial up internet).

I've attempted to determine if it was just when accessing it via the cloudflare tunnel, however I'm noticing similar behavior when I fetch through the durable object to the container.

Is there an optimization or setting I need to get reasonable networking speed?

JJonathan I'm attempting to understand the networking behavior for containers. Currently m...

kian•9/3/25, 5:22 PM

There aren't really any related settings, the bandwidth should be pretty good for most apps.

Are you seeing slow cold starts or the actual HTTP response being streamed slowly?

Kkian There aren't really any related settings, the bandwidth should be pretty good fo...

JonathanOP•9/3/25, 6:55 PM

Specifically the HTTP response is slow for both cases of: performing a fetch to the container (I have a default port specified and it hits a basic python fast api which returns information about the environment) as well as hitting the container using the custom domain to return a web app (verified the web app is not the cause, this is simply just a very slow response as if it takes a long time to go from the zero trust tunnel back to the container origin server) then a delay before the bits come back, the actual processing within the container is pretty quick

pandalambda2•9/4/25, 10:41 AM

Why isn't the container FAQ growing? Support, discord, plus all the other channels looks like there's enough uncertainity that perhaps should be updated every other day, so much to cover, so many questions unanswered..

pandalambda2•9/4/25, 10:44 AM

On rollouts https://developers.cloudflare.com/containers/faq/#how-do-container-updates-and-rollouts-work if I have max_instances = 1 in my wrangler json config, and my container id is stable (i.e. just 'default

Cloudflare Docs

Frequently Asked Questions

Frequently Asked Questions:

pandalambda2•9/4/25, 10:44 AM

does this guarantee the container behaves like a singleton, during rollouts it doesnt try to bring up a replacement first?

Steps•9/4/25, 2:32 PM

Aside from https://developers.cloudflare.com/containers/platform-details/#limits , do Containers have any other limits (like invocations per month, etc.) or are these bound to the calling worker? So could I direct all 10 M workers calls to a container without extra costs or is there something to be aware of?

Steps•9/4/25, 3:01 PM

For example, if I set the timeout to 10 minutes... will one call then cause that much execution time removed from the worker?

Steps•9/4/25, 3:05 PM

Ah, I found the pricing section.

Steps•9/4/25, 3:05 PM

I'd suggest to link that with the limits page.

Steps•9/4/25, 3:07 PM

Regarding the egress: If I have a container that justs ingests data and writes that to R2, but never returns something... that's no egress, right?

Steps•9/4/25, 3:10 PM

When you use Containers, incoming requests to your containers are handled by your Worker, and each container has its own Durable Object. You are billed for your usage of both Workers and Durable Objects.

Ok, if my worker calls my container and that container runs for 1 minute... will the worker be billed the 1 ms it takes to call the container or will both be billed 1m? For the worker it should be wall time and not CPU time, right?

kian•9/4/25, 3:13 PM

Workers is CPU time, Durable Objects and Containers are wall time.

M.S•9/4/25, 11:52 PM

Hi Cloudflare team!

Quick question about Workers for Platforms + Containers integration:

Can user workers deployed via Workers for Platforms include Container bindings?

Specifically:
1. Can a user worker extend the Container class from @Cloudflare/containers?
2. Can user workers bind to containers in their wrangler.toml?
3. If yes, do container resource limits (40GB/20vCPU) apply per user worker or shared across the platform account?

Use case: Building a multi-tenant platform where each tenant needs their own containerized execution environment.

Currently testing but would love official clarification!

Thanks!

pandalambda2•9/5/25, 12:45 AM

Tangently related - considering shopify's crippled Oxygen setup I presume not. It's been mentioned before that SaaS's would like see patterns and practices and enhancements (I think a marketplace was mentioned) around deploying to users' Cloudflare accounts (aka bring your own account). As an end user why would I want Workers for Platform small limits when I could run on my own CF account and also get access to D1, queues, workflows, and so on (workers pro/unlimited or whatever its called today), but if that SaaS's outbound worker is doing something magical so that you have use their Workers for Platform then that's problematic (or another proxy stage at minimum), don't be that SaaS. Luckily on Shopify, Shopify outbound worker just attaches authentication so at least you can do this yourself with setting up a custom app and using clientid/secret to get an access token. Also imagine having to go through the SaaS's first line support to deal with a Cloudflare worker issue, it's just a poor pitch all around, Shopify Plus sales said on a call the benefit to Oxygen was 24/7 support, I nearly spat my coffee across the desk, I can't imagine they done any real training around CF let alone understand what an outbound worker was.

I'm not in the position of the SaaS, but as the SaaS consumer, but if I was I would be looking at using https://github.com/sam-goodwin/alchemy to deploy into the customer's own account via a restrictive api account... ymmv as it doesn't seem an officially supported pattern yet... (although aws anad azure have done it for ~decades even revenue sharing working in marketplace)

GitHub

GitHub - sam-goodwin/alchemy: Infrastructure as TypeScript

Infrastructure as TypeScript. Contribute to sam-goodwin/alchemy development by creating an account on GitHub.

pandalambda2•9/5/25, 12:58 AM

@kian | DevDocs
.. Love to see Container team do a AMA on reddit now we've got a few months since it came out..

SSteps Regarding the egress: If I have a container that justs ingests data and writes t...

pandalambda2•9/5/25, 2:21 AM

This is the big question, I'm not even sure most of CF staff can answer, it's been asked before several times in last few months and no one from CF has chimed in, my understanding/guess is that writing to R2 would be egress because you are going through the frontdoor (no worker level bindings).. my guess is that only invoking worker to the container traffic is not counted because that can work with internet egress turned off. One way to determine this would be disable internet egress https://developers.cloudflare.com/containers/faq/#how-do-i-allow-or-disallow-egress-from-my-container and see if you can still talk to R2.

The other option is instead of just proxying plain old http calls through the worker to the container you have a bi-directional communication websocket that allow you to push to R2 via the invoking worker and derive your http response at the worker. It was mentioned earlier they are looking at a container to worker fetch setup.

But it's not even clear if the invoking worker to container traffic is consider egress.

And then since if you're talking to the frontend endpoints of Cloudflare (for R2, rest api for kv, rest api for D1) presume you never going to leave the local zone since the anycast IPs will ingest at that point anyway, so is the egress charged based on the placement of the container then... rather than the underlying target (say R2 is hosted in a different continent for example)

It's possible they are still flushing out the billing, has anyone actually been charged egress yet? @kian

In fairness fly.io is also pretty useless in explaining their egress charging, made worse by two separate billing patterns depending on which generation your account is.

M.S•9/5/25, 2:08 PM

@pandalambda2 That's a very insightful point you've made about the broader philosophy of managed platforms. It's a crucial discussion for the ecosystem, and your comment really gets to the heart of the trade-offs involved.

You're spot on that for a technical user, the 'bring your own account' (BYOA) model is often superior. It offers the control, transparency, and direct scalability that developers rightly value, avoiding the "walled garden" issue you described.

The perspective I'd add to the discussion is for a different market segment: the non-technical user. The platform I'm building is designed for them; users interact with natural language prompts to generate and execute jobs, and requiring them to manage their own Cloudflare account would be a critical point of failure in the user journey.

This frames the central challenge that I believe Cloudflare can help solve: how to enable builders to provide a seamless, managed experience while also achieving massive scalability.

As your critique highlights, the current 'Managed Platform' model (which Workers for Platforms enables) runs into a scaling wall because all tenants share a single resource quota. This leads to workarounds like queuing, but doesn't solve the core issue of scaling total available resources as a user base grows.

This is exactly why I posted my original technical questions. The hope is that the platform will evolve to better support this managed model—perhaps with features like the isolated resource quotas I mentioned. This would be a game-changer, allowing services like mine to offer a simple UX and achieve true scaling, validating the 'Managed Platform' approach as a first-class citizen alongside the BYOA model.

TangoBee•9/5/25, 5:22 PM

I have two containers: Container A, which sends a POST request to Container B, which exposes an endpoint. I don't want to expose that endpoint publicly, so I want the request to be sent internally. How can I do this?

I'm able to do this with a worker using service bindings, but I haven't been able to get it working in a container to container setup. For context my Container A code is written in Go.

kracozebr•9/5/25, 6:35 PM

Helo. I'm new to cloudflare and I wonder if I can host several containers. I have 2 services (2 docker containers) with network between them like docker compose or kubernetes. Is this possible?
UPD: Ok. I see it possible. May be there is some quide or example (there is no example in docs )

TTangoBee I have two containers: Container A, which sends a POST request to Container B, w...

gruntlord6•9/5/25, 8:06 PM

Maybe use rpc?

Kkracozebr Helo. I'm new to cloudflare and I wonder if I can host several containers. I hav...

gruntlord6•9/5/25, 8:07 PM

You can have as many instances between projects as you want, up to the current resource limits (10 instances iirc)

Ppandalambda2 This is the big question, I'm not even sure most of CF staff can answer, it's b...

gruntlord6•9/5/25, 8:08 PM

It's been pretty quiet here in regards to the egress, they have yet to clarify it

gruntlord6•9/5/25, 8:08 PM

Containers to R2 for image compression is atm my only real use case so it would be nice to have that transparency

Original message was deleted

M.S•9/5/25, 9:54 PM

You've summed it up perfectly. I'm in total agreement

TTangoBee I have two containers: Container A, which sends a POST request to Container B, w...

pandalambda2•9/6/25, 7:56 AM

that's not a supported pattern. put the hostname for worker B (which talks to container B) behind cloudflare zero trust, create a service token, create a policy that gives access to that service token. give container A the client id /client secret of said service token, container A http client connects to container B via worker B passing CF-Access-Client-Id / and CF-Access-Client-Secret HTTP headers and access manages the authentication. actually very nice.

pandalambda2•9/6/25, 7:59 AM

the frankenstein alternative would be embedding something like tailscale in your containers, and disabling sleepAfter, but you'd still need a form of healthcheck such as cron worker that /healthchecks worker B that brings up container B in the event the container was killed for another reason. dont do it

pandalambda2•9/6/25, 8:01 AM

you can also add ASN == cloudflare if you really want as part of a policy. the http requests from container A won't have the standard cf.worker.origin headers (or whatever they called)

pandalambda2•9/6/25, 8:53 AM

@TangoBee https://forms.gle/AGSq54VvUje6kmKu8 if you really want tcp/udp ingress

Google Docs

Containers TCP/UDP Ingress

Give us information on why you would like TCP or UDP ingress for Containers.

1984 Ford Laser•9/6/25, 11:28 AM

I really hope the TCP/UDP ingress idea is still moving forward, have lots of use cases to move over to Containers if that can be sorted

blyedev•9/6/25, 5:43 PM

Would it be possible to host wordpress on containers? Has anyone ever gotten it to work? Would it be decent?

Isaac McFadyen•9/6/25, 6:21 PM

There's no persistent disks, so you'd need to mount something that persists e.g. R2 using a FUSE client

pandalambda2•9/7/25, 4:39 AM

doesn't wordpress require mysql too? so you need something like planetscale (db) and hyperdrive (connector) too. also you want the container stabled close to your DB as wordpress makes dozens or roundtrip db queries and I dont think its currently possible to do smart placement or pin specific locations on containers yet

Jadugar_Jaggu•9/7/25, 7:58 AM

Containers vs Digital Ocean droplets

pandalambda2•9/7/25, 8:01 AM

not this again. The 2 CPUs means nothing on DigitalOcean, compare to dedicated CPUs plans for a fairer comparison... which it seems they don't even offer.

Ppandalambda2 not this again. The 2 CPUs means nothing on DigitalOcean, compare to dedicated C...

Jadugar_Jaggu•9/7/25, 8:03 AM

Comparison is between cloudflare and digital , both platforms based on sharing resources.

pandalambda2•9/7/25, 8:03 AM

yes, but there is no expectation of what a CPU means on DO, look at digitalocean container pricing

pandalambda2•9/7/25, 8:04 AM

https://www.digitalocean.com/products/app-platform

DigitalOcean App Platform | Build, Deploy, and Scale Apps with Ease

Build, deploy, and scale apps quickly using a simple, cost-effective solution. Go from code to production in just a few clicks

Ppandalambda2 yes, but there is no expectation of what a CPU means on DO, look at digitalocean...

Jadugar_Jaggu•9/7/25, 8:04 AM

I don't get it, are you saying cloudflare containers have more performance over digital?

pandalambda2•9/7/25, 8:06 AM

not necessarily at any particular moment. but they have stable baseline, you have an expectation, for example a core on EC2 is expected to deliver stable performance comparable to 1.6ghz xeon core 24/7, whilst a DO core might give something resembling 4ghz but then when barry runs his video encoding you get 400mz

pandalambda2•9/7/25, 8:06 AM

mhz *

pandalambda2•9/7/25, 8:06 AM

if you really want an eye opener go look at a lowendtalk.com you get 50 cores for 5usd

pandalambda2•9/7/25, 8:07 AM

but it means absolute nothing, just trash

Ppandalambda2 not necessarily at any particular moment. but they have stable baseline, you hav...

Jadugar_Jaggu•9/7/25, 8:09 AM

If that the case then which service is in comparison of cloudflare containers, if not DO

pandalambda2•9/7/25, 8:10 AM

aws fargatye

pandalambda2•9/7/25, 8:10 AM

gcp cloudrun

pandalambda2•9/7/25, 8:10 AM

digitalocean container platform

Jadugar_Jaggu•9/7/25, 8:10 AM

When I see 0.0625 vCPU, the first thought that pops into my mind is whether it’s actually capable or even worth trying, lol

pandalambda2•9/7/25, 8:10 AM

linode managed kubernetes

pandalambda2•9/7/25, 8:11 AM

azure has one too

pandalambda2•9/7/25, 8:11 AM

if you want to burden of managing a firecracker host too then you can look at vultr and linode but at their dedicated cpu plans

I'm attempting to understand the networking behavior for containers. Currently my container exposes

Similar Threads