Regarding the egress: If I have a container that justs ingests data and writes that to R2, but never

Regarding the egress: If I have a container that justs ingests data and writes that to R2, but never returns something... that's no egress, right?

StepsOP•9/4/25, 3:10 PM

When you use Containers, incoming requests to your containers are handled by your Worker, and each container has its own Durable Object. You are billed for your usage of both Workers and Durable Objects.

Ok, if my worker calls my container and that container runs for 1 minute... will the worker be billed the 1 ms it takes to call the container or will both be billed 1m? For the worker it should be wall time and not CPU time, right?

kian•9/4/25, 3:13 PM

Workers is CPU time, Durable Objects and Containers are wall time.

M.S•9/4/25, 11:52 PM

Hi Cloudflare team!

Quick question about Workers for Platforms + Containers integration:

Can user workers deployed via Workers for Platforms include Container bindings?

Specifically:
1. Can a user worker extend the Container class from @Cloudflare/containers?
2. Can user workers bind to containers in their wrangler.toml?
3. If yes, do container resource limits (40GB/20vCPU) apply per user worker or shared across the platform account?

Use case: Building a multi-tenant platform where each tenant needs their own containerized execution environment.

Currently testing but would love official clarification!

Thanks!

pandalambda2•9/5/25, 12:45 AM

Tangently related - considering shopify's crippled Oxygen setup I presume not. It's been mentioned before that SaaS's would like see patterns and practices and enhancements (I think a marketplace was mentioned) around deploying to users' Cloudflare accounts (aka bring your own account). As an end user why would I want Workers for Platform small limits when I could run on my own CF account and also get access to D1, queues, workflows, and so on (workers pro/unlimited or whatever its called today), but if that SaaS's outbound worker is doing something magical so that you have use their Workers for Platform then that's problematic (or another proxy stage at minimum), don't be that SaaS. Luckily on Shopify, Shopify outbound worker just attaches authentication so at least you can do this yourself with setting up a custom app and using clientid/secret to get an access token. Also imagine having to go through the SaaS's first line support to deal with a Cloudflare worker issue, it's just a poor pitch all around, Shopify Plus sales said on a call the benefit to Oxygen was 24/7 support, I nearly spat my coffee across the desk, I can't imagine they done any real training around CF let alone understand what an outbound worker was.

I'm not in the position of the SaaS, but as the SaaS consumer, but if I was I would be looking at using https://github.com/sam-goodwin/alchemy to deploy into the customer's own account via a restrictive api account... ymmv as it doesn't seem an officially supported pattern yet... (although aws anad azure have done it for ~decades even revenue sharing working in marketplace)

GitHub

GitHub - sam-goodwin/alchemy: Infrastructure as TypeScript

Infrastructure as TypeScript. Contribute to sam-goodwin/alchemy development by creating an account on GitHub.

pandalambda2•9/5/25, 12:58 AM

@kian | DevDocs
.. Love to see Container team do a AMA on reddit now we've got a few months since it came out..

SSteps Regarding the egress: If I have a container that justs ingests data and writes t...

pandalambda2•9/5/25, 2:21 AM

This is the big question, I'm not even sure most of CF staff can answer, it's been asked before several times in last few months and no one from CF has chimed in, my understanding/guess is that writing to R2 would be egress because you are going through the frontdoor (no worker level bindings).. my guess is that only invoking worker to the container traffic is not counted because that can work with internet egress turned off. One way to determine this would be disable internet egress https://developers.cloudflare.com/containers/faq/#how-do-i-allow-or-disallow-egress-from-my-container and see if you can still talk to R2.

The other option is instead of just proxying plain old http calls through the worker to the container you have a bi-directional communication websocket that allow you to push to R2 via the invoking worker and derive your http response at the worker. It was mentioned earlier they are looking at a container to worker fetch setup.

But it's not even clear if the invoking worker to container traffic is consider egress.

And then since if you're talking to the frontend endpoints of Cloudflare (for R2, rest api for kv, rest api for D1) presume you never going to leave the local zone since the anycast IPs will ingest at that point anyway, so is the egress charged based on the placement of the container then... rather than the underlying target (say R2 is hosted in a different continent for example)

It's possible they are still flushing out the billing, has anyone actually been charged egress yet? @kian

In fairness fly.io is also pretty useless in explaining their egress charging, made worse by two separate billing patterns depending on which generation your account is.

M.S•9/5/25, 2:08 PM

@pandalambda2 That's a very insightful point you've made about the broader philosophy of managed platforms. It's a crucial discussion for the ecosystem, and your comment really gets to the heart of the trade-offs involved.

You're spot on that for a technical user, the 'bring your own account' (BYOA) model is often superior. It offers the control, transparency, and direct scalability that developers rightly value, avoiding the "walled garden" issue you described.

The perspective I'd add to the discussion is for a different market segment: the non-technical user. The platform I'm building is designed for them; users interact with natural language prompts to generate and execute jobs, and requiring them to manage their own Cloudflare account would be a critical point of failure in the user journey.

This frames the central challenge that I believe Cloudflare can help solve: how to enable builders to provide a seamless, managed experience while also achieving massive scalability.

As your critique highlights, the current 'Managed Platform' model (which Workers for Platforms enables) runs into a scaling wall because all tenants share a single resource quota. This leads to workarounds like queuing, but doesn't solve the core issue of scaling total available resources as a user base grows.

This is exactly why I posted my original technical questions. The hope is that the platform will evolve to better support this managed model—perhaps with features like the isolated resource quotas I mentioned. This would be a game-changer, allowing services like mine to offer a simple UX and achieve true scaling, validating the 'Managed Platform' approach as a first-class citizen alongside the BYOA model.

TangoBee•9/5/25, 5:22 PM

I have two containers: Container A, which sends a POST request to Container B, which exposes an endpoint. I don't want to expose that endpoint publicly, so I want the request to be sent internally. How can I do this?

I'm able to do this with a worker using service bindings, but I haven't been able to get it working in a container to container setup. For context my Container A code is written in Go.

kracozebr•9/5/25, 6:35 PM

Helo. I'm new to cloudflare and I wonder if I can host several containers. I have 2 services (2 docker containers) with network between them like docker compose or kubernetes. Is this possible?
UPD: Ok. I see it possible. May be there is some quide or example (there is no example in docs )

TTangoBee I have two containers: Container A, which sends a POST request to Container B, w...

gruntlord6•9/5/25, 8:06 PM

Maybe use rpc?

Kkracozebr Helo. I'm new to cloudflare and I wonder if I can host several containers. I hav...

gruntlord6•9/5/25, 8:07 PM

You can have as many instances between projects as you want, up to the current resource limits (10 instances iirc)

Ppandalambda2 This is the big question, I'm not even sure most of CF staff can answer, it's b...

gruntlord6•9/5/25, 8:08 PM

It's been pretty quiet here in regards to the egress, they have yet to clarify it

gruntlord6•9/5/25, 8:08 PM

Containers to R2 for image compression is atm my only real use case so it would be nice to have that transparency

Original message was deleted

M.S•9/5/25, 9:54 PM

You've summed it up perfectly. I'm in total agreement

TTangoBee I have two containers: Container A, which sends a POST request to Container B, w...

pandalambda2•9/6/25, 7:56 AM

that's not a supported pattern. put the hostname for worker B (which talks to container B) behind cloudflare zero trust, create a service token, create a policy that gives access to that service token. give container A the client id /client secret of said service token, container A http client connects to container B via worker B passing CF-Access-Client-Id / and CF-Access-Client-Secret HTTP headers and access manages the authentication. actually very nice.

pandalambda2•9/6/25, 7:59 AM

the frankenstein alternative would be embedding something like tailscale in your containers, and disabling sleepAfter, but you'd still need a form of healthcheck such as cron worker that /healthchecks worker B that brings up container B in the event the container was killed for another reason. dont do it

pandalambda2•9/6/25, 8:01 AM

you can also add ASN == cloudflare if you really want as part of a policy. the http requests from container A won't have the standard cf.worker.origin headers (or whatever they called)

pandalambda2•9/6/25, 8:53 AM

@TangoBee https://forms.gle/AGSq54VvUje6kmKu8 if you really want tcp/udp ingress

Google Docs

Containers TCP/UDP Ingress

Give us information on why you would like TCP or UDP ingress for Containers.

1984 Ford Laser•9/6/25, 11:28 AM

I really hope the TCP/UDP ingress idea is still moving forward, have lots of use cases to move over to Containers if that can be sorted

blyedev•9/6/25, 5:43 PM

Would it be possible to host wordpress on containers? Has anyone ever gotten it to work? Would it be decent?

Isaac McFadyen•9/6/25, 6:21 PM

There's no persistent disks, so you'd need to mount something that persists e.g. R2 using a FUSE client

pandalambda2•9/7/25, 4:39 AM

doesn't wordpress require mysql too? so you need something like planetscale (db) and hyperdrive (connector) too. also you want the container stabled close to your DB as wordpress makes dozens or roundtrip db queries and I dont think its currently possible to do smart placement or pin specific locations on containers yet

Jadugar_Jaggu•9/7/25, 7:58 AM

Containers vs Digital Ocean droplets

pandalambda2•9/7/25, 8:01 AM

not this again. The 2 CPUs means nothing on DigitalOcean, compare to dedicated CPUs plans for a fairer comparison... which it seems they don't even offer.

Ppandalambda2 not this again. The 2 CPUs means nothing on DigitalOcean, compare to dedicated C...

Jadugar_Jaggu•9/7/25, 8:03 AM

Comparison is between cloudflare and digital , both platforms based on sharing resources.

pandalambda2•9/7/25, 8:03 AM

yes, but there is no expectation of what a CPU means on DO, look at digitalocean container pricing

pandalambda2•9/7/25, 8:04 AM

https://www.digitalocean.com/products/app-platform

DigitalOcean App Platform | Build, Deploy, and Scale Apps with Ease

Build, deploy, and scale apps quickly using a simple, cost-effective solution. Go from code to production in just a few clicks

Ppandalambda2 yes, but there is no expectation of what a CPU means on DO, look at digitalocean...

Jadugar_Jaggu•9/7/25, 8:04 AM

I don't get it, are you saying cloudflare containers have more performance over digital?

pandalambda2•9/7/25, 8:06 AM

not necessarily at any particular moment. but they have stable baseline, you have an expectation, for example a core on EC2 is expected to deliver stable performance comparable to 1.6ghz xeon core 24/7, whilst a DO core might give something resembling 4ghz but then when barry runs his video encoding you get 400mz

pandalambda2•9/7/25, 8:06 AM

mhz *

pandalambda2•9/7/25, 8:06 AM

if you really want an eye opener go look at a lowendtalk.com you get 50 cores for 5usd

pandalambda2•9/7/25, 8:07 AM

but it means absolute nothing, just trash

Ppandalambda2 not necessarily at any particular moment. but they have stable baseline, you hav...

Jadugar_Jaggu•9/7/25, 8:09 AM

If that the case then which service is in comparison of cloudflare containers, if not DO

pandalambda2•9/7/25, 8:10 AM

aws fargatye

pandalambda2•9/7/25, 8:10 AM

gcp cloudrun

pandalambda2•9/7/25, 8:10 AM

digitalocean container platform

Jadugar_Jaggu•9/7/25, 8:10 AM

When I see 0.0625 vCPU, the first thought that pops into my mind is whether it’s actually capable or even worth trying, lol

pandalambda2•9/7/25, 8:10 AM

linode managed kubernetes

pandalambda2•9/7/25, 8:11 AM

azure has one too

pandalambda2•9/7/25, 8:11 AM

if you want to burden of managing a firecracker host too then you can look at vultr and linode but at their dedicated cpu plans

pandalambda2•9/7/25, 8:14 AM

2 prime examples, contabo and php-friends come up regularly, they have a physical node with maybe 96 cores, but they sell maybe 9600 cores per 1u machine and hope that usage patterns means they dont have too much churn

pandalambda2•9/7/25, 8:14 AM

its a minefield of fraudulent marketing

Jadugar_Jaggu•9/7/25, 8:17 AM

Thanks for info. I was thinking to shift my workloads to cloudflare containers. But I am not able to compare between other site's vcpu and cloudflare's vcpu. Currently i am using OVH, 8 GB ram, 4vcpu

pandalambda2•9/7/25, 8:18 AM

I'm not too familar with OVH's current offering, but unless the cores are advertised as dedicated then you don't have an expectation of a baseline, could be good in the morning and crap at night, etc.. and the sad thing is now some hosts like contabo and php-friends have hijacked the terminology of dedicated to mean something else (i.e. it isn't dedicated)

pandalambda2•9/7/25, 8:21 AM

you're best moving a test workload and doing some load testing to understand how your app performs, you probably need a fraction of what OVH offers if OVH vcpus are completely undefined

khangal•9/7/25, 7:05 PM

I tried to deploy container with official container template using account api token. Token has containers edit permission. But pnpm run deploy is failing with message saying i need “containers:write” permission. I’m confused. It’s 5$ paid account.

Ppandalambda2 doesn't wordpress require mysql too? so you need something like planetscale (db)...

gruntlord6•9/8/25, 1:56 AM

they have a wip sqlite adapter but yes, the base install would need to be on mysql and migrated

Kkhangal I tried to deploy container with official container template using account api t...

gruntlord6•9/8/25, 1:57 AM

its an api token permission you need to enable

Ggruntlord6 they have a wip sqlite adapter but yes, the base install would need to be on mys...

pandalambda2•9/8/25, 2:49 AM

even if its compatible with D1 you'll have all sorts of eventual consistency issues since with containers as you'd have to use the D1 rest API which doesn't support sessions, so any parts are fast moving - comments and reactions then it's going to run like reddit on a bad day

Ppandalambda2 even if its compatible with D1 you'll have all sorts of eventual consistency iss...

gruntlord6•9/8/25, 3:28 AM

Couldn't the durable objects be used to save to d1 or its own SQL?

Regarding the egress: If I have a container that justs ingests data and writes that to R2, but never

Similar Threads