Cloudflare Computer

// Overview

Cloudflare Computer is a virtual filesystem that lives inside a Durable Object. The Durable Object holds the authoritative state in SQLite and exposes one pluggable execution surface, `workspace.runtime`. A single entry point — `workspace.runtime.exec(source, { backend })` — runs work, and the selected backend decides whether `source` is a shell command or an ECMAScript module. A Workspace can register several backends under stable IDs, connects them lazily on first use, and can also be constructed with no backend at all, giving you just the filesystem.

Three backends ship in the repository. The container backend projects the SQLite state into a sandbox container as a real FUSE mount, where a sandbox-side daemon called `computerd` mounts the state and syncs changes back over a capnweb RPC channel — a full Linux userland with real binaries and real network. The isolate-shell backend runs just-bash in a Dynamic Worker, reaching the authoritative Workspace over Workers RPC so there is no second store or sync round trip. The isolate-JavaScript backend evaluates an ECMAScript module in a fresh Dynamic Worker with structured input and results, durable relative imports, configured libraries, Workspace-backed `node:fs/promises`, and trusted `ws:git` and `ws:artifacts` modules.

The repository is a small monorepo: `@cloudflare/dofs` is the Durable Object SQLite filesystem and sync protocol, `@cloudflare/computer-rpc` carries the capnweb wire types shared between the Durable Object and the daemon, `@cloudflare/computerd` is the FUSE-mounting daemon that runs in the container, and `@cloudflare/computer` is the top-level package consumed by Durable Objects. Cloudflare labels the package preview-only: the APIs are unstable, the specification under `docs/` is forward-looking intent rather than a description of the code, and it is explicitly not suitable for production yet. The project accepts issues and design proposals but not unsolicited pull requests.

// What it does

• A SQLite-backed virtual filesystem inside a Durable Object as the authoritative state for an agent's work
• One execution entry point, workspace.runtime.exec(source, { backend }), across every registered backend
• Container backend: computerd mounts the workspace as a real FUSE filesystem in a sandbox with a full Linux userland and network
• Isolate shell backend running just-bash in a Dynamic Worker, talking to the Workspace over Workers RPC with no second store
• Isolate JavaScript backend with structured input/results, durable relative imports, Workspace-backed node:fs/promises and trusted ws:git and ws:artifacts modules
• Runnable examples for MCP, egress policies, artifacts publishing, Workers AI assets and a side-by-side container-vs-isolate runtime comparison

// Getting started

Build on the top-level @cloudflare/computer package and follow its README for the entrypoint map and worked fs/runtime examples; the examples directory holds runnable Worker workspaces you can copy.

npm install @cloudflare/computer

await workspace.runtime.exec(source, { backend })

git clone https://github.com/cloudflare/computer.git
cd computer/examples/worker-shell

docs/README.md
docs/19_performance.md

Commands and code are distilled from the project's own documentation — always check the official repo for the latest.

// When to use it

• Give an agent a durable working directory whose state survives between turns and sessions
• Run most agent work in a cheap Workers isolate and escalate only the steps that need npm or native binaries into a Linux container
• Expose a Code Mode MCP tool backed by a durable workspace instead of a stateless sandbox
• Enforce egress policy per execution — none, all, or a custom allowlist — across shell, JavaScript and container backends

// How Cloudflare Computer compares

Cloudflare Computer alongside other open-source code sandboxes & isolation tools AI/TLDR tracks, ranked by GitHub stars.