Project
Cloudflare Containers lets developers run containerized workloads on Cloudflare's edge network, integrated with Workers and Durable Objects.
Cloudflare has fixed a flaw in Containers that let a Workers Paid account read the 60 KiB it had not written inside each 64 KiB disk block it touched. The fleet-wide fix needed no customer configuration changes.
Reality
Cloudflare rebuilt Containers so code picks each sandbox's image and instance type at runtime, with median startup cut to 648ms in a ComputeSDK benchmark. A fresh Linux workspace per agent task becomes quick enough to wait for, on a figure Cloudflare itself reports.
Reality
Cloudflare Containers let a paying tenant read up to 60KiB of another customer's leftover data from each reused 64KiB disk block. Cloudflare has zeroed new blocks and rebuilt pre-fix disks, so the risk still open is plaintext credentials stored there earlier.
Reality
Cloudflare fixed a Containers flaw that let paying customers read other tenants' leftover disk data, found on 18 of 24 production tries. Sandboxes, the product it sells for running untrusted and AI-written code, was affected too.
Perspective Coverage
3 publishersReality
Worker Previews give a branch its own URL, configuration and state, and isolating the Durable Object namespace is what keeps a preview's writes away from the single instance that owns production's storage.
Reality
gRPC got the announcement slot, but underneath it is a raw inbound socket that a Worker can route in JavaScript. Full duplex only shows up once that socket gets passed down to a Durable Object and a Container.
Reality