AI Potluck
Contribute
Back to Gap Map Organization

Cloudflare

company · United States

Scores

1 product on the map — 1 closed.

Cloudflare Sandboxes

Openness

1 high confidence
1.0
license
Proprietary
source
closed
service
proprietary Cloudflare edge (Workers/Durable Objects/Dynamic Worker Loader - no self-host of the isolate/container plane)
open-part
Sandbox SDK only (@cloudflare/sandbox Apache-2.0, cloudflare/sandbox-sdk on GitHub)
pricing
Workers paid plan, Dynamic Workers $0.002/unique-worker/day

The Sandbox SDK is Apache-2.0, but running it requires Cloudflare's proprietary managed edge network, with no way to self-host the isolate or container plane. An open client SDK over a closed runtime does not make this open core.

  • https://api.github.com/repos/cloudflare/sandbox-sdk recorded 2026-08-13

    Repository public and unarchived, described as "Run sandboxed code environments on Cloudflare's edge network"; license reported as NOASSERTION because the root LICENSE is a pointer file.

  • https://blog.cloudflare.com/dynamic-workers/ recorded 2026-06-04

    Dynamic Worker Loader open beta, isolate sandboxing, post-beta $0.002/worker/day pricing

  • https://blog.cloudflare.com/dynamic-workers/ recorded 2026-08-13

    Dynamic Worker Loader is an API by which a Cloudflare Worker instantiates another Worker in its own sandbox, running on Cloudflare's platform; open beta to all paid Workers users; priced at $0.002 per unique Worker loaded per day on top of normal Workers CPU and invocation charges. No self-hosted deployment of the isolate or container plane is offered.

  • https://github.com/cloudflare/sandbox-sdk recorded 2026-06-04

    Apache-2.0 SDK; runs on Cloudflare Containers/Workers/Durable Objects (managed edge)

  • https://raw.githubusercontent.com/cloudflare/sandbox-sdk/main/packages/sandbox/LICENSE recorded 2026-09-29

    The published SDK package LICENSE is the verbatim "Apache License" text, "Version 2.0, January 2004", governing only the client SDK.

  • https://raw.githubusercontent.com/cloudflare/workerd/main/README.md recorded 2026-09-29

    The open-source workerd README warns that it "is not a hardened sandbox" and "on its own does not contain suitable defense-in-depth", while the Cloudflare Workers hosting service "uses many additional layers of defense-in-depth", so the self-hostable runtime is not the hardened isolate plane the managed service runs.

  • https://registry.npmjs.org/@cloudflare%2Fsandbox recorded 2026-09-29

    npm registry metadata for the package, described as "A sandboxed environment for running commands" with the repository "git+https://github.com/cloudflare/sandbox-sdk.git" and the license "Apache-2.0".

  • https://www.cloudflare.com/terms/ recorded 2026-09-29

    Cloudflare Self-Serve Subscription Agreement bars customers from the right to "reverse engineer the Services" and states that the "computer code (including source code or object code), products, software, services" of the Service "are protected by all relevant intellectual property and proprietary rights and applicable laws", with "Cloudflare reserves all rights to the Materials not granted expressly in this Agreement".

Adoption

4 medium confidence
4.0

Adoption is measured by npm downloads of @cloudflare/sandbox, the product's own SDK package, over a trailing month ending 2026-08-09. Package downloads include the usual CI and mirror inflation, and the only other adoption signal, a single customer's execution-request volume during Dynamic Workers' open beta, counts requests rather than distinct users.

Capability

4 medium confidence
4.0

Dynamic Workers' JavaScript and TypeScript isolates start in a few milliseconds and use a few megabytes of memory, but that speed does not carry over to the Sandbox SDK, which runs arbitrary code in containers that Cloudflare's own launch post says take hundreds of milliseconds to boot. Dynamic Workers is in open beta, and its only scale evidence is one customer's reported request volume rather than a published limit.

  • https://api.github.com/repos/cloudflare/sandbox-sdk recorded 2026-08-13

    Repository active and unarchived, described as "Run sandboxed code environments on Cloudflare's edge network" - the container-backed path for arbitrary code.

  • https://blog.cloudflare.com/dynamic-workers/ recorded 2026-09-29

    Launch post saying of containers that "containers are expensive and slow to start, taking hundreds of milliseconds to boot", and that platforms "can also block or intercept any network requests" from generated code.

  • https://blog.cloudflare.com/dynamic-workers/ recorded 2026-09-29

    Launch post stating "Dynamic Worker Loader has no such limits" on global concurrent sandboxes and sandbox creation rate, and "An isolate takes a few milliseconds to start and uses a few megabytes of memory."

  • https://developers.cloudflare.com/sandbox/concepts/architecture/ recorded 2026-09-29

    Sandbox SDK architecture page stating "Sandbox SDK combines Workers, Durable Objects, and Containers for secure code execution." across a client SDK layer, a Durable Object layer and a container runtime layer.

  • https://github.com/cloudflare/sandbox-sdk recorded 2026-06-04

    container-backed sandbox: run commands, manage files, background processes, expose services

  • https://www.computesdk.com/benchmarks/sandboxes/ recorded 2026-09-29

    ComputeSDK sandbox benchmarks page, described as "Independently verified sandbox benchmarks run on a recurring schedule." and carrying a "Sandbox Burst TTI" leaderboard that lists Cloudflare among the providers.