Cloudflare has released the source code for Cloudflare OS, a platform built to run enterprise AI agents and user tools inside isolated V8 compute sandboxes. The company stresses that this is not a traditional computer operating system but a self-hostable environment for agent workspaces that organizations can deploy across Cloudflare Workers. After using an earlier version internally since May among its own staff, the firm has now published version 2 for others to host.
The design centers on containment. Server-side code executes as Dynamic Workers paired with dedicated Durable Object SQLite databases, while outbound networking is turned off by default. That restriction is intended to stop sensitive information from leaving the sandbox. To manage access, the platform relies on Gatekeepers—proxy workers that hold OAuth credentials and record what data agents observe. The approach tries to close a gap left by protocols such as the Model Context Protocol, which define tool interfaces but do not track subsequent data handling. In practice, this gives administrators logs and controls that pure agent frameworks often lack.
Yet the open-source release remains closely tied to Cloudflare’s own stack. The code still depends on Workers, KV storage, R2 object storage, Browser Rendering, and Dynamic Worker Loaders. Organizations must also manage language-model token costs either through Cloudflare’s AI Gateway or by supplying their own keys. That dependency limits how far the system can travel outside the provider’s infrastructure, a common pattern when large cloud companies open parts of their internal tooling. Similar efforts in the past, from container platforms to early serverless runtimes, have shown that true portability often arrives later than the initial source dump.
Source code and deployment templates sit in public GitHub repositories under cloudflare-os and cloudflare-os-starter. Future plans mentioned by the company include a fully managed dashboard edition, Slack integration, and additional connectors. For teams already running workloads on Cloudflare Workers, the release offers a concrete way to experiment with agent sandboxes under tighter data controls. Others will need to weigh the convenience of the existing infrastructure against the cost of remaining locked into one vendor’s services while evaluating longer-term alternatives for secure agent execution.
