Cloudflare published Cloudflare OS on August 5 under the Apache 2.0 licence, and the interesting part is not the name. This is the internal agent workspace thousands of Cloudflare employees already use, released as source you deploy into your own account rather than a product you sign up for. The architecture is the reason to read the repository even if you never run it: server code executes in Dynamic Workers with outbound networking switched off, each app instance gets its own Durable Object Facet with a private SQLite database, and the client and server talk over Cap'n Web. The README also notes it can run on the open source workerd runtime on your own servers.
The short answer
Cloudflare released Cloudflare OS, the agent workspace it already runs internally, as open source under Apache 2.0. Server code runs in Dynamic Workers with outbound networking disabled, each app instance gets its own Durable Object Facet with a private SQLite database, and the client talks to the server over Cap'n Web. There is a starter repository for deploying into your own Cloudflare account. The published version is a rewrite, and the project says it still has rough edges.
Company blog posts about internal tools usually end with a waiting list. This one ends with a repository.
On August 5, Cloudflare published Cloudflare OS, the workspace its own staff use to research, draft documents against live data, automate repetitive work and build small internal apps. The code is on GitHub under the Apache 2.0 licence, with a second repository, cloudflare-os-starter, holding the deployment template. Cloudflare's framing is that you are not meant to use Cloudflare OS. You are meant to fork it and make it your company's.
The architecture is the actual news
Strip away the naming argument and what you have is a well shaped answer to a problem plenty of teams are currently solving badly: how do you let an agent write and run code inside your company without handing it your network.
Cloudflare's answer has three moving parts. Server side code runs in Dynamic Workers with outbound networking disabled, so generated code cannot reach out on its own. Client side code runs in sandboxed browser frames. Communication between the two goes over Cap'n Web, an object capability RPC system, which means the client holds references to specific capabilities rather than a general purpose door into the backend.
Underneath that, every app instance is a Durable Object Facet with its own SQLite database. Cloudflare calls a running app a gadget, and the point of the naming is that a gadget is per user and per instance. When you make a slide deck in Cloudflare OS, you get a private copy of the slide deck app, in its own sandbox, with its own storage. Nobody is sharing a tenant column.
That is a design decision with real consequences. Isolation stops being a policy layer someone has to remember to apply, and becomes the default shape of the system.
What you need to run it
The documented route is a Cloudflare account. You deploy the starter template into it, then supply your own Access policies, your own AI Gateway configuration and your own integrations with internal systems. Local development uses pnpm, with the server and client run as separate processes.
The line worth noticing sits in the README almost as an aside: the whole thing is built on workerd, Cloudflare's open source Workers runtime, and can run on top of it on your own servers. That does not make self hosting a supported path with a guide attached, and we would expect to spend real time on it. It does mean the project is not a shop window with the walls painted on. There is a route out of the platform, and it is the same runtime Cloudflare uses.
Read it before you build the same thing worse
There is a specific kind of internal project happening at a lot of companies right now. Someone wires an agent to a code execution sandbox, someone else adds access to the wiki and the ticket tracker, and six weeks later there is a service with broad reach into internal systems that nobody drew a diagram for.
The value of a published, working, opinionated implementation is that it gives you a reference for the boring decisions. Where does generated code run. What can it reach. How is state partitioned per user. How does a capability get granted and revoked. Cloudflare has answered those in code you can read this afternoon, under a licence that lets you lift the answers.
Be realistic about maturity. The repository is version two, a rewrite informed by what went wrong the first time, and the project's own description is that it is capable with rough edges remaining. Thousands of internal users is genuine evidence the core holds up. It is also evidence about a company willing to run its staff on unfinished tooling, which most organisations are not.
Our position: clone it, read the sandboxing and the Facet layout, deploy it into an account where nothing matters, and treat the architecture as the deliverable. The workspace is the demo. The design is the thing worth keeping.
Sources and further reading
- Cloudflare OS: an open platform for agents, apps, and work, Cloudflare blog, August 5, 2026
- cloudflare/cloudflare-os on GitHub
- Cloudflare announces open-source Cloudflare OS as AI operating system, Phoronix, August 5, 2026
- The workerd open source Workers runtime
Frequently asked questions
Is Cloudflare OS an operating system?
No, and Cloudflare says so directly in the announcement. There is no kernel, no scheduler for hardware, nothing you would boot. The word is being used the way people use it when they say a company runs on a particular tool: it is the layer where work happens, where apps live, and where access to internal systems is mediated. Cloudflare frames it two ways in the same post, as an operating system for a company to be productive with AI and as an operating system for AI workloads. Both are analogies. If the naming irritates you, ignore it and read the architecture instead, because the architecture is doing real work.
What licence is it under, and can I actually self host it?
Apache 2.0, which is permissive enough to fork, modify and run commercially without asking anyone. Self hosting has two levels. The straightforward path is deploying into your own Cloudflare account using the cloudflare-os-starter template, where you supply your own Access policies, your own AI Gateway configuration and your own integrations. The more independent path is the one the README mentions almost in passing: the stack is built on workerd, Cloudflare's open source Workers runtime, so it can run on your own servers. That second path is not the documented happy route, and you should expect to do work, but it exists and it is the difference between open source and a source available demo.
What are Durable Object Facets and why do they matter here?
A Durable Object is a single addressable stateful object with its own storage, and a Facet is a way to spin up many of them cheaply under one namespace. Cloudflare OS uses that so every app instance a user creates gets its own object with its own SQLite database rather than sharing a multi tenant table. Practically this means isolation is the default shape of the system rather than a policy applied on top. When you build a slide deck or a small internal tool inside it, the code and the data are yours alone, and revoking or deleting them is deleting an object rather than filtering rows. It is a good pattern to steal even if you never touch this codebase.
Why is outbound networking disabled on the server side?
Because the server code being executed was written by an agent, and the sane default for code you did not review is that it cannot phone anywhere. Cloudflare runs that code in Dynamic Workers with outbound networking off, so anything the code needs from the outside has to come through an explicit, mediated path rather than an arbitrary fetch. Client code runs in sandboxed browser frames for the same reason. This is the part of the design most worth copying if you are building anything that executes model generated code inside your own systems, and it costs you very little to adopt early compared to retrofitting it later.
Is it ready to use in production?
Cloudflare is candid that it is not finished. The published repository is version two, a full rewrite based on what they learned from the first attempt, and the project describes itself as capable but still carrying plenty of rough edges. Thousands of Cloudflare employees using it daily is a real signal about whether the core works, but it is also a signal about a company that can absorb friction in its own tooling. Our read is that this is worth reading, worth deploying in a sandbox account, and not worth putting between your staff and their actual work this month.