Cloudflare Edge Computing Architecture

Cloudflare announces the same IP addresses from all 300+ PoPs simultaneously using anycast BGP. The internet routing protocol automatically directs each user's packets to the topologically closest Cloudflare datacenter — no DNS-based routing or client-side logic needed. This means a DDoS attack absorbs across hundreds of PoPs simultaneously, and every user gets sub-20ms latency to a Cloudflare node.

A Docker container starts a new OS process with 100ms+ cold start and its own memory space. A V8 isolate starts inside an existing V8 process in under 1ms — it gets an isolated JavaScript heap but shares the V8 JIT compiler, garbage collector, and bytecode cache. Cloudflare runs thousands of isolates per physical machine, each for a different customer Worker, with cryptographic isolation between them. This density is impossible with containers.

Workers KV replicates key-value data to all 300+ PoPs with eventual consistency. Reads are always served locally (sub-1ms), but writes propagate within 60 seconds globally. This makes KV ideal for configuration data, feature flags, and user sessions where stale reads are acceptable. The model is similar to a CDN cache: high read performance, eventual write propagation.

Durable Objects solve KV's consistency limitations: each Durable Object is a stateful actor with a unique ID, guaranteed to run in exactly one location worldwide. All requests to a Durable Object are serialized — enabling collaborative features, rate limiting counters, and WebSocket connection management with strong consistency. The object migrates automatically if its region becomes unhealthy.

A request to a Worker: DNS resolves to anycast IP, nearest PoP receives packet, TLS terminates with 1-RTT (0-RTT resumption for returning visitors), Worker isolate starts in under 1ms if warm or under 5ms cold, JavaScript executes, response returned. Total latency overhead versus serving a static file is about 5ms. This makes Workers viable for auth tokens, HTML rewriting, and API proxying that traditionally required origin round trips.