Cloudflare Computer: Agents Need Isolates, Not Just Containers

Cloudflare’s Agents Week opener is not “we have containers now.” It is “stop pretending every agent needs a full Linux box.”

On August 3, 2026, Matt Carey and Aron Carroll introduced an early preview of @cloudflare/computer — an agent runtime where each agent gets a computer: a durable filesystem plus execution backends that the platform (and the model) route between fast isolates and full Linux containers. The pitch is blunt: container-per-agent does not scale to the concurrent agent counts product teams are already designing for, and the industry’s CPU panic is as real as its GPU panic.

This is Day 1 of Cloudflare Agents Week. explainx.ai’s read: the abstraction is the story — not another sandbox SKU.

Update — August 7, 2026: The repo has shipped a third backend since launch — isolate JavaScript, running ECMAScript modules directly in a Dynamic Worker alongside the original container and isolate-shell backends — plus a monorepo package breakdown, filesystem performance benchmarks, and a firm "no unsolicited PRs" contribution policy. Details below.

TL;DR

The industry shift Cloudflare is naming

Six months ago the default pattern was: spin a container, put the agent inside it. That collapses brain and hands into one heavy process. Recent harnesses (Vercel eve, coding agents, YC QM-style loops) increasingly treat the sandbox as a tool the agent calls — filesystem + shell — while the agent loop runs elsewhere.

Cloudflare’s claim is the economic one:

Across all the clouds, all the hyperscalers, there’s nowhere near enough compute in the world for every company to give each of their users’ agents their own containerized compute environment.

If that is even half right, “Mac Mini farm for every user agent” and “always-on VPS per session” are transitional hacks, not end states. Isolates — the bet behind Workers and Durable Objects — hibernate, start in milliseconds, and store agent state without billing a full guest OS while the model thinks.

Last year Cloudflare already let isolates attach container sandboxes as tools. @cloudflare/computer is the next step: stop making every customer hand-roll isolate↔container glue in userspace.

What @cloudflare/computer actually is

Multiple backends can register under stable IDs on the same Workspace, and workspace.runtime.exec(source, { backend }) is the single execution entry point across all of them — the selected backend decides whether source is a shell command or an ECMAScript module. Backends connect lazily on first use.

The model chooses backends from tool descriptions. Cloudflare says frontier models are already good at preferring the cheap isolate path and falling back to containers when they need npm, native binaries, or a real $PATH.

That is the product bet in one sentence: agents as schedulers over heterogeneous compute, with one shared disk.

How you use it (builder sketch)

Install:

npm install @cloudflare/computer

Minimal mental model — attach a workspace to an agent class (Cloudflare’s triage example uses @cloudflare/think + Workers AI / GLM):

import { Think } from "@cloudflare/think";
import { Workspace } from "@cloudflare/computer";
import { createWorkersAI } from "workers-ai-provider";

export class Agent extends Think {
  override workspaceBash = false;

  override workspace = new Workspace({
    storage: this.ctx.storage,
    useThink: true, // soon will not be needed
  });

  override getModel() {
    return createWorkersAI({ binding: this.env.AI })("@cf/zai-org/glm-5.2");
  }

  override getSystemPrompt() {
    return `You are a bug triage agent. Use /workspace/repo…`;
  }
}

Wire a container when you need Linux:

import {
  CloudflareContainerBackend,
  withWorkspaceContainer,
} from "@cloudflare/computer/backends/container";

export class Agent extends withWorkspaceContainer(Think) {
  override workspace = new Workspace({
    storage: this.ctx.storage,
    useThink: true,
    backends: [
      new CloudflareContainerBackend({
        container: () => this,
        workspace: {
          binding: "Agent",
          id: this.ctx.id.toString(),
        },
      }),
    ],
  });
}

Expose tools so the loop can exec with a backend argument — and prepare the tree yourself before prompting:

await this.workspace.fs.writeFile("/workspace/BUG_REPORT.md", body);
await this.workspace.git.clone({ url: report.repoUrl, dir: "/workspace/repo" });

Full tutorials and examples live in the computer repo (examples/think, examples/tutorial, worker vs container demos).

How it works under the hood

┌───────────────────────────────────────────────────────┐
│ Durable Object (agent harness / Think)                │
│  ┌───────────────────────────────────────────────┐    │
│  │ Workspace (SQLite virtual FS)                 │    │
│  └───────────────┬─────────────┬─────────────────┘    │
│          ┌───────┴───┐   ┌─────┴──────┐   ┌────────┐  │
│          ▼           ▼   ▼            ▼   ▼        │  │
│   Isolate/just-bash   Isolate/JS    Container+FUSE  │  │
│   (cheap, fast)       (Dynamic Wkr) (full Linux)    │  │
└───────────────────────────────────────────────────────┘

• Isolate shell path: shell commands become JS; no guest OS; FS is the DO's store.
• Isolate JavaScript path: an ECMAScript module runs in its own Dynamic Worker with structured I/O and durable relative imports — for agent-authored code that needs more than shell commands but not a full container.
• Container path: computerd mounts the workspace over FUSE; RPC (capnweb) keeps the sandbox honest about the same tree.
• Workspace API: direct FS ops plus a node:fs-compatible wrapper for third-party JS libs.
• Custom backends: same exec(string, options) interface if Cloudflare's three are not enough.

For teams already on Durable Objects for agent state, this is a filesystem + runtime productization of a pattern many were assembling by hand.

What's inside the monorepo

The public repo is a small monorepo, and each package ships its own README with package-specific status:

Recent commits show the isolate backends were renamed for clarity — worker examples split into examples/worker-shell (just-bash) and examples/worker-javascript (the ECMAScript-module backend) — alongside two new examples: examples/artifacts (generates a Worker project and publishes it to Cloudflare Artifacts as a clone-ready repo) and examples/assets (turns a prompt into a Workers AI image, writes it to the workspace, and returns a shareable link via @cloudflare/computer/assets).

Performance: FUSE vs real disk

Cloudflare has since published filesystem benchmarks in docs/19_performance.md. The headline result: computerd's FUSE mount beats a real disk on metadata-heavy work (lots of small file operations — the pattern most coding-agent workloads produce) and trails real disk on large sequential I/O (bulk reads/writes of big files). The doc also includes a head-to-head npm install comparison against cloudflare/sandbox-sdk and instructions to reproduce the numbers yourself — worth running against your own workload mix before trusting isolate-first routing blind.

Cloudflare Computer vs Vercel eve (and friends)

Neither replaces OpenCode-style coding agents on your laptop. Both attack the hosted multi-tenant agent problem: how do you give millions of sessions a “computer” without millions of always-on VMs?

Related workspace metaphors on explainx.ai: HolaBoss / HolaOS, Odysseus self-hosted workspace.

What Day 1 of Agents Week also shipped nearby

Ashley Peacock’s rundown and Cloudflare’s related posts the same day include:

• Workers & Containers inbound TCP + gRPC — agents talking protocols beyond HTTP fetch.
• Billable Usage API — programmatic cost visibility (critical once isolate↔container routing is automatic).
• Running Kimi & GLM at scale on Cloudflare’s edge AI path — the Computer triage sample already points at GLM via Workers AI.

Treat Computer as the execution primitive announcement; the rest of the week is how that cloud becomes an “agent cloud” (access, ADLC, payments, discovery).

What builders should do this week

1. If you already ship agents on Durable Objects — try the preview Workspace and measure what fraction of exec calls hit the container backend. Cloudflare’s <10% goal is your acceptance test.
2. If you bill per container-minute — model isolate-first routing before you buy more VPS/Mac Mini capacity for “one agent = one box.”
3. If you use eve / OpenCode / custom harnesses — compare sandbox adapter interfaces; the industry is converging on brain ≠ hands.
4. Gate and audit — Computer’s gated FS ops are the right instinct after a summer of eval agents escaping harnesses. Shared FS + container still needs egress allowlists and tool policy.
5. Expect API churn — early preview; useThink: true comments already telegraph cleanup.

Cloudflare Computer trial checklist
□ npm install @cloudflare/computer
□ Workspace on a DO with isolate-only first
□ Add CloudflareContainerBackend for npm/native tasks
□ Log backend chosen per exec (isolate vs container %)
□ Confirm FUSE sync + audit trail for writes
□ Pair with Billable Usage API once live
□ Re-read AGENTS.md in github.com/cloudflare/computer

Honest limitations

• Preview only, by Cloudflare's own labeling — the README states plainly it's "suitable for experiments, exploration and prototypes. It is NOT suitable for production use at this time." Packaging, Think flags, and backend APIs may still move.
• Cloudflare’s <10% container target is a goal, not a customer SLA.
• Isolate/just-bash is not a full Linux userland — agents that assume Debian will still need containers. The new isolate-JavaScript backend is also not a container substitute — it runs a single ECMAScript module, not arbitrary native binaries.
• Cost of Containers + FUSE sync is not free; isolate-first only wins if your task mix cooperates, and the new performance doc shows real disk still wins on large sequential I/O.
• You cannot send Cloudflare a pull request. The project's own CONTRIBUTING.md is explicit: bug reports, fix proposals, feature requests, and design proposals go through issues and discussions — unsolicited PRs are not accepted. Only approved collaborators (per COLLABORATORS.md) merge code.
• Security: shared workspace + agent exec still needs your product’s authz, egress, and secrets rules — the library helps observe; it does not replace IR after a rogue agent-class failure.
• Not a drop-in for every non-Workers stack without porting the DO / binding model.

Closing

@cloudflare/computer is Cloudflare productizing the only agent-scale thesis that does not assume infinite VMs: give every agent a durable filesystem and a menu of runtimes, default to isolates, escalate to containers when the model (or your tool descriptions) says it must. That is bigger than a container announcement — it is an argument about how the next billion concurrent agents can exist at all.

Try the preview, measure your container ratio, and follow the rest of Agents Week for TCP/gRPC, usage APIs, and model hosting that sit on the same bet.

Follow @explainx_ai as Cloudflare ships the rest of the week.

Update — August 7, 2026: Cloudflare shipped a browser to match this runtime philosophy — Kitesurf runs a Rust/Wasm browser engine inside these same V8 isolates, trading wall-clock speed for 3-7x less memory and CPU than headless Chromium.

Related on explainx.ai

• Mistral's "code implemented tool calls" patent, explained — the sandboxed pause-and-resume execution pattern this runtime already implements is also the subject of a newly granted US patent, with prior art dating back to 2024
• Cloudflare Kitesurf — agent-first browser in V8 isolates (Aug 6) — same Agents Week, browsing built on the same isolate model
• Cloudflare OS — open-source agent workspace, Gatekeepers, Gadgets (Aug 5) — Agents Week product on top of this runtime
• Microsoft Orchard — Kubernetes-native sandbox for agent RL training
• Cloudflare Wallets: programmable payments for AI agents (Aug 4) — same Agents Week, the payments layer next to this runtime
• Vercel eve — Next.js for agents
• YC QM open-source multi-agent harness
• OpenCode coding agent guide
• Cloudflare Drop instant deploy
• Cloudflare temporary accounts for AI agents
• HolaBoss agent environment workspaces
• OpenAI rogue agent / sandbox containment

Sources

• Cloudflare Blog — Your agent needs a computer, not a container (Aug 3, 2026)
• Welcome to Agents Week
• github.com/cloudflare/computer
• npm — @cloudflare/computer
• just-bash (Vercel Labs)

Specs and APIs reflect Cloudflare’s August 3, 2026 early-preview announcement and public repo docs. Re-check the blog and package README before production commitment — Agents Week previews move quickly.