The 2.5 MB client keeps inbound ports closed
Our 2.5 MB checkout contains the daemon that carries requests from Cloudflare's network to an origin through an outbound connection. A web server can stay off the public internet while Cloudflare handles the public hostname. That is the central reason to use cloudflared: firewall exposure shrinks, and the tunnel connects directly to the provider already serving DNS and edge traffic. The trade is equally direct. Reachability now depends on the local daemon, Cloudflare's control plane, and Cloudflare's network.
The repository had 463 files and about 71,824 source lines at commit 274888e, so this is more than a thin port-forwarding wrapper. The same client can reach protected Layer 4 origins for SSH or RDP, although the README points ordinary private-network users toward WARP instead of requiring a cloudflared command on every client. Public web routing, private routing, Access authentication, protocol negotiation, metrics, and service installation all live in this codebase. Operators should decide which of those roles they need before copying a broad configuration.
A 91-second build is easier than configuring the route
The source build passed in 91 seconds in our unprivileged Debian container. Current project instructions call for Go 1.26 or newer, GNU Make, and Cap'n Proto, then use make cloudflared. Most users can skip that toolchain because Cloudflare publishes standalone binaries, Debian and RPM packages, a Homebrew formula, Windows downloads, and a Docker image. The latest GitHub release, 2026.8.2, was published on August 14, 2026, with checksums for its downloadable artifacts.
Our install phase took 38 seconds and added 0 system packages in the supplied Go image. Running a named public tunnel still takes account work outside the binary: add a site to Cloudflare, point its nameservers there, authenticate the connector, and route a hostname to the origin. The README says private routing can avoid the website requirement. Quick Tunnels also provide a trial without first adding a site, which is useful for evaluation but should not be mistaken for the named production setup.
What happened when we ran it
Our sandbox installed cloudflared in 38 seconds, built it in 91 seconds, and then failed the test step after 53 seconds. Go reported 94 passed and 3 failed out of 97. Those figures come from commit 274888e in a fresh container with 3 CPUs, 8 GB of RAM, no secrets, and no elevated privileges. The checkout occupied 2.5 MB before the build and contained roughly 71,824 lines of source.
The supplied log tail names successful packages such as sshgen, stream, supervisor, tlsconfig, token, tracing, and websocket, then ends with FAIL. It does not show the names or error messages for the 3 failed tests, so assigning a cause would be guesswork. The useful result is narrower: install and compilation worked in the stated environment, while the complete Go test command did not pass. Our scan also found 2 CI workflow files and a Dockerfile, with no top-level tests directory.
Open protocol reports deserve a production trial
The 53-second failed suite is one reason to test the exact network path instead of treating a successful compile as deployment proof. Open issue 1609 says Quick Tunnels defaulted to QUIC rather than automatic protocol selection in version 2026.3.0; an open pull request proposes restoring automatic choice so HTTP/2 can be used where UDP is blocked. A separate August report from Azure Container Apps describes established QUIC connections timing out and reconnecting while the container itself remained healthy. That report does not establish whether Azure, QUIC, configuration, or cloudflared caused the interruptions.
Monitoring also needs calibration around long-lived streams. Issue 1726 reports that a normal HTTP/2 cancellation with error code 0 can appear at error level when a user closes a browser tab running server-sent events or live logs. On a repository with 94 passing tests in our run, one open report should not define the whole client. It can still create false incidents if an alert fires on every error line. Test reconnect behavior, streaming requests, and alert rules under the protocol your firewall permits.
August activity is current, while old agents lose support
GitHub recorded a push on August 28, 2026, two weeks after release 2026.8.2. The repository had 15,442 stars and 537 combined issues and pull requests when fetched. Recent reports and proposed fixes were receiving updates in the same month, which is better health evidence than the release tag alone. The large combined queue includes pull requests as well as issue reports. Operators can search it for platform-specific reports before settling on a deployment pattern.
Cloudflare's README says versions older than one year from the newest release can receive breaking changes and are outside the supported window. That policy turns upgrades into routine operations rather than an optional cleanup task. For an existing Cloudflare customer, the 38-second install and successful 91-second build make cloudflared easy to trial, and outbound-only origin access solves a concrete firewall problem. Teams seeking control over the relay should compare frp or zrok before putting a production hostname behind this client.