One durable workspace can use three execution backends
Cloudflare Computer puts authoritative filesystem state in a SQLite-backed Durable Object. workspace.fs provides familiar asynchronous file operations, while workspace.runtime.exec() routes work to a selected backend. A full Linux container runs real binaries against a FUSE projection. A Worker shell uses just-bash inside a Dynamic Worker. A Worker JavaScript backend evaluates an ECMAScript module with structured input and access to the same workspace. The application can register several backends and choose one per execution.
The shared filesystem is the interesting part. An agent can write a plan through the host API, search it in the Worker shell, then use a container for a binary that the isolate cannot provide. Files persist across Durable Object restarts. The package also supplies agent-facing read, list, find, grep, write, edit, delete, and optional execution tools. An opt-in Git client operates directly on the virtual filesystem without requiring a shell backend.
The project explicitly limits this to prototypes
The main README and package guide both label Cloudflare Computer preview-only. APIs are unstable, the design may change, and production use is ruled out. The specification under docs/ is also described as forward-looking intent rather than a record of current behavior. Those statements matter more than the breadth of examples. This is a place to learn whether the workspace model fits an agent, not a dependency to bury under a stable internal platform contract.
Workspace limits reinforce that experimental scope. The package documents about 10 GB per workspace, shared with the Durable Object. The container-side filesystem is held in memory. FUSE can do well on metadata-heavy tasks but trails native disk for large sequential I/O, package installations, and tar extraction. Agent notes, generated code, and small repositories fit the intended shape. A large monorepo with a large node_modules directory does not.
What happened when we ran it
Our sandbox installed 752 packages in 133 seconds, leaving 1,145 MB on disk. The build completed in 46 seconds. At commit de87919, the repository contained 622 files, roughly 165,081 lines of source, and a 7.2 MB checkout. The installed size is the more relevant contributor cost because this is a Node monorepo with several runtimes and examples.
The test command exited 1 after 141 seconds, while the harness parsed 543 passing tests and zero failed tests. The supplied tail showed a Vitest package completing 34 test files and 121 tests, all passing in 5.66 seconds. It did not include the command-level failure that produced exit 1. We can report the mismatch, but we cannot honestly assign it to coverage, teardown, another task, or the sandbox without the missing output.
npm audit found 9 known vulnerabilities: 7 high and 2 moderate, with no critical or low findings. The repository has four CI workflow files and monorepo workspaces. A production project would need to trace those advisories to reachable packages and features. For a preview trial, they still belong in the experiment record, especially if execution, publishing, or network access is enabled.
The Worker shell has the shortest path and the most flags
A filesystem-only setup requires nodejs_compat, a Durable Object binding, and a SQLite migration. The Worker shell and Worker JavaScript backends add the experimental compatibility flag and a Loader binding. Open issue 105, filed against 0.2.0, reports that the documented shell quick start also needed enable_ctx_exports plus an exported proxy class. The latest release is 0.2.1, but the report remained open when reviewed, so verify the current package rather than assuming the example or issue is definitive.
The shell imports command groups individually, such as curl, Python, jq, yq, and SQLite, allowing the bundler to omit unused groups. Issue 106 reports that the 0.2.0 tarball referenced a sqlite worker file without shipping its module content. Again, that is a version-specific open report, not proof about every command in 0.2.1. It is evidence that each selected feature should get a clean-install acceptance test.
The three backends also carry different trust boundaries. Worker shell network calls use the Dynamic Worker's outbound policy. A container has a real Linux userland and network. JavaScript execution receives configured libraries and trusted workspace modules. Backend descriptions help the model choose where to run code, but natural-language descriptions are not security controls. The application must constrain egress, available commands, publication tools, and credentials independently.
Stub disposal and storage cleanup are application concerns
Long-lived sessions must dispose values returned by getWorkspace() and execution handles. The RPC layer does not automatically collect remote stubs, so repeated undisposed handles accumulate until the session ends. The guide documents using and includes debugging support. That is good documentation, though it asks every application author to get a low-level lifecycle rule right.
Recent open issues also ask for reachable garbage collection and pruning acknowledged tombstones so storage tables do not grow indefinitely. The repository was pushed on August 25, 2026, and release 0.2.1 arrived on August 17. Its 17 open issues and pull requests include active filesystem, performance, and runtime work. The pace suits a preview. It does not create production stability ahead of the project's own declaration.
Prototype the workspace model, not a production promise
Cloudflare Computer is compelling when a team already uses Workers and wants durable agent state without choosing one execution environment forever. The same file tree across host calls, isolates, and containers is easier to reason about than copying artifacts between separate sandboxes. The AI SDK tools, Git client, R2 mounts, and publishing helpers make the prototype useful quickly.
Stop at the prototype boundary. Measure the chosen backend, test every imported command from a clean package, set explicit egress rules, and exercise disposal and storage cleanup. If the experiment proves the model, wait for Cloudflare's production guidance or isolate the preview behind a replaceable adapter. The repository is honest about its status, and adopters should be equally honest with their own users.