Cloudflare / 00
Cloudflare,
in pieces.
Cloudflare runs a network between visitors and websites, and a set of building blocks for running whole applications on it. Each chapter of this guide is an instrument: you send the request, change the data, or break the consumer, and watch which piece answers.
Illustration Send it again
The first request looks the hostname up, misses the cache, reads photo A from the R2 bucket, and leaves a copy in the cache. The second reuses the DNS answer and is answered by the cache; the bucket is not read. Change the photo in the bucket to B and the cache still answers A, a stale copy, until you purge it. The next request then reads B.
- DNS lookup, before HTTP
- Request or response
- Stale copy
- Path length and timing show dependency, not distance or speed
The chapters
Four instruments, one at a time
Browse the 13 services
Select a block to read its job, its unit, and its limits. The lines show which blocks a selected one works with, not where they sit or the order a request takes.
Conceptual map · A binding is a configured capability: it gives a Worker access to one specific resource.
- DNS · Route and protect
- DNS turns a hostname into an address. For a proxied record, it returns Cloudflare addresses so web traffic reaches Cloudflare’s network. DNS-only records send traffic to the origin directly; using Cloudflare DNS alone does not proxy a website. Documentation
- Security · Route and protect
- Cloudflare’s network provides DDoS protection. The web application firewall (WAF) applies rules to HTTP traffic, allowing, blocking, or challenging requests. Your application still needs its own authentication and permission checks. Available security features depend on configuration and plan. Documentation
- CDN cache · Route and protect
- A content delivery network (CDN) can keep reusable responses near visitors. An eligible cache hit avoids fetching the content from its source again. A cache can expire or evict data. It is not your permanent storage, and personalized responses need careful cache rules. Documentation
- Static Assets · Route and protect
- Workers Static Assets serves deployed HTML, CSS, JavaScript, and other site files from Cloudflare’s network. These are files shipped with a deployment. Use object storage for application uploads that change independently. Documentation
- Workers · Run your code
- A Worker runs your code when a request or another event arrives. It can check permissions, call services, and create a response. Do not keep mutable state in global variables: it is neither shared nor durable. Store important data in a storage service. Documentation
- R2 · Keep your data
- R2 holds objects: file bytes plus metadata, addressed by a key in a bucket. Think photos, videos, documents, and exports. Object storage does not query rows like a database. A cached copy on a custom domain can stay stale until its TTL ends or it is purged; the bucket itself is not stale. Documentation
- Workers KV · Keep your data
- KV stores values by key and caches reads around the network. It suits configuration and other data read often but changed less often. Do not use KV alone to coordinate a live counter, reserve a last seat, or require an immediately fresh read after a write. Documentation
- D1 · Keep your data
- D1 is a managed relational database with SQLite SQL semantics. Tables, indexes, and queries let you work with structured records. D1 answers data queries. Coordinating an active room and its connections is a separate application responsibility. Documentation
- Durable Objects · Keep your data
- A Durable Object combines code with strongly consistent storage. Requests for the same object identity reach the same logical coordinator. Each object exists once, not as a copy in every location. Its in-memory state can be discarded at any time; its storage survives. Documentation
- Queues · Do more work
- A producer sends a message. A consumer processes it later, so the original request does not have to wait for that work to finish. A queue does not run your business logic by itself. A consumer does the work; message order is not guaranteed. Documentation
- Workflows · Do more work
- Workflows runs a multi-step process with persisted progress. Steps can retry, and the process can wait for time or an external event. External side effects still need to be safe to retry. Use Queues to hand off messages; use Workflows to manage a process’s progress. Documentation
- Workers AI · Do more work
- Workers AI runs supported machine-learning models on Cloudflare-managed GPUs. Your code sends input and receives model output. Model output can be wrong. Your application decides how to validate, store, and use it. Documentation
- Vectorize · Do more work
- Vectorize indexes numerical vectors, often embeddings of text or images, and retrieves nearby vectors for similarity search. Vectorize searches vectors; an embedding model creates them. It does not generate an answer or replace your source documents. Documentation
A real example: this site’s gallery
Wild Lives, the photography gallery on this site, runs on Cloudflare and uses two of the answers in the instrument above. Its own Worker code never touches a photograph.
- Pages from Static Assets. The gallery’s HTML, scripts and styles are deployed files. A request for a gallery page matches a file, so the asset layer answers it and no Worker code runs.
-
Photographs from R2, on their own hostname. Image
bytes come from
assets.mingyangjin.info, a custom domain in front of a public R2 bucket. The site’s Worker has no binding to that bucket. - The Worker for what matches nothing. A request that matches no file reaches the Worker, which redirects a few short addresses and answers the rest with a 404 page.
Sources and limits
Cloudflare pages used on this page
- Proxy status : a proxied record answers with Cloudflare anycast addresses, before any HTTP.
- Cache : a fresh cached response is served without fetching it from its source.
- R2 consistency and public buckets : after an overwrite, a response cached on a custom domain keeps serving the old object until its TTL ends or it is purged.
- Static Assets and bindings , for the gallery example. Each service on the map links its own documentation.
Documented, illustrated, and observed
- Documented: DNS before HTTP and the reused answer, a cache hit that skips the bucket, and the stale cached copy after an overwrite.
-
Illustration:
img.example.com,/heron.jpg, photos A and B (drawn, not photographed), the compartments, and every count in the instrument. - This site: how the gallery is served comes from this site’s own configuration on the review date.
Left out on purpose
- Pricing, latency, throughput, capacity, and size limits. None appear in this guide, and no path length or animation time stands for one.
- How long a DNS answer or a cached response is kept, which depends on configuration. The instrument keeps both until you act.
- Most of Cloudflare’s catalog, including Pages, Tunnel, Hyperdrive, and Zero Trust.