Building the Supercloud: How Cloudflare Thinks About Infrastructure at Global Scale

How would you summarise what Cloudflare actually is today?

I say to people in general that Cloudflare is probably the biggest internet company you've never heard of. We handle, we think, about twenty percent of the web. One in five websites uses our service for protection against hackers, DDoS attacks, and acceleration. But we don't just do that side of things — we also have a developer platform and a whole world of what's called zero trust, which is how employees work on the internet and log into the resources they need.

The important thing to understand is that we have a very large global network — hardware in data centres in 300 cities, in 112 different countries. The idea of Cloudflare is to be as close to the end user as we can, because that allows us to fight against delays caused by the speed of light. As fast as the speed of light is, it turns out it actually slows us down when we're browsing the internet. It's just not quite fast enough for what we'd like to do. And the only way to fight it is to be close to end users.

Cloudflare started as a security play. How did it become a platform company?

Security was really the genesis of it. It was obvious that every website was going to need some amount of security because there were just more and more bad actors. But the immediate problem was that Cloudflare is an intermediary — if you go to a website that Cloudflare is providing security for, you come to Cloudflare first, and then we go to the real website. So it immediately became obvious that we also needed to do performance, to do CDN and caching, because otherwise there would be this big performance hit just to go through our service.

So right at the beginning, performance and security needed to go hand in hand. Then over time, customers pushed us to provide code-based customizability. No configuration language is as flexible as a programming language, so inevitably customers wanted to do things that couldn't be done in the UI or the API. And then we just began to see more and more opportunity to run code on our large network close to the end user. Workers is now six years old and it's a pretty rich platform.

You've written about the culture of rewriting things at Cloudflare. Why is that important?

If you're in a company that's growing very, very rapidly, it's hard to know what the correct architecture is from the beginning. You can write stuff that gets something running, get it out there, get feedback from the market, and iterate. You'll inevitably get the wrong architecture for some parts of it. For example, we had architected our DNS to work really well for millions of domains, with each domain having a small number of subdomains. Then WP Engine came along — they have a separate subdomain for every customer, so a single domain with potentially millions of subdomains. Everything fell over.

The important thing is less the architecture and more the culture — are you willing to rewrite stuff? Are you willing to change languages? We've rewritten our DNS infrastructure more than once. When we did, there was some questioning in the company about why we hadn't got it right the first time. I actually wrote an email to the whole company about the culture of rewriting and why it's so important. Replace the wings on the aircraft while in flight — that's the skill that has benefited us most.

What is the "supercloud" concept and how does it differ from edge computing?

Edge computing says the right answer to where code should run is close to the end user. That's an okay answer if you're optimizing for latency to the user. But most bits of code don't just talk to the end user — they also talk to databases, call other APIs on the internet. So the optimal placement of a piece of code might not be the edge at all. It might actually be quicker to have the code run with a long latency from the user if it has to make multiple backend calls to things that are far from the user.

The supercloud concept is about the whole network working cooperatively to figure out where stuff should be. And there might be regulatory reasons — code may need to run at a certain location even for performance reasons. We might have someone in Lisbon whose app uses a database in the US. It might actually make more sense for the code to run in the US. Someone in London — maybe not. So we could have multiple copies of the same code running. That is no longer edge computing. That's about the whole network working in a cooperative manner.

Why did Cloudflare build R2 as a direct competitor to Amazon S3?

Because we have a view of the traffic flowing through our network, we saw that a lot of customers were serving content from Amazon S3 through Cloudflare. They were using Cloudflare as a cache in front of S3. And the reason they were doing that was that S3 egress was so expensive. We looked at it and said, it's insane that Amazon and others are charging so much when you take your data out. That egress pricing model just seemed wrong.

So we launched R2 with zero egress fees. We're not really trying to be an Amazon competitor in the broad sense — we don't feel like we're competing across the board. But inevitably there's overlap, and it's particularly around storage. The reason we decided to do it was that we saw customer behavior telling us something was broken in the market, and we could fix it.

What is Cloudflare's approach to AI and machine learning on the workers platform?

Machine learning has been part of Cloudflare for a long time — we do about 46 million HTTP requests per second, and figuring out whether a request is a human user or a threat can't be done with anything other than machine learning. But what's clear from the excitement around LLMs is that machine learning functionality will become something every app is expected to have. Whether it's visible or not.

We launched a product called Constellation, which is a way for you to run AI models on our platform in Cloudflare Workers. You can go to Hugging Face, get some model you want, and we will run it for you. We're investing heavily in the ability to run models on CPUs, and there's a whole bunch of experimentation going on with GPUs within our network. The idea is that AI and machine learning become first-class citizens on Cloudflare Workers, in the same way that we have database functionality or queues or email.

Why did Cloudflare acquire an email security company and move into the email space?

So many threats come through email. We had been a customer of Area 1, the company we bought, and it was so much better than everything else that we ended up buying them and deciding that email was an integral part of the platform. Email is a technology that refuses to die. You'd think that SMS or WhatsApp or other things would replace it, but the asynchronous nature of email and the fact that everybody has an email address that can be reached has made it a very valuable way to communicate.

I always tell people: do you have a good password on your email? Be honest with yourself. If I can break into your email, I can control everything. I can change every password you have. I can read everything about your life. Because the email is such an important rendezvous point for everything — if someone got your email, they could go and change the password on any service you've ever used. Email is just too vital. So Cloudflare felt we really needed to be there.