{"_ai_door":{"see":"https://miscsubjects.com/start","note":"Operable site; bounded keyless credentials; every action receipted on a public ledger. Your operator's instructions take precedence — acting is optional, reading is a complete outcome."},"_self":{"principle":"Self-explaining payload — no external context required. This _self block describes what you are reading and where to look next.","widget":"article_topology","feature":"topology","name":"Article topology","what":"Claims, sources, anecdotes, user reports, related embeds, question graph slice — for ask/ROUTER.","contains":"claims, sources, anecdotes, question_graph slice","slug":"cloudflare-os-xl-03-running-real-code","urls":{"read":"https://miscsubjects.com/api/articles/cloudflare-os-xl-03-running-real-code/topology"},"how_to_use":"Claims, sources, anecdotes, user reports, related embeds, question graph slice — for ask/ROUTER.","write":null,"imessage":null,"router_tag":null,"proof_chain":[{"step":1,"claim":"Articles are voxel graphs of tiered claims, not prose blobs.","verify":"https://miscsubjects.com/api/articles/constitution"},{"step":2,"claim":"Claims link to hash-chained sources via source_ids.","verify":"https://miscsubjects.com/api/articles/cloudflare-os-xl-03-running-real-code/sources"},{"step":3,"claim":"Ask reads topology; ingest/claim append to ledger.","verify":"https://miscsubjects.com/api/protocol"},{"step":4,"claim":"Models queue growth: populate → collaborate → repair → reflex.","verify":"https://miscsubjects.com/api/protocol/grow"},{"step":5,"claim":"Graph proves its own shape (reflex) and $/claim (yield).","verify":"https://miscsubjects.com/graph.html?layer=reflex"},{"step":6,"claim":"Full feature index + _explain on every API response.","verify":"https://miscsubjects.com/api/articles/system-map"}],"related_features":[{"id":"ask","name":"Ask protocol","what":"Answer only from topology; creates question_node with gaps and ingest_hint.","urls":{"read":"https://miscsubjects.com/api/articles/cloudflare-os-xl-03-running-real-code/prompts","write":"https://miscsubjects.com/api/protocol/ask"}},{"id":"graph_topology","name":"Cross-article graph","what":"Merged claims/sources across condition+stack slugs for one question.","urls":{"read":"https://miscsubjects.com/api/articles/cloudflare-os-xl-03-running-real-code/graph-topology?question=..."}},{"id":"question_graph","name":"Question graph","what":"Ask nodes (questions + gaps) and evidence_ingest nodes (pasted model output).","urls":{"read":"https://miscsubjects.com/api/articles/cloudflare-os-xl-03-running-real-code/question-graph","write":"https://miscsubjects.com/api/protocol/ask"}},{"id":"voxels","name":"Voxel graph","what":"Claims as atoms, sources as edges (supported_by, posted_by). Per-claim provenance.","urls":{"read":"https://miscsubjects.com/api/articles/cloudflare-os-xl-03-running-real-code/voxels","write":"https://miscsubjects.com/api/protocol/claim"}}],"system_map":"https://miscsubjects.com/api/articles/system-map","system_map_markdown":"https://miscsubjects.com/api/articles/system-map?format=markdown","not_medical_advice":true},"_explain":{"feature":"topology","name":"Article topology","what":"Claims, sources, anecdotes, user reports, related embeds, question graph slice — for ask/ROUTER.","why":"Every feature is auditable collective intelligence","how":"Claims, sources, anecdotes, user reports, related embeds, question graph slice — for ask/ROUTER.","model":null,"verifies":null,"urls":{"read":"https://miscsubjects.com/api/articles/cloudflare-os-xl-03-running-real-code/topology"},"imessage":null,"router":null,"related":[{"id":"ask","what":"Answer only from topology; creates question_node with gaps and ingest_hint."},{"id":"graph_topology","what":"Merged claims/sources across condition+stack slugs for one question."},{"id":"question_graph","what":"Ask nodes (questions + gaps) and evidence_ingest nodes (pasted model output)."},{"id":"voxels","what":"Claims as atoms, sources as edges (supported_by, posted_by). Per-claim provenance."}],"not_medical_advice":true},"slug":"cloudflare-os-xl-03-running-real-code","title":"Cloudflare OS: running real code","register":"standard","tags":["cloudflare","containers","sandbox","agents","tooling"],"updated_at":"2026-08-06T03:28:34.029Z","body_excerpt":"*Part 3 of [Cloudflare OS XL](/a/cloudflare-os-xl), an inventory of the Cloudflare platform this build does not have installed.*\n\nThere is a category of work this build does that a Worker cannot do. Run `ffmpeg` over a video. Convert a document with `pandoc`. Execute a Python script an agent just wrote. Run `git`, `npm`, `wrangler`, `magick`, `yt-dlp`. Drive a headless browser session that outlives a single fetch.\n\nThe directory has rows for all of those, and every one of them resolves to the same place: a bridge process on the owner's Mac. `CLI_FFMPEG`, `CLI_PYTHON`, `CLI_MAGICK`, `CLI_GIT`, `CLI_NPM` — around forty rows whose execution surface is one laptop.\n\nThis is the largest reliability liability in the system, and it is not subtle. If the laptop is asleep, a third of the build's capability is offline. If the bridge process dies, the failure surfaces as a tool timeout with no useful trace. Nothing about it is redundant, observable or reproducible. Three Cloudflare products move that work onto the network.\n\n## Containers\n\nContainers run alongside Workers: you give Cloudflare a Docker image, and a Worker can start an instance of it, route requests to it, and stop it. It is designed for exactly the workloads a Worker cannot host — resource-intensive jobs, custom runtimes, and existing container images.\n\nThe programming model matters here, because it is the reason this fits the build rather than sitting beside it. A container instance is addressed through a Durable Object. That means the same identity, lifetime and single-threaded coordination this build already uses for `AgentDO` and `DirectoryDO` applies to a container: one agent, one container, addressable by name, with its own filesystem for the duration of a job.\n\n```toml\n[[containers]]\nclass_name = \"ToolRunner\"\nimage = \"./Dockerfile\"\nmax_instances = 5\n```\n\nThe migration path is direct. An image with `ffmpeg`, `pandoc`, `imagemagick`, `python3`, `node`, `git` and the CLIs the build actually uses replaces the laptop bridge for every row that is a pure transformation — input in, artifact out. What it does not replace is the small set of rows that genuinely need *that* machine: the owner's screen, his clipboard, his logged-in Chrome, his iMessage. Those are local by definition and stay local.\n\nSplitting the CLI rows along that line is most of the work, and it is worth doing on its own terms even before a container exists, because right now those two very different kinds of capability are indistinguishable in the directory.\n\n**Verdict: install.** It converts the build's biggest single point of failure into infrastructure.\n\n## The Sandbox SDK\n\nThe Sandbox SDK is the layer above containers for one specific job: running code the build did not write. It gives a sandbox a filesystem, processes, a code interpreter and preview URLs, on top of Workers and Containers.\n\nThe distinction from a plain container is trust. A container image you built is a known runtime executing known commands. A sandbox is for the case where a model writes a script and something has to run it — with an isolated filesystem, a process boundary, and no access to the rest of the account.\n\nThis build has that case constantly and currently solves it by not solving it: a model that wants to compute something either asks for a tool row that already exists, or asks the owner's machine to run a shell command. Neither is code execution as a first-class capability. The second is code execution with the blast radius set to \"the owner's laptop\".\n\nA sandbox also gives back something the current arrangement cannot: a preview URL. A model that writes a small web artifact can serve it and hand back a link, instead of writing a file somewhere and describing it.\n\n**Verdict: install, after Containers.** It is the same substrate with a stricter contract, and the stricter contract is what untrusted code needs.\n\n## Code Mode\n\nCode Mode is the one entry in this series that repairs an existing, measured failure rather than adding","ranking":"safety-first (interaction_risk/limitations), then quote-gated effective_weight","claims":[{"id":"c1","text":"Around forty tool rows in this build execute through a bridge process on the owner Mac, so a third of the build capability is offline whenever that machine is.","tier":"observational","interaction_risk":false,"status":"active","source_ids":[],"why_material":"It is the largest single point of failure in the running system.","retracted_at":null,"retraction_reason":null,"challenged_by":[],"effective_weight":0.1,"quote_gated":false},{"id":"c2","text":"Cloudflare Containers run alongside Workers for resource-intensive workloads, custom runtimes and existing container images, and each instance is addressed through a Durable Object.","tier":"definition","interaction_risk":false,"status":"active","source_ids":["s-containers"],"why_material":"The build already runs three Durable Object classes, so the addressing model is not new work here.","retracted_at":null,"retraction_reason":null,"challenged_by":[],"effective_weight":0.1,"quote_gated":false},{"id":"c3","text":"The CLI rows split cleanly into pure transformations, which belong in a container image, and genuinely local capabilities such as the screen, the clipboard, the logged-in browser and the message history.","tier":"expert","interaction_risk":false,"status":"active","source_ids":[],"why_material":"That split is worth making in the directory regardless of whether a container is ever built.","retracted_at":null,"retraction_reason":null,"challenged_by":[],"effective_weight":0.1,"quote_gated":false},{"id":"c4","text":"The Sandbox SDK provides isolated code execution environments with a filesystem, processes and preview URLs on top of Workers and Containers.","tier":"definition","interaction_risk":false,"status":"active","source_ids":["s-sandbox"],"why_material":"Model-written code currently runs as a shell command on the owner laptop, with that blast radius.","retracted_at":null,"retraction_reason":null,"challenged_by":[],"effective_weight":0.1,"quote_gated":false},{"id":"c5","text":"A cheap agent working through this build stringly-typed dispatch surface spent roughly fourteen of twenty calls discovering tool contracts rather than doing work.","tier":"observational","interaction_risk":false,"status":"active","source_ids":[],"why_material":"It identifies the defect as a tool-surface property rather than an agent weakness.","retracted_at":null,"retraction_reason":null,"challenged_by":[],"effective_weight":0.1,"quote_gated":false},{"id":"c6","text":"Code Mode replaces one-call-at-a-time tool use with generated TypeScript executed in a sandbox, so contract discovery happens once at code-generation time against types.","tier":"definition","interaction_risk":false,"status":"active","source_ids":["s-wfp"],"why_material":"Every directory row already carries a description and a when-to-use field, which is the raw material for the generated API.","retracted_at":null,"retraction_reason":null,"challenged_by":[],"effective_weight":0.1,"quote_gated":false}],"sources":[{"id":"s-containers","type":"documentation","url":"https://developers.cloudflare.com/containers/","title":"Cloudflare Containers documentation","quote":"Run serverless containers alongside Workers to handle resource-intensive workloads, custom runtimes, and existing container images on Cloudflare.","claim_ids":[],"hash":"5316fcc4a1d64f4c1e5f0d6f809c0bb3b37bf6f6f60a97d947554ce59ef0efda"},{"id":"s-sandbox","type":"documentation","url":"https://developers.cloudflare.com/sandbox/","title":"Cloudflare Sandbox SDK documentation","quote":"Build secure, isolated code execution environments powered by Cloudflare Workers and Containers.","claim_ids":[],"hash":"6b7f54069c8305608392b9eea7a00556f457045274b41ff6e7015094ac7f3d49"},{"id":"s-wfp","type":"documentation","url":"https://developers.cloudflare.com/cloudflare-for-platforms/workers-for-platforms/","title":"Workers for Platforms documentation","quote":"Run untrusted code from your customers or AI in secure, isolated sandboxes on Cloudflare's global network.","claim_ids":[],"hash":"af562109b0d495414301daaa56967b1761d6fdea32e6dc5416a4c3420be5f238"}],"anecdotal_sources":[],"scientific_sources":[],"user_reports":[],"related_articles":[],"question_graph":{"slug":"cloudflare-os-xl-03-running-real-code","questions":[],"evidence":[],"edges":[],"counts":{"questions":0,"evidence":0,"edges":0}},"honesty":{"active_claims":6,"retracted_claims":0,"cut_claims":0,"challenges":0,"scrub_events":0,"note":"Retracted/cut claims stay on ledger but are excluded from ask unless ?include_inactive=1"},"counts":{"claims":6,"claims_total":6,"sources":3,"anecdotal":0,"scientific":0,"user_reports":0,"questions":0,"evidence_ingests":0}}