Deep Dive

Five Rust-level memory optimizations to the DNS cache layout of Big Pineapple cut per-entry memory by 56%, freeing approximately 100 TB of memory across Cloudflare's fleet.

Sebastiaan Neuteboom

This post explores the performance of BPF LPM tries, a critical data structure used for IP matching.

Matt Fleming and Jesper Brouer

There's no way to audit a site’s client-side code as it changes, making it hard to trust sites that use cryptography. We preview a specification we co-authored that adds auditability to the web.

Michael Rosenberg

84 million requests a second means even rare bugs appear often. We'll reveal how we discovered a race condition in the Go arm64 compiler and got it fixed.

Thea Heinen

We’ve replaced the original core system in Cloudflare with a new modular Rust-based proxy, replacing NGINX.

Richard Boulton, Steve Goldsmith, Maurizio Abba, and Matthew Bullock

R2 SQL provides a built-in, serverless way to run ad-hoc analytic queries against your R2 Data Catalog. This post dives deep under the Iceberg into how we built this distributed engine.

Yevgen Safronov, Nikita Lapkov, and Jérôme Schneider

D1, Cloudflare’s managed SQL database, announces read replication beta. Here's a deep dive of the read replication implementation and how your queries can remain consistent across all regions.

Justin Mazzola Paluska and Lambros Petrou

Hyperdrive, Cloudflare's global connection pooler, relies on some key innovations to make your database connections work. Let's dive deeper, in celebration of its availability for Free Plan customers.

Andrew Repp and Matt Alonso

Yarn tests fail consistently at the 27-second mark. The usual suspects are swiftly eliminated. A deep dive is taken to comb through traces, only to be derailed into an unexpected crash investigation.

Yew Leong

The Linux kernel can produce a hung task warning. Searching the Internet and the kernel docs, you can find a brief explanation that the process is stuck in the uninterruptible state.

Oxana Kharitonova and Jesper Brouer

Here we explain how we made our data pipeline scale to 700 million events per second while becoming more resilient than ever before. We share some math behind the approach and some of the designs.

Constantin Pan and Jim Hawkridge

Multi-Path TCP (MPTCP) leverages multiple network interfaces, like Wi-Fi and cellular, to provide seamless mobility for more reliable connectivity. While promising, MPTCP is still in its early stages,

Marek Majkowski

Hyperdrive (Cloudflare’s globally distributed SQL connection pooler and cache) recently added support for directing database traffic from Workers across Cloudflare Tunnels.

Andrew Repp, Emilio Assunção, and Abhishek Chanda

In this post we will describe how we use anomaly detection to watch for novel DDoS attacks. We’ll provide an overview of how we build models which flag unusual traffic and keep our customers safe.

Nick Wood and Manish Arora

Cloudflare's Vectorize is now generally available, offering faster responses, lower pricing, a free tier, and supporting up to 5 million vectors.

Jérôme Schneider and Alex Graham

Let’s Encrypt’s cross-signed chain will be expiring in September. This will affect legacy devices with outdated trust stores (Android versions 7.1.1 or older). To prevent this change from impacting customers, Cloudflare will shift Let’s Encrypt certificates upon renewal to use a different CA

Dina Kozlov

This post illustrates some of the Linux Kernel features, which are helping us to keep our production systems more secure. We will deep dive into how they work and why you may consider enabling them as well

Ignat Korchagin

This is our story of what we learned about the connect() implementation for TCP in Linux. Both its strong and weak points. How connect() latency changes under pressure, and how to open connection so that the syscall latency is deterministic and time-bound

Frederick Lawler