Cloudflare Wants Your AI Agent to Live at the Edge, Not a Mac Mini

The current wave of computer-using agents has a hardware problem. Projects tracked in curated lists like trycua/acu now treat “computer use” as a formal taxonomy: agents that reason about tasks, plan sequences of actions, and act via clicks, keystrokes, and API calls. Microsoft has shipped a Copilot Studio tool that lets agents automate Windows desktop and web apps through a Computer-Using Agent model combining vision with reasoning. Open-source experiments such as the screenpipe agent demonstrate autonomous Gmail-to-Dropbox invoice workflows running directly on a laptop. All of them share the same assumption: the agent needs a real computer to drive—buttons to click, a browser to manipulate, a filesystem to litter with intermediate files.

That assumption has sent developers scrambling for headless Mac minis, SSH tunnels over Tailscale, and remote-desktop hacks to watch autonomous workflows stall on a permissions dialog at 3 a.m. Astropad’s chronicle of the unattended-agent lifecycle—check progress, review logs, realize a system dialog blocked everything—has become a familiar genre, so much so that Mac mini shipments reportedly grew by double digits in 2025, driven by agent use cases. A survey of remote coding tooling catalogs the resulting improvisation: tmux plus Mosh for the DIY crowd, browser-based terminal proxies, voice-first iOS interfaces, and funded platforms running parallel agents in isolated worktrees. Cloudflare Computer, a preview repository that surfaced quietly in the company’s GitHub org, proposes a different substrate entirely: skip the physical machine, and give the agent a virtual filesystem that lives inside a database at the edge.

At its center is a Durable Object—not a VM, not a container, but Cloudflare’s edge-located, single-threaded coordination primitive—running SQLite as the authoritative store. The filesystem is not an afterthought mounted into compute; it is the primary entity. Compute is a pluggable projection. A Workspace registers one or more backends under stable identifiers, and workspace.runtime.exec(source, { backend }) serves as the single execution entry point. The backend decides whether source is a shell command or an ECMAScript module, and connections materialize lazily on first use. The workspace can even exist with no backend at all, offering callers a durable filesystem on its own. This inverts the usual cloud pattern. Typically you provision a container, attach a volume, and hope the two stay in sync. Here the volume is the source of truth in a transactional database, and the container is merely one of several possible views.

Three backends ship today, and their mechanics reveal the architecture’s flexibility. The Container backend projects the SQLite state into a sandbox container as a genuine FUSE mount. A daemon called computerd runs inside the sandbox, mounting the workspace over the network via a capnweb RPC channel and syncing changes back to the Durable Object. The result is a full Linux userland with real binaries and real network access, but the storage authority remains upstream in the edge database. For lighter work, the Isolate shell backend runs just-bash inside a Dynamic Worker, reaching the authoritative workspace over Workers RPC. Because there is no secondary store and no sync round trip, the shell operates directly against the source of truth. The Isolate JavaScript backend pushes this further: it evaluates an ECMAScript module in a fresh Dynamic Worker with structured input and results, durable relative imports, and a workspace-backed implementation of node:fs/promises. Trusted modules such as ws:git and ws:artifacts give the agent scoped access to version control and publishing primitives without escaping the sandbox.

The isolate backends are arguably the more radical departure. Cloudflare’s Dynamic Workers are ephemeral V8 isolates that start cold in milliseconds. Running just-bash or a JavaScript module inside one means every agent invocation gets a fresh process with no residual state, yet the workspace persists in the Durable Object. The JavaScript backend in particular is carefully sandboxed: it receives structured input, returns structured results, and imports durable relative paths from the workspace itself. Even node:fs/promises is backed by the Durable Object’s SQLite store, not a local ephemeral disk. This is not a container with a warm pool of reused instances; it is closer to a database trigger that happens to speak Linux and ECMAScript.

The monorepo structure reinforces that this is platform plumbing, not a single demo. The @cloudflare/dofs package provides the SQLite-backed virtual filesystem and sync protocol building blocks. @cloudflare/computer-rpc handles the capnweb wire types shared between the Durable Object and the container-side daemon. @cloudflare/computerd is the FUSE mount and RPC server that lives inside the sandbox, while @cloudflare/computer is the top-level package consumed by Durable Objects. A separate package distributes a prebuilt computerd binary for linux-x64. The layering suggests Cloudflare intends this to be a composable substrate that other services can adopt, much like Workers AI or R2.

Performance numbers in the repository’s docs/19_performance.md suggest the trade-offs are predictable. The FUSE mount outperforms real disk on metadata-heavy workloads—exactly the kind of churn agents produce when writing logs, node_modules trees, or temporary artifacts—and trails on large sequential I/O. For agent workloads that spend most of their time spawning processes and writing small files, the profile is favorable, though the document cautions that these are early benchmarks.

The examples directory makes the target audience explicit. A think chat agent uses the workspace as its working directory, reachable from a terminal. A think-compare-runtimes web UI runs the same agent task against both the container and worker backends side by side, effectively treating execution surface as a variable rather than a fixed asset. One tutorial builds an endpoint where an agent writes a markdown recipe card and then runs pandoc inside the container backend to produce a PDF—demonstrating the hand-off between generative text and binary execution. Another example generates a Worker project in a workspace and publishes it to Cloudflare Artifacts as a clone-ready repo. A separate assets example turns a prompt into an image via Workers AI, writes it to the workspace, and returns a shareable link. These are not human remote-desktop scenarios; they are autonomous workflows that need durable state, arbitrary execution, and network access without managing a persistent server.

That composability matters because the agent ecosystem is fragmenting across access patterns. Some developers want to talk to their agents via Discord or Telegram; others want voice interfaces while walking the dog. Some run parallel agents in isolated worktrees through polished macOS apps. Cloudflare Computer does not compete with those interfaces. It competes with the underlying assumption that every agent needs a long-lived Linux host. By offering a filesystem that outlives any single execution, and runtimes that connect to it on demand, it turns the agent’s “computer” into a serverless primitive.

The README is unambiguous about maturity. The package is preview-only, APIs are unstable, and the design is subject to change. The specification documents under docs/ are forward-looking, describing intent rather than implementation. It is explicitly not suitable for production. That caution is warranted, because the architecture is ambitious. FUSE-over-RPC from inside a sandbox to a Durable Object is a nontrivial stack, and the performance edge on metadata operations may not hold for every workload. The project also does not address the visual GUI-automation layer that Microsoft, Anthropic, and OpenAI are pursuing; there is no screen to scrape here, only a filesystem and a process boundary. If your agent must visually navigate a desktop, this is the wrong tool.

If the preview stabilizes, the implications are material. Cloudflare is betting that agent workloads do not need a Mac mini under a desk, or even a traditional cloud VM, but rather a persistent SQLite-backed workspace with pluggable, serverless execution surfaces. The Durable Object becomes the computer. That model collapses the distance between storage and compute: a shell command, a Node.js module, and a Linux binary can all operate on the same bytes without a single sync step or volume mount. Whether developers trust a preview filesystem-as-database to host their unattended agents remains an open question. But the direction is clear. The industry is busy giving agents mice and keyboards; Cloudflare is trying to give them a kernel.