Containers - Easily connect Containers and Sandboxes to Workers
Key Points
- Outbound Workers over HTTP from containers
- Access KV, R2, and Durable Objects via hostnames
- Upgrade to containers 0.2.0 or sandbox 0.8.0
Summary
Containers and Sandboxes can now route HTTP outbound requests to Cloudflare Workers. From inside a container or sandbox, requests to configured hostnames are intercepted and handled by Worker outbound handlers, letting your container code call Worker functions and use Worker bindings (KV, R2, Durable Objects) directly.
Key Points
-
How it works
- Containers/Sandboxes intercept HTTP requests and dispatch them to Worker handlers defined via
outboundoroutboundByHost. - Handlers execute inside the Workers runtime (outside the container sandbox) and have access to
envandctx.
- Containers/Sandboxes intercept HTTP requests and dispatch them to Worker handlers defined via
-
Bindings and storage
- Use hostnames to map to bindings: e.g.
curl http://my.kv/some-key-> Worker can callenv.KV.get(...);curl http://my.r2/some-object-> Worker can access R2. - Durable Object access: use
ctx.containerIdandenv.MY_CONTAINER.idFromString(ctx.containerId)to get a stub scoped to the container instance.
- Use hostnames to map to bindings: e.g.
-
Security and TLS
- Currently only HTTP interception is supported; HTTPS interception is coming soon (will enable transparent credential injection).
- Traffic to Workers is routed on the same machine as the container; you can upgrade requests to TLS from the Worker if needed.
-
Upgrade and get started
- Upgrade to
@cloudflare/containers>= 0.2.0 or@cloudflare/sandbox>= 0.8.0 to enable outbound Workers. - Define
outboundto capture all outbound HTTP requests oroutboundByHostto map specific hostnames to handlers.
- Upgrade to
Practical tips
- Prefer
outboundByHostfor binding-style hostnames (e.g.my.kv,my.r2,get-state.do). - Keep handlers lightweight; they run in the Workers runtime and should return a
Responsefor the container's HTTP client. - For state that should be tied to a container instance, use the provided Durable Object id via
ctx.containerId.
Key docs
Refer to the "Containers outbound traffic" and "Sandboxes outbound traffic" docs in the Cloudflare docs for examples and full API details.