Workerd is Cloudflare's open-source JavaScript and WebAssembly runtime that powers Cloudflare Workers, written in C++ and built on the V8 engine. The project serves three primary use cases: as an application server for self-hosting code designed for Cloudflare Workers, as a local development tool for testing such code, and as a programmable HTTP proxy capable of intercepting, modifying, and routing network requests in both forward and reverse configurations.
The runtime is built around several core design principles that distinguish it from other serverless platforms. It prioritizes server-first architecture rather than CLI or GUI interfaces, relies on web platform standards like the fetch API for built-in functionality, and introduces the concept of nanoservices that function as decoupled, independently-deployable components while maintaining the performance characteristics of local function calls. The homogeneous deployment model allows all nanoservices to run on every machine in a cluster, simplifying load balancing. Workerd uses capability-based bindings for configuration rather than global namespaces, making code more composable and resistant to SSRF attacks. A notable feature is its commitment to backwards compatibility through compatibility dates, allowing developers to pin their workers to past API versions and ensuring that upgrading workerd will never break existing JavaScript code.
The repository shows active development and maintenance patterns.
Building workerd requires Bazel as the build system, with support for Linux, macOS, and Windows platforms. On Linux, the project requires clang 19 or higher with libc++ and LLD. macOS builds need Xcode 16.3, while Windows builds require App Installer and LLVM. The project provides prebuilt binaries distributed through npm, accessible via npx workerd, with system requirements including glibc 2.35 or higher on Linux and macOS 13.5 or higher on macOS.
Configuration uses Cap'n Proto text format, allowing developers to define workers, services, and HTTP bindings declaratively. The project includes comprehensive documentation through inline comments in workerd.capnp and a library of sample configuration files. Integration with Wrangler, Cloudflare's official CLI tool, enables local development workflows where developers can run wrangler dev to test workers locally using workerd.
The documentation explicitly warns that workerd is not a hardened sandbox on its own and should not be used to run untrusted code without additional isolation mechanisms like virtual machines. Cloudflare's hosted Workers service employs multiple layers of defense-in-depth beyond what workerd provides. The project maintains a bug bounty program through HackerOne for security researchers to report vulnerabilities.
