Runtime

Cluster functions run in V8 isolates — lightweight sandboxes using the same JavaScript engine as Chrome. Each function gets its own isolate with a full set of Web APIs.

Available APIs

HTTP

Encoding

Crypto

Streams

Globals

V8 Version

The runtime uses V8 146.9.0 with:

• Full ES2024 support
• ICU 77 for internationalization (Intl.* APIs)
• WebAssembly support

Limitations

• No Node.js APIs — no fs, path, os, child_process, net, http, Buffer
• No require() — use ES module import/export (the bundler handles modules for you)
• No eval() by default — enable with --allow-code-generation in dev, not available in production
• 30-second timeout — requests that exceed 30 seconds are terminated
• No persistent state — isolates may be recycled between requests. Use external services for state
• fetch() reaches public hosts only — requests to internal or private destinations are blocked at connect time and reject with fetch blocked: destination is an internal/private address. This covers loopback, private ranges (RFC1918, CGNAT), link-local including the cloud metadata endpoint (169.254.169.254), and other reserved/internal addresses, for both IP literals and hostnames that resolve (or redirect) to them.

Example: Crypto

export async function handler(request: Request): Promise<Response> {
  const body = await request.text();
  const encoded = new TextEncoder().encode(body);
  const hash = await crypto.subtle.digest("SHA-256", encoded);
  const hex = [...new Uint8Array(hash)]
    .map(b => b.toString(16).padStart(2, "0"))
    .join("");
  return Response.json({ sha256: hex });
}

Example: Streaming

export function handler(request: Request): Response {
  const stream = new ReadableStream({
    start(controller) {
      controller.enqueue(new TextEncoder().encode("Hello "));
      controller.enqueue(new TextEncoder().encode("World!"));
      controller.close();
    },
  });
  return new Response(stream);
}