Cloudflare Workers Now Support Inbound TCP and gRPC
Cloudflare Workers have expanded their capabilities to accept inbound TCP connections, moving beyond their original HTTP-only limitation. This enhancement enables full-duplex communication and supports various TCP-based protocols, with gRPC being the first to leverage this new feature. The change significantly broadens the types of workloads that can be handled at the edge, offering new architectural possibilities for message brokers, database proxies, and custom binary protocols.
Read original on InfoQ ArchitectureExpanding Edge Functionality with Inbound TCP
Cloudflare Workers, initially limited to serving HTTP, can now accept inbound TCP connections via a new `connect(socket)` handler. This is a significant architectural shift, enabling Workers to act as ingress points for non-HTTP traffic. This capability is routed through Cloudflare's Spectrum, their existing proxy for non-HTTP protocols, allowing for more diverse applications at the network edge.
gRPC Support and Implementation Details
With inbound TCP, gRPC is the first protocol to be built on top. Workers can now serve unary and server-streaming gRPC. However, due to web platform API constraints (specifically, the lack of HTTP/2 stream-level control in `fetch()`), bidirectional gRPC streaming is not natively supported within Workers directly. Instead, Cloudflare uses a translation mechanism: incoming gRPC is converted to gRPC-web, and outgoing gRPC-web is converted back to gRPC. This allows existing gRPC clients (like mobile apps using `grpc-swift` or `grpc-kotlin`) to connect without changes.
Architectural Impact
The ability to handle raw TCP sockets at the edge allows for new distributed system designs. Workers can now terminate arbitrary TCP connections, enabling them to route or process traffic for protocols like message brokers, database proxies, and custom binary protocols directly at Cloudflare's global network edge. This positioning is analogous to an API gateway but applied to raw sockets, offering a powerful control point for connection-level logic and policy enforcement.
Socket Handover and Full-Duplex Communication
The architecture allows for sophisticated routing: a Worker can accept an inbound socket, process it, and then hand it off to another Worker or, crucially, to a Durable Object. From a Durable Object, the socket can further be passed to a Container (e.g., a customer's VM or Docker container) via `getTcpPort()`. This enables full-duplex communication paths, allowing unmodified backend servers (like Go gRPC or Python socket servers) to run behind Cloudflare Workers.
export default {
async connect(socket): Promise<void> {
const writer = socket.writable.getWriter();
await writer.write(new TextEncoder().encode("Hello, world!\n"));
await writer.close();
},
} satisfies ExportedHandler;This feature significantly extends the utility of Cloudflare Workers, transforming them from HTTP-centric edge functions into versatile network proxies and application frontends capable of handling a much broader array of distributed system protocols and communication patterns directly at the edge.