The local products post (order 6) of the Sandbox Series. How OpenCode, Codex CLI, Cursor and other CLI agents and IDEs set up local sandboxes, where the isolation boundary lies, common pitfalls, and security best practices.
Browser Run gives Workers access to Cloudflare-managed headless Chrome. Quick Actions fit one-shot tasks such as screenshots, PDFs, HTML, JSON, and crawls; Browser Sessions fit Puppeteer, Playwright, CDP, and Stagehand automation where you need full control.
Cloudflare Cache Rules are zone-level cache policy: request expressions decide what is eligible for cache, how Edge TTL and Browser TTL behave, what dimensions enter the cache key, and how stale content, ETags, and purge interact. Use them for CDN cache policy; use the Worker Cache API for programmatic caching.
Cloudflare Containers let a Workers app call on-demand serverless containers for workloads that need a full filesystem, a specific runtime, existing container images, or more CPU, memory, and disk. They do not replace Workers; Workers still handle entry, routing, and platform bindings while containers run the heavy runtime-specific work.
The Cloudflare Edge Platform series answers one product question: how do Workers, D1, KV, R2, Durable Objects, Queues, Workflows, Cache, Images, Email, Turnstile, Observability, Browser Run, and Containers help you run a website or app cheaply and reliably?
Before a Cloudflare app goes live, do not stop at a successful deploy. Check Custom Domains, Routes, www/root redirects, maintenance pages, CPU/memory/subrequest limits, log sampling, and fallback paths. This appendix turns the Edge Platform series into a production checklist.
Cloudflare Email Service connects transactional email, magic links, notifications, and inbound routing to Workers. Arbitrary outbound sending currently requires Workers Paid; inbound routing is available on Free and Paid, with DNS, quota, message-size, bounce, and anti-spam limits still shaping the design.
Hyperdrive solves the latency and connection-pooling problem when Workers connect to existing Postgres / MySQL databases. It uses edge connection setup, database-near pooling, and read query caching so a regional database works better with global Workers.
Cloudflare Images has two paths: transform images stored in R2/S3/origin at the edge, or store images in Images and deliver named variants. The first is priced by unique transformations; the second also involves stored and delivered images.
Workers Observability is for debugging and request tracing; Workers Analytics Engine is for high-cardinality product events and custom metrics; GraphQL Analytics API is for querying existing Cloudflare product data. Keeping those roles separate prevents logs from becoming a database and keeps billing, monitoring, and product analytics from blending together.
Smart Shield is Cloudflare's origin protection bundle: Smart Tiered Cache, connection reuse, Argo Smart Routing, Regional Tiered Cache, Cache Reserve, Health Checks, and Dedicated CDN Egress IPs reduce requests and connections reaching your origin.
Turnstile is Cloudflare's CAPTCHA alternative: the client widget generates a token, and the server must validate it with the Siteverify API. Tokens expire after 300 seconds and are single-use; a widget without server validation is incomplete.
Cloudflare Workflows turns multi-step Workers processes into durable steps: each step can retry, sleep, wait for events, and register rollbacks, while instances can be inspected, paused, resumed, or terminated. Queues fit single-step background work; Workflows fit long processes that must remember progress.
A sandbox is not a single package but a spectrum—Namespace, cgroups, seccomp, gVisor, and Firecracker stacked by trust boundary; local OS sandboxes bound blast radius, cloud microVMs bound multi-tenancy, and the choice hinges on trust and ops cost.
Three kinds of relationship you see when the seven weeks are put side by side: an idea that returns in later weeks (the Markov chain from Week 2 is used again in Weeks 4 and 6; the linear combination of weights from Week 4 becomes Week 5's unit); an earlier week's tool that a later week depends on; and the lectures teaching one method, saying where it falls short, and moving to the next. Includes three cross-week examples and four cross-week self-check questions.
The twelve projects side by side: which functions each has you write, which lecture section it uses, and what example the spec page gives you to check against; which projects share a method (enumeration, search, Markov chains, learning from data) and which need something the lectures do not teach. Includes three worked examples and five self-check questions. The course gives no difficulty ratings or hour estimates, and neither does this post.
Week 1 is about getting a program to derive new facts from known ones: propositional symbols and five connectives turn knowledge into sentences; model checking enumerates all 2^n truth assignments to decide whether the knowledge base entails a query; inference rules and resolution work on the sentences directly, converting to CNF and deriving the empty clause by contradiction; first-order logic cuts the number of symbols with constants, predicates and quantifiers. With time links for every section, plus the approach, common mistakes and self-checks for the Knights and Minesweeper projects (reference implementations folded away).
Week 2 is about probability: conditional probability and Bayes' rule turn evidence into probabilities; a Bayesian network uses arrows to split a joint probability into one conditional probability table per node, inference by enumeration is exact but slow, and rejection sampling and likelihood weighting approximate it with samples; a Markov chain describes a state that changes over time with a transition model, and a hidden Markov model adds a sensor model to work back from observations to states you cannot see. With time links for every section, plus the approach and checks for the Heredity and PageRank projects.
Week 3 covers three ways to write an optimization problem. Local search keeps a single state: hill climbing moves to a better neighbor and gets stuck at local optima, and simulated annealing accepts a worse move with probability e^(ΔE/T). Linear programming writes the problem as a linear cost function plus linear constraints and hands it to an existing solver. Constraint satisfaction problems shrink domains with node consistency and arc consistency (AC-3), then find a solution with backtracking search guided by the MRV, degree and least-constraining-value heuristics. Includes per-section time links, plus the approach, pseudocode, pitfalls and checks for the Crossword project (the reference implementation is folded at the end).
Week 4 covers three forms of machine learning. Supervised learning fits a hypothesis function to labeled data: classify by the k nearest neighbors, or draw a decision boundary with a set of weights (perceptron learning rule, logistic regression, support vector machines), then use loss functions, regularization and cross-validation against overfitting. Reinforcement learning uses Q-learning to update the estimated value of each state and action from rewards, with ε-greedy keeping some probability of random exploration. Unsupervised learning clusters with k-means. With time links for every section, plus the approach and ways to check your work for the Shopping and Nim projects.