|
| 1 | +--- |
| 2 | +pcx_content_type: configuration |
| 3 | +title: Dynamic Worker Loaders |
| 4 | +head: [] |
| 5 | +description: The Dynamic Worker Loader API, which allows dynamically spawning isolates that run arbitrary code. |
| 6 | + |
| 7 | +--- |
| 8 | + |
| 9 | +import { |
| 10 | + Type, |
| 11 | + MetaInfo, |
| 12 | + WranglerConfig |
| 13 | +} from "~/components"; |
| 14 | + |
| 15 | +:::note[Dynamic Worker Loading is in closed beta] |
| 16 | + |
| 17 | +The Worker Loader API is available in local development with Wrangler and workerd. But, to use it in production, you must [sign up for the closed beta](https://forms.gle/MoeDxE9wNiqdf8ri9). |
| 18 | + |
| 19 | +::: |
| 20 | + |
| 21 | +A Worker Loader binding allows you to load additional Workers containing arbitrary code at runtime. |
| 22 | + |
| 23 | +An isolate is like a lightweight container. [The Workers platform uses isolates instead of containers or VMs](/workers/reference/how-workers-works/), so every Worker runs in an isolate already. But, a Worker Loader binding allows your Worker to create additional isolates that load arbitrary code on-demand. |
| 24 | + |
| 25 | +Isolates are much cheaper than containers. You can start an isolate in milliseconds, and it's fine to start one just to run a snippet of code and immediately throw away. There's no need to worry about pooling isolates or trying to reuse already-warm isolates, as you would need to do with containers. |
| 26 | + |
| 27 | +Worker Loaders also enable **sandboxing** of code, meaning that you can strictly limit what the code is allowed to do. In particular: |
| 28 | +* You can arrange to intercept or simply block all network requests made by the Worker within. |
| 29 | +* You can supply the sandboxed Worker with custom bindings to represent specific resources which it should be allowed to access. |
| 30 | + |
| 31 | +With proper sandboxing configured, you can safely run code you do not trust in a dynamic isolate. |
| 32 | + |
| 33 | +A Worker Loader is a binding with just one method, `get()`, which loads an isolate. Example usage: |
| 34 | + |
| 35 | +```js |
| 36 | +let id = "foo"; |
| 37 | + |
| 38 | +// Get the isolate with the given ID, creating it if no such isolate exists yet. |
| 39 | +let worker = env.LOADER.get(id, async () => { |
| 40 | + // If the isolate does not already exist, this callback is invoked to fetch |
| 41 | + // the isolate's Worker code. |
| 42 | + |
| 43 | + return { |
| 44 | + compatibilityDate: "2025-06-01", |
| 45 | + |
| 46 | + // Specify the worker's code (module files). |
| 47 | + mainModule: "foo.js", |
| 48 | + modules: { |
| 49 | + "foo.js": |
| 50 | + "export default {\n" + |
| 51 | + " fetch(req, env, ctx) { return new Response('Hello'); }\n" + |
| 52 | + "}\n", |
| 53 | + }, |
| 54 | + |
| 55 | + // Specify the dynamic Worker's environment (`env`). This is specified |
| 56 | + // as a JavaScript object, exactly as you want it to appear to the |
| 57 | + // child Worker. It can contain basic serializable types as well as |
| 58 | + // Service Bindings (see below). |
| 59 | + env: { |
| 60 | + SOME_ENV_VAR: 123 |
| 61 | + }, |
| 62 | + |
| 63 | + // To block the worker from talking to the internet using `fetch()` or |
| 64 | + // `connect()`, set `globalOutbound` to `null`. You can also set this |
| 65 | + // to any service binding, to have calls be intercepted and redirected |
| 66 | + // to that binding. |
| 67 | + globalOutbound: null, |
| 68 | + }; |
| 69 | +}); |
| 70 | + |
| 71 | +// Now you can get the Worker's entrypoint and send requests to it. |
| 72 | +let defaultEntrypoint = worker.getEntrypoint(); |
| 73 | +await defaultEntrypoint.fetch("http://example.com"); |
| 74 | + |
| 75 | +// You can get non-default entrypoints as well, and specify the |
| 76 | +// `ctx.props` value to be delivered to the entrypoint. |
| 77 | +let someEntrypoint = worker.getEntrypoint("SomeEntrypointClass", { |
| 78 | + props: {someProp: 123} |
| 79 | +}); |
| 80 | +``` |
| 81 | + |
| 82 | +## Configuration |
| 83 | + |
| 84 | +To add a dynamic worker loader binding to your worker, add it to your Wrangler config like so: |
| 85 | + |
| 86 | +<WranglerConfig> |
| 87 | + |
| 88 | +```toml |
| 89 | +[[worker_loaders]] |
| 90 | +binding = "LOADER" |
| 91 | +``` |
| 92 | + |
| 93 | +</WranglerConfig> |
| 94 | + |
| 95 | +## API Reference |
| 96 | + |
| 97 | +### `get` |
| 98 | + |
| 99 | +<code>get(id <Type text="string" />, getCodeCallback <Type text="() => Promise<WorkerCode>" />): <Type text="WorkerStub" /></code> |
| 100 | + |
| 101 | +Loads a Worker with the given ID, returning a `WorkerStub` which may be used to invoke the Worker. |
| 102 | + |
| 103 | +As a convenience, the loader implements caching of isolates. When a new ID is seen the first time, a new isolate is loaded. But, the isolate may be kept warm in memory for a while. If later invocations of the loader request the same ID, the existing isolate may be returned again, rather than create a new one. But there is no guarantee: a later call with the same ID may instead start a new isolate from scratch. |
| 104 | + |
| 105 | +Whenever the system determines it needs to start a new isolate, and it does not already have a copy of the code cached, it will invoke `codeCallback` to get the Worker's code. This is an async callback, so the application can load the code from remote storage if desired. The callback returns a `WorkerCode` object (described below). |
| 106 | + |
| 107 | +Because of the caching, you should ensure that the callback always returns exactly the same content, when called for the same ID. If anything about the content changes, you must use a new ID. But if the content hasn't changed, it's best to reuse the same ID in order to take advantage of caching. If the `WorkerCode` is different every time, you can pass a random ID. |
| 108 | + |
| 109 | +You could, for example, use IDs of the form `<worker-name>:<version-number>`, where the version number increments every time the code changes. Or, you could compute IDs based on a hash of the code and config, so that any change results in a new ID. |
| 110 | + |
| 111 | +`get()` returns a `WorkerStub`, which can be used to send requests to the loaded Worker. Note that the stub is returned synchronously—you do not have to await it. If the Worker is not loaded yet, requests made to the stub will wait for the Worker to load before being delivered. If loading fails, the request will throw an exception. |
| 112 | + |
| 113 | +It is never guaranteed that two requests will go to the same isolate. Even if you use the same `WorkerStub` to make multiple requests, they could execute in different isolates. The callback passed to `loader.get()` could be called any number of times (although it is unusual for it to be called more than once). |
| 114 | + |
| 115 | +### `WorkerCode` |
| 116 | + |
| 117 | +This is the structure returned by `getCodeCallback` to represent a worker. |
| 118 | + |
| 119 | +#### <code>compatibilityDate <Type text="string" /></code> |
| 120 | + |
| 121 | +The [compatibility date](/workers/configuration/compatibility-dates/) for the Worker. This has the same meaning as the `compatibility_date` setting in a Wrangler config file. |
| 122 | + |
| 123 | +#### <code>compatibilityFlags <Type text="string[]" /> <MetaInfo text='Optional' /></code> |
| 124 | + |
| 125 | +An optional list of [compatibility flags](/workers/configuration/compatibility-flags) augmenting the compatibility date. This has the same meaning as the `compatibility_flags` setting in a Wrangler config file. |
| 126 | + |
| 127 | +#### <code>allowExperimental <Type text="boolean" /> <MetaInfo text='Optional' /></code> |
| 128 | + |
| 129 | +If true, then experimental compatibility flags will be permitted in `compatibilityFlags`. In order to set this, the worker calling the loader must itself have the compatibility flag `"experimental"` set. Experimental flags cannot be enabled in production. |
| 130 | + |
| 131 | +#### <code>mainModule <Type text="string" /></code> |
| 132 | + |
| 133 | +The name of the Worker's main module. This must be one of the modules listed in `modules`. |
| 134 | + |
| 135 | +#### <code>modules <Type text="Record<string, string | Module>"/></code> |
| 136 | + |
| 137 | +A dictionary object mapping module names to their string contents. If the module content is a plain string, then the module name must have a file extension indicating its type: either `.js` or `.py`. |
| 138 | + |
| 139 | +A module's content can also be specified as an object, in order to specify its type independent from the name. The allowed objects are: |
| 140 | + |
| 141 | +* `{js: string}`: A JavaScript module, using ES modules syntax for imports and exports. |
| 142 | +* `{cjs: string}`: A CommonJS module, using `require()` syntax for imports. |
| 143 | +* `{py: string}`: A [Python module](/workers/languages/python/), but see the warning below. |
| 144 | +* `{text: string}`: An importable string value. |
| 145 | +* `{data: ArrayBuffer}`: An importable `ArrayBuffer` value. |
| 146 | +* `{json: object}`: An importable object. The value must be JSON-serializable. However, note that value is provided as a parsed object, and is delivered as a parsed object; neither side actually sees the JSON serialization. |
| 147 | + |
| 148 | +:::caution[Warning] |
| 149 | + |
| 150 | +While Dynamic Isolates support Python, please note that at this time, Python Workers are much slower to start than JavaScript Workers, which may defeat some of the benefits of dynamic isolate loading. They may also be priced differently, when Worker Loaders become generally available. |
| 151 | + |
| 152 | +::: |
| 153 | + |
| 154 | +#### <code>globalOutbound <Type text="ServiceStub | null" /> Optional</code> |
| 155 | + |
| 156 | +Controls whether the dynamic Worker has access to the network. The global `fetch()` and `connect()` functions (for making HTTP requests and TCP connections, respectively) can be blocked or redirected to isolate the Worker. |
| 157 | + |
| 158 | +If `globalOutbound` is not specified, the default is to inherit the parent's network access, which usually means the dynamic Worker will have full access to the public Internet. |
| 159 | + |
| 160 | +If `globalOutbound` is `null`, then the dynamic Worker will be totally cut off from the network. Both `fetch()` and `connect()` will throw exceptions. |
| 161 | + |
| 162 | +`globalOutbound` can also be set to any service binding, including service bindings in the parent worker's `env` as well as [loopback bindings from `ctx.exports`](/workers/runtime-apis/context/#exports). |
| 163 | + |
| 164 | +Using `ctx.exports` is particularly useful as it allows you to customize the binding further for the specific sandbox, by setting the value of `ctx.props` that should be passed back to it. The `props` can contain information to identify the specific dynamic Worker that made the request. |
| 165 | + |
| 166 | +For example: |
| 167 | + |
| 168 | +```js |
| 169 | +import { WorkerEntrypoint } from "cloudflare:workers"; |
| 170 | + |
| 171 | +export class Greeter extends WorkerEntrypoint { |
| 172 | + fetch(request) { |
| 173 | + return new Response(`Hello, ${this.ctx.props.name}!`); |
| 174 | + } |
| 175 | +} |
| 176 | + |
| 177 | +export default { |
| 178 | + async fetch(request, env, ctx) { |
| 179 | + let worker = env.LOADER.get("alice", () => { |
| 180 | + return { |
| 181 | + // Redirect the worker's global outbound to send all requests |
| 182 | + // to the `Greeter` class, filling in `ctx.props.name` with |
| 183 | + // the name "Alice", so that it always responds "Hello, Alice!". |
| 184 | + globalOutbound: ctx.exports.Greeter({props: {name: "Alice"}}) |
| 185 | + |
| 186 | + // ... code ... |
| 187 | + } |
| 188 | + }); |
| 189 | + } |
| 190 | +} |
| 191 | +``` |
| 192 | + |
| 193 | +#### <code>env <Type text="object" /></code> |
| 194 | + |
| 195 | +The environment object to provide to the dynamic Worker. |
| 196 | + |
| 197 | +Using this, you can provide custom bindings to the Worker. |
| 198 | + |
| 199 | +`env` is serialized and transferred into the dynamic Worker, where it is used directly as the value of `env` there. It may contain: |
| 200 | + |
| 201 | +* [Structured clonable types](https://developer.mozilla.org/en-US/docs/Web/API/Web_Workers_API/Structured_clone_algorithm). |
| 202 | +* [Service Bindings](/workers/runtime-apis/bindings/service-bindings), including [loopback bindings from `ctx.exports`](/workers/runtime-apis/context/#exports). |
| 203 | + |
| 204 | +The second point is the key to creating custom bindings: you can define a binding with any arbitrary API, by defining a [`WorkerEntrypoint` class](/workers/runtime-apis/bindings/service-bindings/rpc) implementing an RPC API, and then giving it to the dynamic Worker as a Service Binding. |
| 205 | + |
| 206 | +Moreover, by using `ctx.exports` loopback bindings, you can further customize the bindings for the specific dynamic Worker by setting `ctx.props`, just as described for `globalOutbound`, above. |
| 207 | + |
| 208 | +```js |
| 209 | +import { WorkerEntrypoint } from "cloudflare:workers"; |
| 210 | + |
| 211 | +// Implement a binding which can be called by the dynamic Worker. |
| 212 | +export class Greeter extends WorkerEntrypoint { |
| 213 | + greet() { |
| 214 | + return `Hello, ${this.ctx.props.name}!`; |
| 215 | + } |
| 216 | +} |
| 217 | + |
| 218 | +export default { |
| 219 | + async fetch(request, env, ctx) { |
| 220 | + let worker = env.LOADER.get("alice", () => { |
| 221 | + return { |
| 222 | + env: { |
| 223 | + // Provide a binding which has a method greet() which can be called |
| 224 | + // to receive a greeting. The binding knows the Worker's name. |
| 225 | + GREETER: ctx.exports.Greeter({props: {name: "Alice"}}) |
| 226 | + } |
| 227 | + |
| 228 | + // ... code ... |
| 229 | + } |
| 230 | + }); |
| 231 | + } |
| 232 | +} |
| 233 | +``` |
0 commit comments