Cloudflare open-sourced a preview of Computer, a virtual filesystem that lives inside a Durable Object, and it quietly answers the question every agent builder has been tripping over: where does the agent’s state actually live? The answer, per the repo, is a single authoritative SQLite store in the Durable Object, with three pluggable execution backends that all read and write the same workspace. No second store, no sync round trip, no drift between what the agent thinks it wrote and what it can read back.
The design is the news. Computer treats the filesystem as the source of truth, not the agent loop. The Durable Object holds the state in SQLite and exposes one entry point, workspace.runtime.exec(source, { backend }), where the backend decides whether the source is a shell command or an ECMAScript module. Three backends ship today: a container backend that projects the SQLite state as a real FUSE mount with a sandbox-side daemon called computerd, an isolate shell that runs just-bash in a Dynamic Worker, and an isolate JavaScript backend that runs an ECMAScript module in a fresh Dynamic Worker with structured input and results. The container gets full Linux userland, real binaries, real network. The isolates skip the container entirely and reach the authoritative workspace over Workers RPC, which means no second store and no sync protocol in the path.
That last point is the one worth sitting with. The container backend is impressive plumbing, but the isolate backends are the architectural statement. Most agent frameworks today bolt a filesystem onto an agent by giving it a directory in some ephemeral VM and praying the checkpointing works. Cloudflare’s bet is that the filesystem should be the durable artifact, and execution should be a stateless function of it. The workspace is the memory. The runtime is just a lens.
The performance note in the repo backs up the design choice. computerd’s FUSE mount beats real disk on metadata-heavy work and trails it on large sequential I/O, per docs/19_performance.md. For agent workloads, which are dominated by small reads and writes, scattered config files, and tiny JSON state, that is the right trade. Agents do not stream 4K video. They read a file, write a file, run a command, read the output. Metadata-heavy is exactly the profile of an agent’s day.
There is a deeper implication for the AI economy here. The agent state problem has been the quiet tax on every serious agent deployment. Companies building agents at scale have had to invent their own state layers, usually a mix of blob storage, a database, and a bunch of glue code that nobody wants to maintain. Cloudflare is proposing that the platform itself should own that layer, and that the filesystem metaphor, the one every developer already understands, is the right interface. That is a genuinely contrarian position in a world where everyone is pushing vector databases and memory APIs as the answer to agent state.
The repo is explicit that this is a preview. “APIs are unstable and the design is subject to change,” the README warns, and the specification under docs/ is forward-looking, “read it for intent, not as description of the code today.” The package is not suitable for production use. That honesty matters, because the interesting parts of the design are the ones that will change. The ws:git and ws:artifacts trusted modules in the JavaScript backend point at where this is heading: agents that can clone repos, run builds, and publish artifacts, all against a filesystem that survives the execution.
The examples directory shows the ambition. examples/think runs a @cloudflare/think chat agent that uses the workspace as its working directory, reachable from a terminal. examples/think-compare-runtimes runs the same agent task against the container and worker runtimes side by side, which is a nice admission that the backend choice should be an evaluation, not a default. examples/tutorial has an agent write a markdown recipe card on the host and run pandoc on it in the container to produce a PDF. examples/artifacts generates a Worker project in a workspace and publishes it to Cloudflare Artifacts as a clone-ready repo. examples/assets turns a prompt into an image with Workers AI, writes it to the workspace, and returns a shareable link through @cloudflare/computer/assets.
The pattern across all of them is that the agent’s output is a filesystem, not a chat log. The agent writes files, and those files are real, inspectable, and portable. That is a cultural shift as much as a technical one. The current agent ecosystem is full of black boxes that produce text. Cloudflare is pushing toward agents that produce artifacts, which is a much more useful unit of work.
For AI builders, the practical takeaway is that the state problem is getting a platform-level answer, and the filesystem is winning. The @cloudflare/dofs package, the Durable Object SQLite-backed virtual filesystem, is the foundation, and it ships with a @platformatic/vfs provider for Node, which means the model is not locked to Cloudflare’s runtime. The capnweb RPC channel between the Durable Object and computerd is the sync protocol, and it is shared across the container and isolate paths.
The open question is whether the filesystem metaphor survives contact with real agent workloads at scale. SQLite in a Durable Object is a single-writer store, which is fine for a single agent but a real constraint for concurrent agents sharing a workspace. The repo does not address multi-agent coordination, and the preview status suggests Cloudflare knows this is unresolved. The other question is whether the container backend, with its FUSE mount and computerd daemon, becomes the production path or a reference implementation for the isolate backends, which are simpler and have no sync round trip at all.
Cloudflare has a history of shipping developer infrastructure that starts as a clever hack and becomes the default way to build. Workers itself was dismissed as a toy until it was not. Computer has the same feel: a small, opinionated package that makes a hard problem look easy because the platform absorbed the complexity. The repo is MIT licensed, the contribution model is deliberately closed (no unsolicited pull requests, feedback through issues only), and the AGENTS.md file at the root suggests the repo is designed to be read by agents as much as by humans.
The most telling line in the whole repo is the tagline: “Give your agent a computer.” Not a memory, not a context window, not a retrieval layer. A computer. The filesystem is the interface, and Cloudflare is betting that the oldest abstraction in computing is the right one for the newest kind of program. For a platform that made its name on stateless functions, that is a remarkable evolution. The state is not going away. Cloudflare just decided to own it.