Serverless news and engineering summaries

EmDash is an open-source, TypeScript-based CMS designed as a modern successor to WordPress. It utilizes serverless architecture, Astro for frontend development, and isolated Dynamic Workers for plugin security. EmDash addresses WordPress's legacy security and marketplace issues by enforcing granular plugin permissions, while supporting native x402 payments and AI-driven automation via the Model Context Protocol.

Deno has introduced Deno Sandbox, a specialized environment designed for running untrusted LLM-generated code safely. Recognizing the security risks of prompt-injected code exfiltrating API keys or accessing unauthorized networks, Deno Sandbox utilizes lightweight Linux microVMs with sub-second boot times. Key features include a robust secret management system where real credentials only materialize during requests to approved hosts, and strict network egress controls to block malicious outbound traffic. It supports JavaScript and Python SDKs, allowing developers to manage sandboxes programmatically and deploy them directly to production on Deno Deploy. This tool is ideal for building AI agents, secure plugin systems, and ephemeral CI runners while maintaining defense-in-depth security.

The author successfully replaced a cloud VPS with a repurposed CMF Phone 1 running a rooted Android OS. Leveraging Termux, runit, and chroot environments, the phone acts as a power-efficient, battery-backed server for personal web applications. Ansible manages the infrastructure as code, ensuring reliability, automated deployments, and connectivity via Tailscale and Cloudflare Tunnels.

The author migrated their decade-old Ubuntu VPS to a new Hetzner FreeBSD server, utilizing Bastille and Jails for virtualized site management. The transition improved server performance, security, and cost. Despite initial configuration hurdles, the new stack demonstrates significantly higher request capacity and stable latency under heavy load compared to the previous aging infrastructure.

AWS introduces Lambda MicroVMs, a serverless compute primitive powered by Firecracker. It offers virtual machine-level isolation, near-instant launch times, and stateful execution for multi-tenant applications running untrusted code. MicroVMs retain memory and disk state across sessions, allowing developers to provide dedicated environments for tasks like AI coding assistants without managing complex underlying infrastructure.

Cloudflare Flagship is a feature flag service that enables developers to control feature visibility in applications without redeploying code. It integrates natively with Cloudflare Workers, supports OpenFeature standards, and offers robust features like targeting rules, percentage rollouts, and multi-type variations for serverless application management.

Cloudflare has introduced Moltworker, a middleware adaptation of the open-source AI agent Moltbot (formerly Clawdbot), designed to run on the Cloudflare Developer Platform. This implementation allows users to host their personal AI assistants in the cloud rather than on dedicated local hardware like Mac minis. By leveraging Cloudflare Workers' enhanced Node.js compatibility, the platform supports 98.5% of popular NPM packages. Moltworker utilizes several Cloudflare services: Sandboxes for secure isolated code execution, Browser Rendering for web automation tasks, R2 for persistent data storage, and AI Gateway for centralized AI provider management and cost tracking. The project is available as an open-source proof of concept on GitHub, showcasing how the edge network can handle complex, stateful AI agents with built-in security through Zero Trust Access.

Cloudflare introduces Kitesurf, a lightweight, agent-focused browser built for the Cloudflare Workers platform. Unlike traditional browsers like Chromium, Kitesurf is stateless, isolated, and utilizes WebAssembly to provide AI agents with efficient HTML extraction and screenshot capabilities, significantly reducing CPU and memory consumption while ensuring scalability for bursty, automation-driven workloads.

This guide details how to boot Debian over a network using iSCSI and Netboot.xyz. By separating the OS from local hardware using a remote storage ZFS ZVol, the author avoids dual-booting conflicts and hardware repartitioning on their gaming PC. The setup involves configuring TFTP, DNSMasq, and iSCSI targets on a Proxmox host for a remote networked server installation.

bookshelf is an MIT-licensed, self-hosted ebook library serving EPUB and PDF readers, downloads, search, profiles, and reading positions. It runs as a Node server over filesystem storage or as Cloudflare Workers over R2, with Docker support and a generated demo collection. There is no authentication, so deployment requires a trusted network or an external access-control layer.

Telegram Serverless enables deploying bot backends directly onto Telegram’s infrastructure. By writing JavaScript modules, engineers skip server provisioning and maintenance. The platform offers a V8 sandbox for code execution, a built-in SQLite-powered database, and an SDK for the Bot API, streamlining development through a CLI that manages project state, local testing, and atomic deployments.

Wasmer has introduced Edge.js, an open-source JavaScript runtime that executes Node.js workloads within a WebAssembly sandbox. Unlike other edge runtimes, Edge.js maintains full Node.js compatibility by isolating system calls and native modules using WASIX, eliminating the need for Docker containers and providing high-density, secure serverless execution with rapid startup times.

Lightwhale is an immutable, minimalist Linux operating system optimized for running Docker containers. It boots directly into a Docker-ready environment from an ISO, using OverlayFS for persistence. Designed for simplicity and security, it eliminates installation overhead while supporting both bare-metal and virtualized deployments with an intuitive, maintenance-free architecture.

Kedge is a globally distributed cloud platform offering serverless functions, SQLite databases, and static hosting via hardware-isolated VMs. It features push-to-deploy integration, global edge content delivery, and per-second billing based on usage. Its architecture focuses on performance, scalability, and developer ease-of-use through SSH access and GitHub integration.

Chris Armstrong explores the potential of OCaml for serverless application development, highlighting how programming language choice significantly impacts efficiency, cold-start performance, and deployment simplicity. While Python and TypeScript offer ease of use but higher overhead, and Rust provides performance with a steep learning curve, OCaml is presented as a pragmatic 'sweet spot'. It combines the safety and speed of compiled languages with the simplicity of garbage-collected ones. However, OCaml currently faces hurdles regarding native cross-compilation and the lack of mature cloud SDK or IaC integrations. To address this, projects like smaws and ocaml-cfgen are emerging to improve the ecosystem, aiming to make OCaml a more viable and competitive choice for high-performance, cost-effective serverless architectures in enterprise environments.