Cloud
Cloudflare
A global network with CDN, DNS, DDoS protection, plus Workers, R2 and D1 for running apps at the edge.
What it is
Cloudflare started as a CDN and DNS proxy with DDoS protection and is now a full platform. Your domain's traffic passes through its network spread across hundreds of cities, where it is cached, filtered and accelerated.
Beyond the network there is a developer platform: Workers (code at the edge), R2 (S3-compatible storage with no egress fees), D1 (a SQLite database), KV, Queues, Pages.
The free tier is generous, so Cloudflare often sits in front of sites of any size as DNS, CDN and WAF.
Use it when
- You need CDN, DNS and protection against DDoS and bots for a site.
- You want to run code close to users with minimal latency (Workers).
- You serve many files and egress fees in other clouds are costly (R2).
- You need Zero Trust access to internal apps without a VPN.
Avoid it when
- You need long-running computation or heavy databases: these are not general-purpose virtual machines.
- Compliance forbids routing traffic through a third-party proxy.
- The app relies heavily on Node.js APIs that are not available in the Workers runtime.
Key concepts
- Anycast CDN
- A request lands on the nearest network node, where a cached copy is served or code runs.
- Proxy (orange cloud)
- A mode where a DNS record is proxied through Cloudflare: it hides the server IP and enables cache and WAF.
- WAF
- Web Application Firewall: rules against SQL injection, bots and suspicious requests.
- R2
- Object storage with an S3-compatible API and zero egress fees.
- Tunnel
- Cloudflare Tunnel exposes an internal service through an outbound connection, with no open ports.
Example
Interview questions
1. What does a CDN do and why is it needed?
A CDN keeps copies of static files on nodes closer to users, so responses arrive faster and the origin has less load. It also absorbs part of DDoS traffic.
2. How do Workers differ from AWS Lambda?
Workers run on V8 isolates at the network edge and start with almost no cold start. Lambda runs a containerized environment in one region but supports more languages and longer executions.
3. Why is R2 interesting compared with S3?
It is compatible with the S3 API but charges no egress fees. For projects that serve many files this can cut the bill a lot.
Interview questions from the bank
- LCP on a product page on mobile is 4.2 s with a TTFB of 600 ms. The main photo is rendered by a carousel component after hydration and has
loading="lazy". What do you change, in what order, and how do you confirm it helped?MiddleFrontend performance - After a deploy some users see the old version of the site for another day, and for others the page breaks: a cached old
app.jsdoes not match the new HTML, because the file name does not change. How do you configure caching for HTML and static assets so both problems go away?MiddleFrontend performance - You put a CDN in front of the site and enabled caching of all responses for an hour to take load off the origin. The next day a user complains they saw someone else's cart. What went wrong, and what can a CDN cache safely?MiddleFrontend performance
- Someone added
<link rel="preload">for 12 resources "so everything loads faster", and LCP got worse, while the console says some preloads were not used within a few seconds. Why, and when do preload, prefetch and preconnect actually help?MiddleFrontend performance - The build still concatenates all code into one
bundle.js, and static assets are served from three subdomains (domain sharding), because once "it was faster". The server and CDN already run HTTP/2 and HTTP/3. Which of these tricks now hurt, and why?MiddleFrontend performance - After introducing a Service Worker with cache first for everything, some users stay on an old version for weeks, and after an API deploy with a new contract the app breaks for them. How do you set up caching strategies and worker updates?SeniorFrontend performance
- Estimate on a napkin: 10 million DAU, each makes 50 requests per day, 10% of requests are writes of 1 KB, the average response is 5 KB. Compute average and peak QPS, data volume per year and outgoing traffic. How many Node processes and servers do you need?MiddleSystem design
- After upload a file must be checked with an antivirus, images need three thumbnails, and videos need a preview. ClamAV scans tens of MB/s per core, while ffmpeg on video works for minutes. Design this pipeline and the serving: where the queues are, how to keep video from blocking images, when a file becomes available and how to serve 20 Gbit/s of downloads.SeniorSystem design
Related technologies
- Cloudflare WorkersA serverless platform on Cloudflare's edge: V8 isolate code starts almost instantly worldwide.
- AWSThe largest cloud platform, with hundreds of services from virtual machines and storage to databases, queues and ML.
- HetznerA German provider with very good-value VPS, dedicated servers and a simple cloud API.
- CaddyCaddy is a web server and reverse proxy written in Go with automatic HTTPS and very simple configuration.
- nginxnginx is a fast web server and reverse proxy that also works as a load balancer and HTTP cache.
- TerraformTerraform is an infrastructure as code tool: you describe cloud resources in configuration and it creates and changes them.
Logos belong to their owners and are used for identification only. Icons: Simple Icons (CC0), Devicon (MIT).