Oxy is Cloudflare's Rust-based next generation proxy framework | Hacker News Reader

Oxy is Cloudflare's Rust-based next generation proxy framework

blog.cloudflare.com

154 pointslukastyrychtr59 comments

It’s not OSS :(

I figured with this type of blog post the finale would be, and everyone can try it out at…

Hopefully they do release it OSS eventually.

They mention Pingora near the end, another similar project, which also isn't OSS so not sure I'd expect this project to eventually end up OSS.

Given that we open sourced the runtime for Cloudflare Workers, don't despair about us eventually open sourcing stuff.

> Even though Oxy is a proprietary project, we try to give back some love to the open-source community without which the project wouldn’t be possible by open-sourcing some of the building blocks such as https://github.com/cloudflare/boring and https://github.com/cloudflare/quiche.

They open sourced a few bits, but those were both mid-last year. I'd say quiche is more interesting than boring.

For a company that got so much out of NGINX for years this is disappointing.

NGINX was great for us for a long time. But there comes a time where your needs and their future plans diverge. We couldn’t keep maintaining a fork and we had features that would have meant a huge effort to shoehorn into the NGINX architecture.

And NGINX is written in C and we really wanted to use less memory-unsafe languages after Cloudbleed.

This is a massive segue, but where would memory-unsafe languages be acceptable for use at Cloudflare? I'm assuming existing software that needs to be maintained would be one of the them but what about low-level firmware, kernel code, and so on? Would Rust would a replacement to C in those areas too?

Yes I understand. I’m not complaining about you writing Oxy I’m complaining about the proprietary license after you derived so much value from Open Source, same as the parent comment.

> Oxy heavily relies on open-source dependencies, with hyper and tokio being the backbone of the framework

It seems almost every single production async framework uses tokio instead of async-std. Has tokio won? Is there a reason in 2023 not to use tokio as the async base?

Tokio has won.

Recent downloads on crates.io (like npm for Rust)

- Tokio 12.1M

- Async-std 1.6M

It’s an order of magnitude difference.

Deno has periodically had open github issues or ideas where there's possible paths but tied to Tokio & they seem to want to leave the door open for now. Just one tiny data point but I find it interesting.

Bytedance has their in-house monoio <https://github.com/bytedance/monoio> (supports io-uring) but it requires rust nightly. On some benchmarks & applications it outperforms tokio by a significant margin. <https://github.com/bytedance/monoio/blob/master/docs/en/benc...>

Another async framework might give smaller binaries, important for Linux routers and things.

While it is interesting that they achieved a technical feat, is there any reason for this article to be here? It teaches us nothing apart from the fact that Cloudflare did a thing.

At the simplest level the answer is... someone posted this to HN and other users upvoted it enough for it to reach the front page.

We write things up for one main reason: find new employees. We want people to know what sorts of things we work on. So we try to explain them in a lot of detail. A secondary reason is that it's sometimes helpful to learn how someone else solved a problem. Real world examples can be helpful and sometimes more helpful than abstract discussions.

I was quite there with you, until you said:

> We write things up for one main reason: find new employees.

JFC, vomit in my shirt, gross.

What kind of Ayn Randian misery world do you live in? I think a lot of people write things because they think it's interesting & worth discussing & has merit. It doesn't necessarily have to be for self or corporate gain. It's ok if people just want to help other people, want to share? No? Yes? Is it so objectionable that we have a broader human cause, that we want people to do well & know more & understand better? Do we have to reduce everything to the utmost petty corporatistic parasitism?

Or just more broadly: can we not ascribe motive so quickly, with such cocky self-assurity? (Especially to such incredibly vulgar/short ends?) Let's leave some possibility of intent open, yeah, please?

The commenter you’re replying to is CTO of Cloudflare, so I’d say they likely know why the company makes these blog posts.

You think the person you’re replying to is slandering Cloudflare by saying they write blog posts primarily to build their brand among potential hires.

I don’t think he’s slandering Cloudflare. I think he’s captured their intent well. I say this because jgrahamc is the CTO of Cloudflare. He has been for years.

Very very good point & I didn't know that.. But I'm still not sure that actually really matches employee's motivations for writing these things.

See my comment above. I agree about employee motivations. I was talking about Cloudflare’s motivation to have the blog and spend all the effort on it.

I haven’t read any Ayn Rand so I’m not totally sure what that means but, as I said, the main reason Cloudflare has a blog like that is to attract new employees.

Of course, there are all sorts of others reasons such as giving our employees the satisfaction of having their work made public, helping them write better, hopefully making potential customers think we are cool and want to buy stuff, getting feedback from the outside world (I particularluly love the “why didn’t they do X” type comments because sometimes we learn something useful) and so on.

That's basically what all technical blogs from corporations does. I suppose they imagine we'd learn something it.

I concur with the other commentator, bit disappointing it's not OSS, guess they are afraid of helping the competition. I did expect a "and you can give it a try here" section in the end.

We're not afraid of helping the competition. Example: we open sourced the entire runtime for Cloudflare Workers! https://github.com/cloudflare/workerd

Open sourcing something has a cost and we mostly only open source things like stand-alone libraries. We also mostly open source things that are fairly mature because it's hard to manage software that's rapidly changing internally and handle PRs from outside.

You did mention on your Pingora post months ago that that would be open-sourced eventually though. Is that still the case? Is Oxy entirely separate from those plans?

What kind of corporate but tech stuff do people find interesting? Curious, im looking to write more to practice but idk exactly what kind of stuff people are interested or what level of technical information they want too. Interested in anyones answers

It provides "validation" (as the kids say) to Rust, Tokio, and Hyper. Whether they need additional validation at this point is debatable though.

Because of one word, and I think you know which it is.

You're on a site with "news" in its name. The word news can be defined as "information about things people did".

That's an unfortunate name.

That was my first thought as well[1].

[1]: https://www.urbandictionary.com/define.php?term=oxy

They need to make a complimentary service called Percs

Yeah, it has no PR.

I thought the same thing! Then I was reminded that it's also used prominently on acne medication I've seen in stores.. https://cdn11.bigcommerce.com/s-i5q5a5nhp2/images/stencil/12...

edit: also, for some reason - this older song came to mind: https://www.youtube.com/watch?v=nEYwmfd65C8

I recently watched Dopesick on Hulu and yeah, that’s the first thing that came to mind.

Does this mean that one will be able to route TCP traffic through Cloudflare?

(I would have named it something else.)

You can already do this with Spectrum (https://developers.cloudflare.com/spectrum/).

I just looked at this yesterday. The only things available to me was ssh and minecraft. this is not the free tier account.Maybe i’m missing something.

Edit: Enterprise account only .

The value-based price model at Cloudflare is a big turn off. Don't expect that all the Enterprise features are ready to be used in your Enterprise account. I can't remember that I have seen this feature in any Enterprise account.

With GCP, Azure and AWS you at least have an idea of what you are paying for. Cloudflare is more up to how lucky you got with your AM.

Thank you, I have somehow missed this.

Not really practical for public access, but you can do this using Cloudflare Tunnel (running the cloudflared daemon on the host and client).

Products > Cloudflare Zero Trust > … > Add non-HTTP applications > Arbitrary TCP

https://developers.cloudflare.com/cloudflare-one/application...

Will be interested to see why I would use this instead of Envoy or similar FOSS. One obvious thing would be giving the operational work to Cloudflare instead of doing it myself, but beyond that it reads like "we built an internal thing in Rust."

I mean... You wouldn't, unless you started working at Cloudflare. It seems to be an internal proprietary framework.

Whoever chose the name clearly never heard about the opioids crisis..

Should really have saved that name for a concurrency library, so you could use Oxy-continuations.

(slow clap)

They obliviously missed an opportunity to call it "Roxy" and avoid the unfortunate current name collision...

If they offer a blind proxy solution they can market it as Boxxy

Naming things is hard.

https://www.urbandictionary.com/define.php?term=roxy (2nd entry)

Excellent! This is what a Doctor should prescribe for high perf requirements.

Sad to read. This is exactly what Richard Stallman warned about. He would be turning in his grave if he knew about this.