Is Cloudflare overcharging us for their images service?
jpetazzo.github.io
jpetazzo.github.io
While I continue to dig in to the specifics of the billing and support issues described, I can confirm this bit from the blog post:
if you stored 2 million images and delivered 1 million images, your total cost for that month for the Images product should be ~$210, not $400+
I've reached out to the author to get some additional information which will help me investigate this further. Also happy to chat with anyone else with questions or issues (zaid at cloudflare)
The support experience described matches all of my experiences with CF support over the years.
Sometimes there's workaround, if you pay big bucks, you might get "personal" manager who can actually connect you with necessary people. But that service is not available for every company out there. And if you don't pay big bucks, you don't have a chance.
This scheme probably makes sense. At certain scale you just can't talk to everyone. When you have 20 developers and 20 million clients, one person can have only so much time. And most support issues are stupid anyway.
I wrote about it here last year: https://matteosonoio.it/cloudflare-support/
> It’s likely that we will replace Cloudflare Images in the long run. Looking at storage costs alone, S3 would be 4 times less expensive for our use-case.
Cloudflare R2 would likely be a good choice too, if you're willing to bet that the (inevitable?) shakedown for money once you find the limits of "unlimited egress with no fees" won't be too bad.
I recommend idrive
the price is their strong point but you shouldn't use S3 or any of the sort for any critical stuff in the first place.
reply to comment below: if you require S3 support more than once a year then you definitely should not be using idrive but for the rest of us who don't need that idrive is a great alternative!
You are most welcome ^_^
This is only profitable if the data volume is huge though. For 5-10 TB, one is always best served by cloud storage providers like S3, R2 or Wasabi.
R2 egress is free. There's no shakedown. If you look at https://blog.cloudflare.com/introducing-r2-object-storage (the original announcement) we said many times that egress is free. That's sort of R2's whole thing!
See also: https://www.cloudflare.com/developer-platform/r2/
No egress charges
Our affordable, consistent pricing helps free up resources across your organization — and you never have to pay egress fees for data accessed from R2.
There might not be precise measurement system which bills you by the byte, but many provides monitor (or periodically sample) bandwidth utilization, so and using too much data will catch someone's attention.
Example from Hetzer, which claims to provide "unlimited" traffic. https://lowendtalk.com/discussion/180504/hetzner-traffic-use...
> We will routinely check your traffic use. If we continue to see such a high amount, we may choose to cancel your contract.
Does this effectively mean DDoS protection that's free until you actually use it?
P.S.: In contrast, imagine a website dedicated to journalistic content about how {dictator} is a crook and a parasite that has made {country} weak and a joke to the rest of the world. If there's a regular nation-state level DDoS from nodes in {country}, Cloudflare might say: "Hey, uh, your situation is not normal anymore, and it's not exactly your fault be we are a business that needs to recoup costs..."
In exactly none of the posts about these debacles did CloudFlare say anything of the sort. It’s always comic book villain levels of communication.
Warning: Insurance is not going to pay if YOU burn down your home /// even a little bit ///!!!
That reminds me of an NPR piece [0] discussing how a worrying number of people seem to be getting wrong/illegal tax-advice from "influencers" on TikTok etc. I'm sure a similar thing with insurance fraud either has happened or will happen eventually.
https://blog.cloudflare.com/unmetered-mitigation/
"Cloudflare mitigates record-breaking 71 million request-per-second DDoS attack"
https://blog.cloudflare.com/cloudflare-mitigates-record-brea...
"Mitigating a 754 Million PPS DDoS Attack Automatically"
https://blog.cloudflare.com/mitigating-a-754-million-pps-ddo...
Where things start to get shaky is if your site uses a lot of bandwidth for legitimate traffic, or otherwise uses the service in an unusual way. Personally I see it like an old shared hosting plan that will probably let you use some burst capacity if you get Slashdotted, but operates under a vague shared understanding that the service is only for "normal websites". (Which includes a lot of policies and content guidelines that only become problems if you show up on someone's "sort by usage descending" dashboard.)
I think publishing a specific amount of bandwidth that customers are allowed to consume would go a long way to putting R2 in the former category. Maybe that number is your maximum object size multiplied by your GET request limit, maybe it's your current total network capacity, maybe it's eight octillion zottabits per second.
I think what people are saying is we know there is probably a silent line somewhere, and we have no way of knowing when we cross it. It feels like it has an implied "most of the people reading this can treat it as unlimited in practice"
Cloudflare is free but concerned it won’t be regularly. Someone’s paying for it sooner or layer
It's almost always best to use some sort of image processing service (like Gumlet.com) to optimise images and then pay lower per GB bandwidth costs.
To summarize, I think this issue comes down to the fact CF didn't design well around the scenario that someone may upgrade their image storage capacity multiple times in a billing cycle, which seems to be the case for the author. If you only upgrade zero or once each cycle, it's not too bad.
I understand they want it to be prepaid. But I wonder why they don't just do the calculation upfront and charge you the difference (times the remaining days in the billing cycle) every time you upgrade.
In my opinion, CF Images is best if you use it with a Worker in front and R2 as storage, as you have (most) all the convenience of R2, the CDN, and CF Images, but without the unusual pricing.
Perhaps it's time I did a write-up on how to do this - it works very well for the purposes of our SaaS[1] at least :)
Even at his worst case (all images are 1mb) - they're only serving ~1tb per month in image data (admittedly, he mentioned these were stale numbers, so it'll have increased since then).
But I serve 1tb/month (actually much more than this) on old gaming machines sitting in my basement with just a standard comcast business line, just hosting media for my extended family.
I pay 200/m for the business line, and then another 15 in electric costs. And I need the internet either way.
Every now and then I get a rep calling trying to upsell me, and that's about it.
At the end of 2 years they wanted to renew me. So my strong suspicion is they don't care in the slightest.
I'll add - I've also done this on a consumer Google Fiber line (which is more restrictive in the sense that contractually I can't host paid services). They also don't blink an eye when I push out 10mbps (or 500mpbs) over extended periods.
No scummy salesy tactics like I experienced from Cloudflare, and very quick and helpful support.
Not saying it's been completely bugless, but nothing worth complaining about.
I was evaluating image hosts a while ago. CF Images seemed promising but I was afraid that my use-case would grow to become cost-prohibitive, and I really didn't want to deal with a migration off it later. So I settled on rolling-my-own with R2 and ffmpeg to pre-generate a few renditions [1].
In short, R2 billing is weird. I actually haven't updated my bucket in months and yet the storage amount fluctuates a bit month-to-month. (Is R2 storage accounting probabilistic?!?) I also got hit by a billing line item in May for "R2 late usage" from Feb to March which I could not find any information about.
Their support only recently got back to me, with a very unhelpful / irrelevant answer of course.
The amounts involved are only ~$1 so I don't care too much - I was mostly curious - and I don't blame them for maybe not wanting to expend too much effort looking into irregularities on such a tiny account.
No regrets though. Using CF Images would still be 5x more expensive month-to-month even at my (tiny) scale. The $5-per-100k flat-rate is probably the thing that allows them to make any money on image hosting.
[1] Word to the wise - there are a lot of subtleties around building production-scale image hosting that often times it may be much easier to simply pay the premium for a managed service. For example, what if you want to only generate renditions just-in-time to save on storage? What about updating your rendition list on the fly, eg adding a new one, or even removing older ones from storage? When / how often should you sweep storage of unused renditions?
Maybe Cloudinary is more expensive (though not by a lot for our use case) but I can say that nobody has had to log in or think about it for months. The thing just works.
Most of the CF add-on services seem to be hobby-quality. We used to use their video stream/encoding service too but have since switched to another more robust platform.
We had negotiated a contract with a fixed capacity and overage charges for when we went over them. They estimated our usage for six months out and twelve months out, then spread the fixed cost out across two six month periods, billing monthly. So in effect, we would be paying for capacity six months in advance that we didn’t need, progressively getting closer to accurate billing.
The real problem came about ten months into the contract. We went over the fixed capacity. Still, no problem, right? That’s what the overage charges are for. Nope! They just switched our service off, causing us downtime.
They fixed it by manually applying a random amount of credit. Which we weren’t billed for. After that, they were really keen to negotiate a new fixed contract, even though they weren’t billing us for the overage charges.
We couldn’t figure it out at first because they were behaving very strangely about a bunch of things. Eventually we realised that there was one thing that explained all their weird behaviour: they just hadn’t implemented overage handling at all. They had no way of stopping our service from being automatically disabled when we went over our limit; the only way they could fix it was to manually apply credit; and the only way they had to bill us for the overages was to negotiate a new contract.
I’m still not certain if that was the case, but it was the only explanation we could come up with, and they were less than forthcoming about it all. The whole service was an absolute shitshow in many other ways as well; it was beta quality at best and they had no interest in fixing the issues. So can I believe they just didn’t implement overages? Yup.
This is such weasel wording. It's frustrating because it's most likely true and the people writing it are probably not lying and honestly swamped.
But considering that growth is the main purpose of most companies like this... by definition, they will at nearly all times be dealing with unprecedented demand!
> "Additionally, they may face challenges in paying invoices"
"face challenges?" You mean that it's not working at all? It's just such a strange word to use.
It’s an interesting concept, a corollary would be walking into a physical store and being treated as a thief, until you check out and make payment. (in fact the opposite is true generally as they check your receipt on exit, or you walk through the magnetometers on exit). I’m not saying it’s right or wrong, just making an observation.
(in b4 it's Actually Indians.)
Bad news:
https://gizmodo.com/amazon-reportedly-ditches-just-walk-out-...
> Though it seemed completely automated, Just Walk Out relied on more than 1,000 people in India watching and labeling videos to ensure accurate checkouts. The cashiers were simply moved off-site, and they watched you as you shopped.
Must be a soulcrushing job though
if there is a mistake and someone thinks I stole something, I'd like to be able to explain that I did not, rather than having false charge on my card.
Something scans wrong? Employee punches something in and you don't get wrung up for an item? Some AI camera system decides you've done some sort of switcheroo?
They will have the police come to arrest you next time you're at the store and have long since forgotten the details of your last purchase. Now your chance to explain involves lawyer fees - way more expensive than most credit card fees.
If you notice the mistake and try to explain to an employee before it's chargable as theft, and think you get it cleared up: there's still a good chance you still get charged and also the employee is fired and/or charged too. Major retailers assume their employees are just as much of a thief as they think you are.
Between the cameras, the guards everywhere, the anti-thief systems on products, the alarm portals and the ticket check, the whole experience is super aggressive.
Never happened to me anywhere in Europe but many times in Australia so it must be a local law that they can do that.
This is more common in the higher-crime areas, but even in the low-crime places, this seems to be very common a lot with small and expensive things (jewelry, high-end electronics).
I received an invoice for cloudflare domains with incorrect billing period when I renewed it early. It calculated the billing period from the date invoice was created, instead of the the actual year in the future I was renewing it for.
It was not a huge issue, but I reported it via support and they acknowledge the issue. This was in 2023.
Doesn’t inspire confidence.
Especially no customer service response for months for paying customers.
Someday we’ll reach equilibrium but it seems far away for now.
We (well I) shortlisted;
- Fastly
- Cloudflare
- Imgix
- Cloudinary
Imgix (for us) was the clear winner. We had only initially planned to use in a small performance-sensitive part of the platform. That quickly escalated (in a good way) to doing all our of public images on a custom plan. Imgix were great. We have no complaints.
- Opportunistically serve more efficient image formats when browsers support them without converting/storing
- Cropping and resizing without needing to build your own compute to do it (no creating and storing thumbnails)
- Watermarking on the fly (e.g., on cropped images)
You could absolutely build it all yourself, but tying it all together with your CDN and handling user uploads safely and doing auth (so users can't, for instance, just remove a watermark) isn't very easy, and it's nice to have a managed service that just does the thing.
Its, yet again, the utter refusal by CF to provide even basic support. Even for paying users. Even for users who bought the so-called "pro" plan, mainly so that they can access the support that comes with it.
I myself had a metering/billing issue that:
1. I first posted on the forum. Instead of responding there, I was told by staff to raise a ticket. 2. No response to the ticket. Autoclosed after ~1 month. 3. I immediately reopen it. No response, autoclosed after ~1 month. 4. Repeat, for 5 months. 5. Then, I wrote an angry rant in the ticket, and finally the support response arrives: "the customer is misinterpreting the reported numbers, they mean X, not Y". Fair, enough, not obvious from the UI, but could you not have told me this without so much ... friction?
I love what CF has built (I even own a small amount of stock!). Its not perfect, but its far more of a serveless/cloud model than any other player. Makes so many things so much easier.
But, _PLEASE_, CF: improve tooling, and commit to a basic level of support.
Seriously though, it feels like support exists as a hurdle to get to engineering. I have never had a serious issue that was resolved by support. I miss when customer engineers or customer support actually was treated like a value add part of the business.
The author discovers the wild world of financial engineering and "float".
Instead of settling usage changes for it's image service with a single charge, Cloudflare settles it with two charges in such a way that the customer "floats" Cloudflare money for some portion of their billing cycle.
This is the bullshit that you start to do when you become publicly traded. It adds zero value for the customer.
That's literally their business model.
Is that even the right way to look at it? I mean, perhaps some company is providing enough value and enjoyment of their product that a 500% profit margin is gleefully paid by their customers.
But even then, images are quite simple to deal with compared to big files like videos because you don't have to chunk them. So just copying them several time and putting a load balancing in front of it will get you 99% there for half of the price, dev time included.
For most companies, you don't need more.
Here are the reasons image processing on VPS is hard.
- Reliability and uptime is a huge concern. If service goes down, images can show broken - When you build it yourself, you pay for image processing, bandwidth AND developer time. image processing at multiple terabytes and half a million image processed is not trivial ( inputs can be crazy and output needs to be modified as per the requesting platform) - Images form a big part of Google web vitals so slow image processing can hurt LCP score. - Newer formats like AVIF and JXL are increasingly complex. They need way more processing power than plain old JPEG.
https://expatcircle.com/cms/why-you-should-never-use-cloudfl...