# Container vs Worker Shell vs Worker JavaScript Execution Backends in Cloudflare Computer

> Explore Cloudflare Computer's Container, Worker Shell, and Worker JavaScript backends. Understand their trade-offs in isolation, language support, and startup latency to choose the right execution environment.

- Repository: [Cloudflare/computer](https://github.com/cloudflare/computer)
- Tags: deep-dive
- Published: 2026-08-16

---

**Cloudflare Computer provides three distinct execution backends—Container, Worker Shell, and Worker JavaScript—each offering different trade-offs between isolation, language support, and startup latency.**

The **Computer** framework (found in the `cloudflare/computer` repository) lets developers run arbitrary code inside Cloudflare's edge infrastructure. The three execution backends determine *how* that code runs: inside a full Linux container, through a container-hosted shell process, or directly in the V8 JavaScript engine. Choosing the right backend depends on whether you need native binary execution, operating system capabilities, or millisecond-level cold starts.

---

## What Is the Container Execution Backend?

The **Container backend** runs your workload inside a complete Linux container managed by Computer's Durable Objects infrastructure.

In [`packages/computer/src/backends/container.ts`](https://github.com/cloudflare/computer/blob/main/packages/computer/src/backends/container.ts), the backend implementation builds a container image, configures namespaces and cgroups, and launches an isolated process environment. This gives you:

- **Full OS isolation** via Linux namespaces, PID isolation, and cgroup resource limits
- **Arbitrary binary execution**—run Node.js, Python, Go, Rust, or any compiled executable
- **Filesystem access** with optional FUSE mounts for temporary storage
- **Custom network stacks** tunneled through Computer's edge infrastructure

The container backend carries higher startup overhead (tens of milliseconds to launch) but removes the constraints of the V8 sandbox.

```typescript
import { Computer } from '@cloudflare/computer';
import { ContainerBackend } from '@cloudflare/computer/backends/container';

const computer = new Computer({
  backend: new ContainerBackend({
    // Execute a native binary inside the container
    command: ['python3', 'ml-inference.py'],
    mounts: [{ source: '/tmp/models', target: '/models' }],
  }),
});

await computer.run();

```

Configuration examples appear in [`examples/container/worker-configuration.d.ts`](https://github.com/cloudflare/computer/blob/main/examples/container/worker-configuration.d.ts), which defines the TypeScript interface for container-specific options.

---

## What Is the Worker Shell Execution Backend?

The **Worker Shell backend** (often called "worker-shell") is a specialized container mode that launches a minimal init process—the worker-shell binary—which then spawns your requested command.

Located alongside the container backend in [`packages/computer/src/backends/container.ts`](https://github.com/cloudflare/computer/blob/main/packages/computer/src/backends/container.ts), the worker-shell variant differs in its entry point:

- Uses a **lightweight shell wrapper** as PID 1 instead of your program directly
- Provides **stdio piping** and **signal handling** between Computer's Durable Object and the spawned process
- Exposes a **compatibility layer** that makes arbitrary binaries behave like Worker fetch handlers

The worker-shell is the bridge that lets you treat containerized processes as if they were Worker scripts. Example configuration appears in [`examples/worker-shell/worker-configuration.d.ts`](https://github.com/cloudflare/computer/blob/main/examples/worker-shell/worker-configuration.d.ts):

```typescript
import { Computer } from '@cloudflare/computer';
import { ContainerBackend } from '@cloudflare/computer/backends/container';

const computer = new Computer({
  backend: new ContainerBackend({
    // The worker-shell compatibility layer
    command: ['worker-shell', '--', 'node', 'server.js'],
    // Shell handles HTTP-to-stdio translation
    shellMode: true,
  }),
});

// The container appears as a standard Worker fetch handler
export default {
  async fetch(request: Request) {
    return computer.handle(request);
  },
};

```

---

## What Is the Worker JavaScript Execution Backend?

The **Worker JavaScript backend** runs your code directly in Cloudflare's native V8 isolate environment—identical to standard Cloudflare Workers.

Implemented in [`packages/computer/src/backends/worker-js.ts`](https://github.com/cloudflare/computer/blob/main/packages/computer/src/backends/worker-js.ts), this backend offers:

- **Sub-millisecond cold starts** with no container launch overhead
- **Native Worker APIs**—`fetch`, `Request`, `Response`, `caches`, `WebCrypto`
- **JavaScript/TypeScript only**—no native binaries, no filesystem access, no child processes
- **Maximum density**—thousands of isolates per host, aggressive memory sharing

This is the backend to choose when your logic fits within the standard Worker model and latency is critical.

```typescript
import { Computer } from '@cloudflare/computer';
import { WorkerJsBackend } from '@cloudflare/computer/backends/worker-js';

const computer = new Computer({
  backend: new WorkerJsBackend({
    // Entry point exports a fetch handler
    entry: './src/edge-handler.ts',
  }),
});

await computer.run();

```

---

## Key Differences: Container vs Worker Shell vs Worker JavaScript

| Dimension | Container Backend | Worker Shell Backend | Worker JavaScript Backend |
|-----------|-------------------|----------------------|---------------------------|
| **Runtime environment** | Full Linux container with custom PID 1 | Linux container with worker-shell as init | Native V8 isolate |
| **Supported languages** | Any (Node.js, Python, Go, binaries, etc.) | Any (via shell exec) | JavaScript/TypeScript only |
| **Startup latency** | ~10–50ms container launch | ~10–50ms (includes shell init) | <1ms warm, ~5ms cold |
| **Filesystem access** | Full tmpfs/FUSE mounts | Via mounted directories | None (in-memory only) |
| **Native binary execution** | Yes—direct execution | Yes—via shell spawn | No |
| **Process spawning** | Yes—full PID namespace | Yes—shell manages children | No—single-threaded isolate |
| **Network model** | Custom tunnel via Computer | Custom tunnel via Computer | Native Cloudflare edge |
| **Source implementation** | [`packages/computer/src/backends/container.ts`](https://github.com/cloudflare/computer/blob/main/packages/computer/src/backends/container.ts) | Same container.ts, shell flag | [`packages/computer/src/backends/worker-js.ts`](https://github.com/cloudflare/computer/blob/main/packages/computer/src/backends/worker-js.ts) |
| **Example config** | [`examples/container/worker-configuration.d.ts`](https://github.com/cloudflare/computer/blob/main/examples/container/worker-configuration.d.ts) | [`examples/worker-shell/worker-configuration.d.ts`](https://github.com/cloudflare/computer/blob/main/examples/worker-shell/worker-configuration.d.ts) | Inline in worker-js backend |

---

## When to Use Each Execution Backend

### Choose **Container** when you need:

- Maximum isolation between workloads
- Custom Linux distributions or system libraries
- Long-running processes with significant resource consumption
- Direct control over the container lifecycle

### Choose **Worker Shell** when you need:

- Compatibility with existing CLI tools or servers (e.g., a Python HTTP server)
- HTTP request translation to stdio-based programs
- The simplest path from containerized code to Worker-compatible interface

### Choose **Worker JavaScript** when you need:

- Lowest possible latency for request handling
- Integration with Cloudflare's edge caching and KV/DO primitives
- No dependencies outside npm/JS ecosystem
- Maximum execution density and cost efficiency

---

## How the Backends Are Tested

The [`packages/computer/tests/worker-backend.test.ts`](https://github.com/cloudflare/computer/blob/main/packages/computer/tests/worker-backend.test.ts) suite validates behavior across all three execution modes. Tests verify:

- Correct process isolation in container backends
- HTTP request/response translation via worker-shell
- V8 isolate lifecycle management for Worker JavaScript
- Error propagation and resource cleanup

Running these tests ensures parity where possible and documents the invariant differences between backends.

---

## Summary

- **Container backend** provides full Linux container isolation for arbitrary binaries with filesystem and network capabilities—implemented in [`packages/computer/src/backends/container.ts`](https://github.com/cloudflare/computer/blob/main/packages/computer/src/backends/container.ts).

- **Worker Shell backend** is a container variant using a compatibility shim to present containerized processes as Worker handlers—configuration shown in [`examples/worker-shell/worker-configuration.d.ts`](https://github.com/cloudflare/computer/blob/main/examples/worker-shell/worker-configuration.d.ts).

- **Worker JavaScript backend** executes pure JS/TS in native V8 isolates for sub-millisecond starts—implemented in [`packages/computer/src/backends/worker-js.ts`](https://github.com/cloudflare/computer/blob/main/packages/computer/src/backends/worker-js.ts).

- Startup latency increases from **Worker JS (<1ms)** → **Worker Shell (~10–50ms)** → **Container (~10–50ms)**, while flexibility increases in reverse.

- Select backends based on whether you need native binaries (Container/Shell) or minimal latency (Worker JavaScript).

---

## Frequently Asked Questions

### Can I switch between execution backends without changing my code?

Partially. The Worker JavaScript backend requires a JavaScript fetch handler, while Container and Worker Shell backends can wrap arbitrary executables. If your logic is already a JS module, you can switch between Worker JS and Worker Shell (which can `node your-script.js`). Pure binaries require Container or Worker Shell.

### Does the Worker Shell backend add overhead compared to direct Container execution?

Yes—approximately 1–2ms for the shell process to initialize and set up stdio pipes. This is usually negligible compared to container launch time. The benefit is automatic HTTP-to-process translation without modifying your binary.

### Why does Container backend exist if Worker Shell can run any binary?

The Container backend with custom PID 1 gives you direct control over the init process, signal handling, and container layout. Worker Shell imposes a specific initialization pattern. Use Container when you need to replace the shell entirely or run container-native orchestration.

### Is filesystem persistence available across requests in any backend?

No backend provides durable persistence by default. Container and Worker Shell mounts are tmpfs-backed and destroyed with the container. Use Cloudflare KV, Durable Object storage, or R2 for persistent data across invocations.