camelAI moves its AI agent from VMs to Cloudflare's edge
- Most teams run AI agents inside full Linux virtual machines. camelAI did too—until the numbers convinced it to dismantle the machine entirely.
- The overhaul came in three steps: move the AI agent out, move the files into a database, then remove the command line. Nothing changed for users.
- Removing the command line was the most radical step. But in the code, "removed" still leaves a narrow escape hatch.
An always-on machine and high-speed disk for every user could not support camelAI's planned scale
This is camelAI CTO Miguel Salinas's account of an architectural overhaul. The team completely rebuilt its AI agent, moving it from dedicated virtual machines to a lightweight architecture running on Cloudflare Durable Objects. According to camelAI, both cost and latency fell sharply. The migration happened in three stages, and all the code was open-sourced on July 24, making every mechanism verifiable in the repository.
New to camelAI? Here's the short version
camelAI is an AI coding assistant built by a three-person team: Illiana Reed leads product, Miguel Salinas leads engineering, and Isabella runs operations.
You tell it what you want in a chat box. It writes the code, installs dependencies, runs the project, and deploys it to a working URL. It can also connect to your databases and dozens of external services, run Python notebooks, and build dashboards.
The company's own description is "an AI software engineer that lives in its own computer." That "computer" was a Linux virtual machine assigned to each user—and it is exactly what this overhaul removes.
Most teams run AI agents in full Linux virtual machines or container sandboxes. camelAI started the same way.
The problem was the cost structure. Every user needed an always-on machine plus high-speed disk storage for project files. As the user base grew, scaling meant adding real machines and real disks. At camelAI's planned scale, the economics did not work.
The hard part is that AI agents naturally assume they are running on Linux. They have been trained to reach for bash whenever they hit a problem. camelAI also started with the Claude Code harness, which itself requires a full virtual machine. A harness is the software layer around the model that runs the conversation loop and manages tools and state.
Instead of trying to schedule virtual machines more efficiently, the team redesigned the system around a more fundamental premise: it did not need virtual machines at all.
Just over four months earlier, camelAI CEO Illiana Reed had published a post beginning, "Every camelAI user has a persistent computer, a real Linux environment," calling it a core product promise. The post explained that Modal, Cloudflare Containers, and Fly.io's Sprites had all proved unsuitable, so the team spent a week building its own container service. Miguel notes that the old post remains online, although camelAI no longer runs any machines on that infrastructure.
The virtual machine contained three things: the AI agent itself, the project files, and the command line. The three-stage overhaul moved them out one by one. Each time, the team had to answer the same question: who would take over the work that component used to do?
First, move the AI agent: faster responses, but the machine remains
The Claude Code harness could not be separated from its virtual machine, so the first job was to write a new one.
The foundation was pi, Mario Zechner's open-source AI agent toolkit, released under the MIT license and holding 81,000 GitHub stars. pi is a stack of libraries, not a single program. Its top layer is a command-line tool that assumes an operating system underneath it. The lower layers provide the raw components an AI agent needs—conversation loops and state management—without caring where they run. camelAI did not modify a single line of pi. It simply used the bottom two layers.
camelAI's package.json includes only @earendil-works/pi-agent-core and @earendil-works/pi-ai, both at version 0.80.6. It does not include pi-coding-agent, the command-line layer that assumes an operating system is present.
The new harness runs inside a Durable Object. This is a small Cloudflare compute instance with its own dedicated storage, activated in a data center close to the user. camelAI assigns one to each chat session.
A conventional cloud service is like taking a number at a bank. A different teller may handle you each time, so you have to explain everything again. A Durable Object is more like a dedicated receptionist with a private drawer: you return to the same person, and the drawer still contains whatever you left there last time.
The virtual machine still exists at this stage; the AI agent simply no longer lives inside it. When a command needs to run, the AI agent calls the machine remotely. Anthropic describes its own hosted AI agents in similar terms: the brain and the hands are separated.
This brought three benefits. The AI agent could respond without waiting for a machine to boot. The machine could sleep while the AI agent worked—and stay asleep for the entire turn if no command was needed. One brain could also direct several hands, operating multiple machines at once.
In the product, those "hands" are called projects. Each project had a virtual machine and a Git repository, created directly from code with Cloudflare Artifacts, so camelAI did not need to operate its own Git server. At this stage, the AI agent still had a command line and was largely unaware that it no longer ran inside the virtual machine.
Next, replace the disk: store files as data and eliminate always-on machine costs
The next version removed the virtual machine without changing the project structure. The file system moved into the Durable Object, while large files went to Cloudflare R2, Cloudflare's object storage service.
The building blocks already existed. Cloudflare's Agents team had created a package called @cloudflare/shell, which describes itself as "an experimental Worker sandbox execution and filesystem runtime." camelAI reused substantial parts of its code.
A Durable Object's storage is already a SQLite database, with a 10 GB limit per instance and a per-row size limit. Small files are therefore stored directly in a row. Files larger than roughly 1.5 MB go into Cloudflare R2, leaving only a pointer in the database row. To the AI agent, it still looks like a normal file system. Underneath, it is a table and an object store.
- The threshold is a hard-coded constant in
workspace-filesystem-do.ts:DEFAULT_INLINE_THRESHOLD = 1_500_000, or 1.5 million bytes. - Cloudflare's official documentation sets the storage limit for each SQLite-backed Durable Object at 10 GB on the paid plan, with a 2 MB limit per row. The 1.5 MB threshold leaves headroom below that hard 2 MB ceiling; it was not chosen arbitrarily.
In the virtual-machine architecture, files persisted because camelAI kept paying to maintain a machine and its disk. Now files persist because the data itself has been stored. Idle data is cheap; an idle machine is not. That is where this step cuts the real cost.
Version history still runs through Cloudflare Artifacts, so every project retains a complete Git history.
Finally, remove the command line: the AI agent writes JavaScript to call fixed methods
Removing the command line was the most radical of the three steps. camelAI says so itself.
The problem was not just cost. If an AI agent can run arbitrary commands and access the internet, it needs credentials to get useful work done—database passwords, API keys, and more. The team tried keeping credentials outside the environment through authenticated proxy URLs, but the implementation became increasingly fragile and difficult to secure.
So camelAI removed the command line. The AI agent now writes JavaScript, which is executed through Cloudflare Code Mode. Instead of invoking one tool at a time, it writes a block of code that chains the necessary work together. Each execution starts in a fresh V8 isolate.
A V8 isolate is not a new computer. It is closer to opening a new tab in a browser that is already running: it appears in a few milliseconds, uses only a few MB of memory, and disappears when the work is done. The next task gets another clean instance. According to Cloudflare, starting a container takes hundreds of milliseconds and consumes hundreds of MB.
Credentials stay outside the sandbox
The sandbox comes with access to the user's data connections and methods for everything the platform can do. Credentials never enter the sandbox. When the AI agent calls a connection method, authentication happens on the platform side. The key never appears anywhere the AI agent can reach.
How much capability is lost without the command line?
Most of what the AI agent used the command line for was file manipulation: listing directories, reading files, editing files, and searching content. Native tools cover roughly 80% of that work. The remaining 20% consisted of specific commands for specific jobs, which the team converted into explicit methods one by one.
The "Anything goes" line on the left is exactly what disappeared. The AI agent can now do only what the team has anticipated and implemented among those 64 methods.
- The public description says "read, write, edit, plus our own grep and glob." The code actually contains 7 tools:
read/write/edit/ls/grep/find/delete. The extras arelsanddelete, while glob is namedfindin the code. - The file containing the methods,
code-mode-tools.ts, is 4632 lines long and registers 64 methods. These include platform operations such asdeploy_projectandrun_notebook, along with general-purpose harness tools such asWebSearchandTodoWrite. - The sandbox also provides
tools.search(). The AI agent searches for tools by keyword, then usestools.describe()to inspect their parameters. It does not need all 64 manuals loaded into its context at once. - The system prompt contains a hard rule: do not use create-worker, wrangler, or package-manager commands for scaffolding, builds, or deployment. It explicitly blocks the model's old habits.
Deployment is the clearest example. Previously, the AI agent ran wrangler deploy through a proxy. The platform had to inspect proxy traffic and infer which session had deployed something. Now deployment is handled by a platform-controlled deploy_project method. The platform knows exactly when a deployment occurs, so it can attach a hook and automatically open the preview when deployment finishes.
The results: reportedly lower costs, faster responses, isolated credentials, and open-source code
After all three steps, the new architecture reportedly delivered four gains.
Cost: from paying for uptime to paying per execution
Virtual machines and containers incur ongoing costs.isk charges whenever they are awake, even when no one is using them. An isolate exists only when invoked and disappears when the work is done. When it is not running, it does not exist—and generates no bill. Scaling no longer means adding real machines and real disks.
camelAI's comparison is that thousands of executions cost roughly the same as a few minutes on the container services it evaluated. The independently checkable figures are Cloudflare's own numbers, published in its March 24, 2026 announcement for Dynamic Workers:
But the entire post lacks a before-and-after bill. Its conclusion says costs are "orders of magnitude lower," yet it never provides numbers such as the previous monthly cost and the current one. That claim comes from camelAI alone and cannot be independently checked by readers.
Latency: the AI agent runs in the data center closest to the user
The AI agent runs on Cloudflare's edge, so requests no longer detour through a central virtual machine. It does not wait for a virtual machine to boot either; it can begin responding as soon as the user finishes speaking.
Security and cheaper models: credentials stay out, and tool boundaries become clearer
Credentials never enter the sandbox. Authentication happens on the platform side, so the AI agent never holds a key.
A command line is open-ended: almost anything can be typed into it. Cheaper models are more likely to experiment aimlessly, take detours, or get stuck in that environment. camelAI says they perform noticeably better when given a small set of methods with clear boundaries. That feeds directly into cost. Making the product economical is the point of the architecture, and model spending has to fall too.
There are no public numbers for this claim either. The repository contains 52 test files that run real models, plus a group with camel-free- in their filenames, apparently intended for cheaper models on the free tier. But no benchmark results have been published.
All the code is open source
camelAI released its repository under the MIT license on July 24 at Github.com/qaml-ai/camelAI. Every mechanism described above can be traced to its corresponding source file. That is how the items marked "Verified" in this article were checked.
After the teardown, Linux survives in only three places: building apps, running data analysis, and querying databases
Building a user's application still requires a container because this work genuinely needs Linux. User applications are built with Vite, Tailwind, and React Router, and adding a dependency requires bun install.
The team considered building inside a Worker, since the finished application is itself a Worker. But Cloudflare does not support that path well, and a Worker has only 128 MB of memory and a fraction of one CPU. Builds would be slow, and many projects would simply run out of memory. We verified the 128 MB limit in Cloudflare's official documentation; it is the same on free and paid plans.
The solution is to start a container when a build is needed, copy the project in, run the build, retrieve the result, and shut the container down. Notebooks work the same way. Linux is still used—but only for the few seconds when it is genuinely necessary.
The public account mentions two containers, but the production configuration actually defines three categories. The third runs SQL queries and data exports and is not mentioned in the blog. A code comment explicitly says that this container does not run user code.
| Container | Purpose | Size | Maximum | Sleep after idle |
|---|---|---|---|---|
| Build sandbox | Runs bun install and frontend builds | 2 vCPU · 8 GiB | 100 | 2 minutes |
| Analysis sandbox | Runs notebooks, shell, and DuckDB | 2 vCPU · 8 GiB | 100 | 5 minutes |
| Query sandbox | Runs SQL queries and exports (not publicly mentioned) | 0.5 vCPU · 4 GiB | 25 | 2 minutes |
Data comes from the repository's production configuration and container-sizing.ts.
Code comments explain why the idle timeout is only 2 to 5 minutes: memory and disk are billed by provisioned capacity for as long as the container remains awake; only CPU is billed by actual usage. A running container burns money even when it is doing nothing. This is the same rule that explains why camelAI removed its always-on virtual machines, just at a different scale.
"Removing bash" still leaves an escape hatch in the code
The repository includes a method called analysis_exec, which can run shell commands inside the analysis container. Its tool description explicitly calls it an escape hatch for data tasks that run_notebook cannot handle.
Strictly speaking, then, the command line has not disappeared from the system. It has disappeared from the AI agent's everyday workspace and become a narrow, purpose-specific route through a designated container. That is very different from giving the AI agent unrestricted access to bash at all times—but it is not the same as literally removing the shell.
The AI agent can no longer improvise its own route; the team must anticipate every missing capability
camelAI acknowledges this directly. With a command line, an AI agent can work out its own solution when it encounters something unfamiliar. Now, whenever a capability is missing, the team has to add it.
The honest downside is that we have to anticipate what the AI agent will need. With bash, it could explore on its own. Now, if a capability is missing, we have to add it.
Miguel Salinas, camelAI CTO
The team believes that pressure is good for the product. It forces camelAI to understand what users are actually trying to do and build a proper path for it, instead of letting the AI agent improvise in production.
There is another unmentioned cost
We read camelAI's grep implementation. It loads every file under a directory and scans it line by line in JavaScript. It can inspect up to 20,000 files, returns 100 matches by default, and truncates lines longer than 500 characters.
A purpose-built tool such as ripgrep is a compiled program optimized for parallel disk searches. The two are not in the same performance class. Small projects may hide the difference. The public material does not explain what happens when repositories grow large.
An AI agent does not need a computer—and camelAI had to dismantle one to see it
The industry's default approach is to reproduce a human programmer's work environment for an AI agent: a machine, a file system, and a command line. That is how human programmers work, so the AI agent gets the same setup.
After removing that environment piece by piece, camelAI concluded that an AI agent really needs precise capability interfaces. If it needs file operations, give it seven tools. If it needs deployment, give it a method. It does not need to know whether a real computer exists underneath.
The migration path itself is the method: first separate the AI agent from its environment, then move state out of the machine and into data, and finally replace open-ended capabilities with bounded interfaces. Each step can be tested and rolled back independently, making the process far less risky than replacing everything at once.
Nothing changed for users. They still ask the AI agent to build an application and deploy it to a working URL. The AI agent still reads files, writes files, searches content, and publishes projects. The promise from four months earlier—"every user has a persistent computer"—remains intact. That "computer" is now a database table plus a disposable sandbox.
One piece still blocks anyone trying to reproduce this today
Cloudflare Artifacts remains in closed beta. The official documentation, last updated May 5, 2026, says access requires submitting an application form. The version-history layer in this architecture does not yet have a public entry point.
Another issue is not a hard barrier, but it is worth knowing: @cloudflare/shell describes itself as "experimental." The package debuted on March 13, 2026 and had released 19 versions by July 23. The latest was 0.4.3, while camelAI pins version 0.3.7. Nineteen releases in just over four months suggest that this foundation is still changing rapidly.
What anyone can use immediately is the code itself. camelAI released the repository under the MIT license on July 24, and every mechanism has a corresponding source file.
workers/main/src/chat-thread-do.ts contains the AI agent's main loop running inside the Durable Object (Step 1); workspace-filesystem-do.ts implements the database-backed file system, with the 1.5 MB threshold near the top (Step 2); code-mode-tools.ts contains the 64 methods that replace the command line (Step 3); and pi-container-tools.ts contains the 7 file tools, including the line-by-line grep implementation.camelAI dismantled the Linux machine beneath its coding AI agent in three steps—and open-sourced everything
camelAI's CTO published the full architectural breakdown: move the AI agent, replace the disk with a database, and remove the command line. Here's the illustrated one-page version.
↓ The whole story on one page · Includes an animated diagram
camelAI is an AI coding assistant: you describe what you want in a chat box, and it writes the code, installs dependencies, and deploys the project to a working URL. Its original pitch was "a persistent Linux computer for every user." That computer was a Linux virtual machine in the cloud, complete with its own disk and command line—and it kept billing for as long as it stayed on.
The problem was the cost structure. Giving every user an always-on machine with a high-speed disk meant that every jump in users required more physical compute and storage capacity.
Illustration only; the original post provides no exact duration. The gap between these two bars is what the virtual-machine approach costs. So the team did not optimize scheduling. It started over from the premise that no virtual machine was needed.
The virtual machine contained three things: the AI agent itself, the project files, and the command line. The three refactors moved them out one by one. Each move had to answer the same question: who would now do the work that component used to handle?
The first step fixed latency, but the machine still occupied resources. The second eliminated the cost of the persistent machine and disk, while the AI agent's compute still billed by the minute. Only the third step addressed compute. Each change could be tested and rolled back independently.
Once the virtual machine was gone, the file system moved into a Durable Object—a small Cloudflare compute instance with dedicated storage. It wakes up in the data center nearest the user, with one instance assigned to each chat session. Its storage is already a SQLite database.
Files exist only while it runs
It bills even when idle
data.csv → Over 1.5 MB, only a pointer remains
The file goes into Cloudflare R2 object storage
This is the key distinction. In the virtual-machine era, files persisted because you kept paying to maintain a machine. Now they persist because the data has been stored. Idle data is cheap. Idle machines are not.
Cost was not the only reason to remove the command line. An AI agent that can run commands and access the internet needs credentials such as database passwords and API keys to get anything done. camelAI tried shielding those credentials behind authenticated proxy URLs, but the implementation grew increasingly messy.
So the team removed direct command-line access. The AI agent now writes JavaScript, and every execution starts in a fresh V8 isolate—a small, independent runtime separated within the same process. It starts in milliseconds, uses only a few MB, and disappears when the job is done. It is closer to opening a new tab in an already-running browser. Credentials never enter the sandbox; authentication happens on the platform side.
Our code review found two differences from camelAI's public account: there are actually 7 file tools, not the 5 it mentioned, and the methods file registers 64 methods.
A container bills for memory and disk whenever it is awake, even when nobody uses it. An isolate starts only when called and disappears after execution. According to camelAI, several thousand executions cost roughly the same as a few minutes on the container services it evaluated. This comparison has not been independently verified.
Two more caveats matter. The repository retains a method that can run shell commands inside the analysis container, explicitly described in a comment as an "escape hatch." The shell has not disappeared from the system; it has disappeared from the AI agent's everyday workspace. camelAI's custom grep scans files line by line in JavaScript, up to 20,000 files. That is not in the same league as a purpose-built, optimized search tool, and the post does not address the cost as repositories grow. There is also a roadblock for anyone trying to reproduce the architecture: Cloudflare Artifacts, which manages version history, remains in closed beta and requires an application.
short bursts,
billed nonstop.
It wakes only
to run commands.
hardcoded in the source
Idle machines do.
- × Run any
unplanned command - × Touch any credential
plus 7 file tools,
replace bash
building apps, running analysis,
and querying databases.
Members can copy or download the full Markdown, and let their AI subscribe and ask.
Found this useful? Leave your email — every new explainer, the moment it's out. Unsubscribe anytime.