Technical Support Engineer - Application Performance

Cloudflare traces turns the proxy layer into OpenTelemetry spans, with new volume-based pricing. * Steef-Jan Wiggers Cloud Queue Lead Editor | Domain Architect | Cloud Expert Follow InfoQ on. Cloudflare has recently made Traces available in open beta, extending automatic tracing from Workers to the rest of the request path. Security rules, transformations, cache decisions, routing, Worker execution, and origin handling now appear as OpenTelemetry spans in a single request-level timeline, without any instrumentation to write. A pricing change arrives with it, and it applies to Workers Tracing too. This fills a well-known gap for developers running distributed tracing through a proxy. Previously, the trace showed the client and then the application, with everything in between inferred from logs and configuration. Each supported step now arrives as a span with its timing, outcome, and attributes. The questions Cloudflare uses as examples are the ones developers actually open tickets about. Which security rule blocked the request, and how long did rule evaluation take? Did a Transform Rule rewrite the URL before the application received it, and where did that happen relative to routing? Which Page Rule, Snippet, or Worker handled the request, and which route pattern matched? And where did the time go: one example shows a cache miss where 527ms of a 539ms request went to getting a response from the origin. Nested cache, upstream, and origin spans showing where a request spent its time (Source: Cloudflare blog post) Context propagation is what makes it more than a Cloudflare-only view. Traces can accept a W3C traceparent header from an incoming request, so Cloudflare spans join a trace that started upstream, and can forward a new traceparent to the origin for instrumented services to continue. An incoming propagation policy controls whether Cloudflare accepts context from callers at all, which matters because accepting a trace ID from any client opens the door to noise. Sampling runs on the same rules engine Cloudflare uses elsewhere. Teams set a baseline rate, perhaps 1% in normal operation, then write Trace Rules that override it for matching traffic. One example traces every request for a single customer's hostname, source IP, or identifying header while everyone else stays at the baseline. Another captures every request carrying a temporary debug header during an investigation. Rules can target paths, methods, headers, addresses, geographies, or combinations of those. Spans export over OTLP to any compatible backend. Teams configure an account-level destination, then choose which domains send traces to it. Cloudflare frames this as a commitment to OpenTelemetry and to keeping the data portable across observability tools. There is an agent angle. Through the Cloudflare Observability MCP server, a coding agent can query traces using the SQL API, compare failed traces against successful ones to find where the spans diverge, and connect those findings to code in the repository. This continues the pattern InfoQ covered in Cloudflare's agent tracing work in August, where telemetry becomes something an agent reads rather than a dashboard a person watches. Teams already using Workers Tracing should note the pricing change, which is the second in two months. That August coverage reported that every span would become a billable event from October 1, 2026. Cloudflare now replaces that model on December 1, 2026, charging instead for data ingested and retention. The free plan includes 0.5GB of ingestion per day with seven-day retention and no additional usage. Paid and Enterprise plans include 50GB of ingestion and 10GB-month of storage per billing cycle, with additional usage at $0.25 per GB ingested and $0.10 per GB-month stored. Retention of up to one year is listed as coming soon. Charging by volume rather than by span is the more consequential half. Sampling decisions now map directly to a bill, which explains why Trace Rules take the shape they do: keep the baseline low, raise it for the traffic under investigation. Coverage is partial by design, and Cloudflare lists what is still missing. Broader automatic instrumentation is planned across the HTTP request path, including DDoS rules and Access, and the Workers execution path, including Workflows, Queues, and Pipelines. Also planned are authenticated context propagation, so trusted callers can continue a trace without Cloudflare accepting context from everyone, ad hoc tracing of a specific request without changing the baseline rate, and OpenTelemetry API support in Workers for adding attributes to existing spans. Traces is available in open beta from the dashboard, the API, or Terraform, on any domain, with export to an OTLP destination. Steef-Jan Wiggers. Steef-Jan Wiggers is one of InfoQ's senior cloud editors and works as a Domain Architect at VGZ in the Netherlands. His current technical expertise focuses on implementing integration platforms, Azure DevOps, AI, and Azure Platform Solution Architectures. Steef-Jan is a regular speaker at conferences and user groups and writes for InfoQ. Furthermore, Microsoft has recognized him as a Microsoft Azure MVP for the past sixteen years.

Sharing a draft of Personal Agent Protocol. Since announcing this new protocol on Tuesday with Meta and Genesys, Instinct, NiCE, Rocket, Shopify, Stripe, and Walmart, the response has been overwhelming. So today Sierra is publishing a draft of Personal Agent Protocol, known as Poppy, and announcing an additional 35 design partners: Adyen, Atomic, Bank of America, BBVA, Chime, Cigna, Cloudflare, Comcast, DIRECTV, ElevenLabs, FOX, Gap Inc., GEICO, Hertz, Insurify, Klaviyo, Liberty Mutual, Mastercard, Nordstrom, Notion, Okta, OneSignal, OpenAI, PayPal, Plaid, SiriusXM, Synchrony, Target, United Airlines, Venmo, Visa, Wells Fargo, Zapier, Zendesk, and 1Password. These companies will participate in the design process for the draft Personal Agent Protocol, contributing valuable feedback from their unique business perspectives. Today, when someone asks their personal agent to make a purchase or resolve an issue, it often has to sign in as the customer and navigate pages built for people. Businesses have no standard way to help guide the agent, which limits what the customer, their personal agent and the brand can do directly together. With the Personal Agent Protocol, consumers have choice and control, and companies know when they're dealing with an agent and who it represents. How Personal Agent Protocol works. Poppy is built on the principle that customers decide what access to give their personal agents, and companies set parameters for what those agents can do. This enables companies to work with personal agents in the way that is best for their customers: through their existing websites and APIs, or through an agent of their own. Poppy defines five building blocks for how personal agents and companies work together. * Discovery. Companies publish one file at a standard address on their website (/.well-known/poppy.json). This tells personal agents how to interact with the company, how customers can sign in, and what the agent can do. * Sessions. The personal agent starts a session on its customer's behalf. It can begin as a guest, which may be enough to check whether a product is in stock or ask about a returns policy. The personal agent identifies itself, so the company always knows when an agent is acting for a customer. * Sign-in. When a task needs the customer's account, the person signs in on the company's page through OAuth. If permitted by the company, the agent can sign in on the customer's behalf with a session token that grants only the access the customer approved. * One session across every channel. The same token works for the company's APIs, its website and conversations with its agent. A question asked before sign-in and an order change made afterward are part of the same visit. The customer doesn't have to start over, and the company sees the whole journey instead of disconnected fragments. * Getting the job done. The company decides which channels to offer, based on what works best for its customers: * Its website: the agent browses the company's regular pages, and the company applies the customer's permissions on each one. * Its APIs: the agent connects through interfaces built on standards such as OpenAPI and MCP. * Its own agent: for tasks that need conversation, such as a warranty claim or an exchange. Replies can stream as they're written, and companies can hold a request open until there's news to share. Built on standards companies already use. A company can start with what it already has and add more over time. Companies can connect once through Poppy, rather than building a separate connection for each personal agent. The protocol is built on OAuth, JSON Web Tokens (JWTs), HTTPS, OpenAPI and MCP. Because these are open and widely used, teams can implement it with libraries and tools they already have. The core is also designed to be extended, so industries can build their own layers on top. Protocols such as Universal Commerce Protocol (UCP) focus on shopping, from finding products to checking out and managing orders. Personal Agent Protocol is complementary, covering how a personal agent identifies itself, gets the customer's permission, and works with a company across any kind of task - from buying a sweater to applying for a mortgage. What it looks like in practice. Personal Agent Protocol works whether a company offers its website, its APIs or its own agent. * Through a website. A customer asks their personal agent to return a jacket. The agent finds the retailer using the protocol, identifies itself, and the customer signs in once. The agent then uses the retailer's regular returns page. The retailer knows it's an agent acting for a signed-in customer, and lets it start a return but not change the payment details on file. * Through APIs. A customer's flight is canceled, and they ask their personal agent to rebook them. The agent connects to the airline's booking tools through MCP using the customer's approved access. It finds the next available flight and confirms the seat with the customer before booking. * Through a company agent. At Sierra Summit on Tuesday, Alex McGillis, VP of Product at Rocket, showed the protocol live featuring Meta's personal agent, Muse. Alex asked Muse to get pre-approved for a mortgage. Muse went to Rocket's website, found Rocket's agent through Poppy, and asked Alex for permission to connect. Alex then signed in to share the credit and income details a mortgage needs. The two agents worked through the purchase price, down payment and interest rate and within moments, Alex had a pre-approval letter ready. While he was in control at every step of the way, the agents did all the work. What comes next. This draft is a starting point. Over the next month Sierra will host design workshops and publish a reference implementation to help developers get started. As personal agents grow in popularity and take on more work, its goal is simple: customers choose who acts for them, companies know who they are working with, and both can do so securely and within the boundaries they set. Sierra'd love as many companies as possible to read the draft and help shape this new protocol.

Cloudflare adds production flamegraphs to Workers, exposing where CPU and memory go. The on-demand profiles cover Workers and Durable Objects; Cloudflare's examples show what brief, traffic-dependent captures can reveal and what they miss. By RuntimeWire Staff - Published Oct 9th, 2026, 8:32am CT - 3 MIN READ - 3 SOURCES - VIA The Cloudflare Blog Listen to article. Cloudflare added on-demand CPU and allocation profiling for Workers and Durable Objects, giving developers a way to inspect code running in production instead of relying only on logs and aggregate metrics. The feature, described in an October 9th post on the Cloudflare Blog, renders profiles as interactive flamegraphs in the dashboard and lets users download them for analysis with other tools. The post is by Dominik Picheta, a Cloudflare software engineer who previously worked at Meta. Picheta is also the author of Nim in Action and a contributor to the Nim programming language. In a serverless environment, reproducing production traffic locally can be difficult. Developers can choose a Worker version and capture duration, then inspect the flamegraph or download a pprof profile. Cloudflare's production profiling documentation lists capture durations from one to 50 seconds and also documents profiling a specific Durable Object instance through the dashboard, CLI or API. A profile can find waste hidden in ordinary code. Cloudflare's clearest CPU example comes from the Worker behind its R2 object-storage binding. In a 50-second capture, the genericR2JsonReplacer function accounted for more than 5% of CPU time. The team found that JSON serialization was already walking a tree while the replacer walked it again, repeating work on nested values. Cloudflare says removing that duplicate traversal made the function 2.7 times faster. A second finding involved a duplicate call to a metrics function, which accounted for about 1% of CPU time in the profile. Reusing the first result removed the extra work. The figures come from Cloudflare's own example, not an independent benchmark. The profile showed the team where familiar code paths were doing unnecessary work. The memory example connects profiling to a harder operational problem. Cloudflare says an internal Worker was frequently evicted after its P999 memory usage reached about 133 MB, above the 128 MB limit. A heap profile showed that Prometheus instrumentation, which the team believed was disabled, still accounted for roughly 66.7% of allocations in the capture. After the code path was removed, Cloudflare reported P999 memory falling to 118 MB, leaving about 10 MB of headroom. Production access comes with constraints. The capture is on demand, not continuous. A Worker or Durable Object must already be active and receiving traffic during the selected window; profiling does not generate requests or start a fresh isolate. Developers need the relevant code to run while the profiler is collecting data. Cloudflare says profiling requests are also rate limited, and availability can vary by environment. Memory profiling samples allocations made during the capture window. It is not a heap snapshot and does not show which objects remain in memory. A short profile can help locate allocation-heavy code, but it cannot by itself establish that a function is retaining memory or explain allocations that happened outside the capture. Cloudflare's post also says TypeScript projects should enable source maps so profiles show useful function names. Without them, minified or obfuscated names can make a flamegraph much less actionable. Developers need to select an active version with suitable traffic, exercise the code path, and make sure the build preserves source-level mappings. Cloudflare says it is working on continuous profiling to make intermittent problems easier to catch. Continuous profiling could catch a rare spike that ends before an engineer starts a manual capture. RuntimeWire, Inc. get virtually zero search traffic. Please consider sharing this story. Signal check Noise Signal Where does this story land? Drag the dial. The company One platform for your apps, agents, and workforce to build, secure, and scale without managing infrastructure. San Francisco 26 stories Cloudflare is a connectivity cloud that combines network, security, and developer services on a single global platform. Its network runs in 335+ cities across 125+ countries, within 50ms of 95% of the world's population. The company serves an average of 102 million HTTP requests per second, proxies roughly 20% of the web's traffic, and powers 42% of the Fortune 500. Customers include Shopify (featured case study), and logos shown include the U.S. Department of Commerce, L'Oreal, and Labcorp. Core offerings span Network & CDN, SASE/Zero Trust, and Compute & Storage. Developer products include Workers, Durable Objects, Workers KV, R2 object storage, and SQL. Cloudflare emphasizes paying only for compute time (not wall time) and no capacity planning. Pricing highlights: Application services tiers include Free ($0/month with Unmetered DDoS, Universal SSL, Global CDN), Pro ($20/month billed annually or $25/month billed monthly with Image optimization, Bot protection, Ticket support), Business ($200/month billed annually or $250/month billed monthly with PCI DSS 4.0, 100% uptime SLA, Chat support), and Contract (custom, with Network priority, 24/7 support, custom terms). Zero Trust pricing offers the first 50 users free, then $7 per active user per month (with 100% uptime SLA and 30-day logs on pay-as-you-go; Contract adds unlimited CASB & DLP, Logpush, and 24/7 phone support). The developer platform has a Free tier (e.g., 100,000 daily requests, 1M KV daily reads, 25 AI daily requests, 10GB R2 storage, 5GB SQL stored data) and Paid plans starting at $5/month with usage-based rates such as $0.30 per million requests and $0.02 per million CPU ms. Cloudflare is publicly traded on the NYSE under the ticker NET (IPO on September 13, 2019). Stay on the wire. Breaking startup & AI news, funding scoops, and launches as they happen. Follow @runtimewire on Threads and LinkedIn.