Cloudflare Rewrites Core System in Rust: 25% Faster and 50% Less CPU
Hello HaWkers, Cloudflare just released one of the most impressive Rust migration success stories we've seen in the industry.
Have you ever wondered what happens when one of the largest internet infrastructure companies decides to completely rewrite its core system? The results are absolutely spectacular.
What Cloudflare Did: The Massive Migration
Cloudflare replaced its FL system (Cloudflare's "brain" that existed for 15 years) with a new version called FL2, completely rewritten in Rust. This was not a small project - more than 100 engineers worked on this migration throughout 2025.
The FL system is crucial: once a request reaches Cloudflare's network, it's FL that executes all the security and performance features the company offers. We're talking about processing billions of requests per day.
The decision to migrate from NGINX (with a mix of C, Rust, and Lua) to a completely new system in pure Rust was bold, but the numbers prove it was worth every line of rewritten code.
The Impressive Numbers
The performance gains exceeded the most optimistic expectations:
Performance and Resources
- 25% increase in overall performance
- 10ms reduction in response time
- 50% less CPU usage compared to the previous system
- Less than half the memory used
Security and Stability
- Dramatic reduction in crashes, with most remaining crashes being hardware failures
- Compile-time security guarantees from Rust
- Zero vulnerabilities related to memory safety since launch
These numbers are not theoretical - they are real measurements in production, processing a significant percentage of global internet traffic.
Why Rust Made Such a Difference
The choice of Rust was not due to hype or trend. Rust offers unique characteristics that make all the difference in critical infrastructure systems:
1. Memory Safety Without Garbage Collection
Rust guarantees memory safety at compile time, without needing a garbage collector. This means:
// In Rust, this simply doesn't compile
// The compiler detects problems BEFORE the code runs
fn process_request(data: &mut Vec<u8>) {
let reference = &data[0]; // Gets immutable reference
data.push(42); // ERROR: can't modify with immutable reference active
println!("{}", reference); // Reference usage
}
// The correct version in Rust:
fn process_request_safe(data: &mut Vec<u8>) {
// Uses and discards reference before modifying
if let Some(first) = data.first() {
println!("First byte: {}", first);
} // reference dies here
data.push(42); // Now it's safe to modify
}This type of guarantee eliminates entire classes of bugs that are common in C/C++.
2. Zero-Cost Abstractions
Rust allows writing high-level code that compiles to code as fast as C:
// High-level and readable Rust code
fn process_headers(headers: &[(String, String)]) -> HashMap<String, String> {
headers
.iter()
.filter(|(key, _)| !key.is_empty())
.map(|(k, v)| (k.to_lowercase(), v.clone()))
.collect()
}
// Compiles to assembly code as efficient as C
// No runtime overhead!FL2 Architecture: Modular and Extensible
The new FL2 architecture was designed to be modular from the start. Unlike the previous system that grew organically over 15 years, FL2 was designed to:
Modular Proxy System
// Simplified FL2 structure
pub struct ProxyCore {
router: Router,
middleware_chain: Vec<Box<dyn Middleware>>,
security_layer: SecurityLayer,
cache: CacheManager,
}
impl ProxyCore {
pub async fn handle_request(&self, req: Request) -> Response {
// Processing pipeline
let ctx = self.create_context(req);
// Executes middlewares
let result = self
.middleware_chain
.iter()
.fold(Ok(ctx), |acc, middleware| {
acc.and_then(|ctx| middleware.process(ctx))
})?;
// Applies security rules
let secured = self.security_layer.validate(result)?;
// Checks cache before making upstream request
if let Some(cached) = self.cache.get(&secured.cache_key()) {
return Ok(cached);
}
// Processes and returns
let response = self.router.route(secured).await?;
self.cache.set(secured.cache_key(), response.clone());
Ok(response)
}
}
// Each middleware is isolated and testable
trait Middleware: Send + Sync {
fn process(&self, ctx: Context) -> Result<Context, Error>;
}Integrated Security Features
FL2 integrates security features directly into the architecture:
pub struct SecurityLayer {
ddos_protection: DDoSProtector,
waf: WebApplicationFirewall,
rate_limiter: RateLimiter,
ssl_validator: SSLValidator,
}
impl SecurityLayer {
pub fn validate(&self, ctx: Context) -> Result<Context, SecurityError> {
// DDoS protection
self.ddos_protection.check(&ctx.client_info)?;
// Rate limiting per IP/user
self.rate_limiter.check_limits(&ctx)?;
// WAF rules
if let Err(threat) = self.waf.scan(&ctx.request) {
return Err(SecurityError::ThreatDetected(threat));
}
// SSL/TLS validation
self.ssl_validator.verify_certificate(&ctx.ssl_info)?;
Ok(ctx)
}
}High-Performance Cache System
One of the significant improvements in FL2 is the completely rewritten cache system:
use std::sync::Arc;
use tokio::sync::RwLock;
pub struct CacheManager {
storage: Arc<RwLock<HashMap<String, CachedItem>>>,
ttl_checker: TtlChecker,
eviction_policy: LruEviction,
}
#[derive(Clone)]
struct CachedItem {
data: Vec<u8>,
headers: HashMap<String, String>,
created_at: Instant,
ttl: Duration,
hit_count: AtomicU64,
}
impl CacheManager {
pub async fn get(&self, key: &str) -> Option<Vec<u8>> {
let cache = self.storage.read().await;
if let Some(item) = cache.get(key) {
// Checks if still valid
if item.created_at.elapsed() < item.ttl {
// Increments hit counter (atomic)
item.hit_count.fetch_add(1, Ordering::Relaxed);
return Some(item.data.clone());
}
}
None
}
pub async fn set(&self, key: String, data: Vec<u8>, ttl: Duration) {
let mut cache = self.storage.write().await;
// Eviction policy if cache is full
if cache.len() >= self.eviction_policy.max_size() {
self.eviction_policy.evict(&mut cache);
}
cache.insert(
key,
CachedItem {
data,
headers: HashMap::new(),
created_at: Instant::now(),
ttl,
hit_count: AtomicU64::new(0),
},
);
}
}The Migration Process: Gradual and Safe
Cloudflare didn't simply "flip the switch" from FL to FL2. The process was carefully planned:
Phase 1: Parallel Development (2024-early 2025)
// Feature flag system for gradual rollout
pub struct RolloutManager {
percentage: AtomicU8, // 0-100
}
impl RolloutManager {
pub fn should_use_fl2(&self, request: &Request) -> bool {
// Uses IP hash for deterministic decision
let hash = calculate_hash(&request.client_ip);
let threshold = self.percentage.load(Ordering::Relaxed);
(hash % 100) < threshold
}
}
// Allowed testing FL2 with 1%, then 5%, 10%, etc.Phase 2: Gradual Rollout (early-mid 2025)
- Started with 1% of traffic
- Intensive metrics monitoring
- Gradual increase based on stability
- Instant rollback capability
Phase 3: Complete Migration (late 2025)
- 100% of traffic on FL2
- FL1 will be shut down in early 2026
- Continuous performance monitoring
Lessons for Developers
Cloudflare's migration teaches several valuable lessons:
1. Planning is Crucial
100+ engineers working for over a year shows that large migrations require serious investment.
2. Rust Pays Off at Scale
The 50% gains in CPU and memory mean savings of millions of dollars in infrastructure for Cloudflare.
3. Security Comes for Free
Rust compiler guarantees eliminated crashes and vulnerabilities automatically.
4. Gradual is Safe
The gradual rollout allowed detecting and fixing problems before affecting all users.
Ecosystem Impact
This Cloudflare success story is influencing the entire industry:
- Discord has already migrated critical parts to Rust
- Dropbox uses Rust in its storage engine
- AWS is writing new services in Rust
- Microsoft is rewriting Windows components in Rust
When to Consider Rust for Your Project
Rust makes sense when you need:
- Maximum performance without sacrificing security
- Concurrent systems with high throughput
- Guaranteed memory safety
- Low resource usage (CPU/memory)
- Long code lifespan (decades)
If you're building high-traffic APIs, infrastructure systems, or any service where performance and reliability are critical, Rust is worth considering.
Cloudflare's Future with Rust
Cloudflare doesn't plan to stop here. With FL2's success, the company is:
- Migrating more services to Rust
- Developing new open-source tools in Rust
- Sharing knowledge about Rust in production
- Actively contributing to the Rust ecosystem
If you feel inspired by Rust's power and want to understand more about modern programming languages, I recommend checking out another article: TypeScript Dominates GitHub in 2025 where you'll discover how strongly-typed languages are dominating development.
Let's go! 🦅
💻 Master JavaScript and Prepare for Rust
The knowledge you gained in this article about performance and system architecture is just the beginning. JavaScript remains essential, and mastering it prepares you to learn languages like Rust.
Invest in Your Future
I've prepared complete material for you to master JavaScript:
Payment options:
- $4.90 (single payment)