Cloudflare Workers Add Inbound TCP Sockets, Bringing gRPC Support to the Serverless Platform

Overview

Cloudflare Workers can now accept inbound TCP connections and serve gRPC traffic, according to Cloudflare’s own announcement, which states that “since the platform launched in 2017, a Worker could open outbound sockets to a database or a service, but it could only be a server for HTTP.” The change, also covered by InfoQ, marks the first time Workers can act as a server for a protocol other than HTTP.

What We Know

A new handler for inbound sockets

The capability is built around a new Workers handler, async connect(socket): Promise<void>, which lets a Worker accept an inbound TCP socket and read from or write to it directly, according to Cloudflare. Routing is handled through a new Spectrum application type, described in the post as “Cloudflare’s ingress proxy for non-HTTP traffic,” where developers specify the Worker they want incoming TCP connections routed to.

Sockets can also be forwarded onward: from one Worker to another, from a Worker to a Durable Object, or from a Durable Object to a Container using this.ctx.container!.getTcpPort(8080).connect(), per the same post. Cloudflare describes Containers as able to run any program, in any language, reached over the forwarded socket, giving the platform full-duplex support for arbitrary TCP-based protocols rather than just gRPC.

gRPC arrives as the first protocol on top

gRPC is the first protocol Cloudflare is building on the new socket support, and Workers can directly serve unary and server-streaming gRPC calls, translating them to gRPC-web, according to Cloudflare’s post as independently confirmed by InfoQ. Full bidirectional streaming gRPC is not directly supported by a Worker itself; Cloudflare’s post explains that “web platform APIs like fetch() do not expose” the stream-level control gRPC depends on, and that browsers face the same limitation, “which is why gRPC-web exists” — a conversion Cloudflare says it has been running inside its reverse proxy “since 2020.” For workloads that need true bidirectional streaming, Cloudflare points developers toward running a native gRPC server inside a Container, reachable through the same socket-forwarding path.

On the implementation side, Cloudflare’s post points developers to the open-source @connectrpc/connect library together with Protocol Buffers for defining gRPC services inside a Worker, and cites real-time voice AI applications needing low-latency communication, as well as mobile app backends using libraries like grpc-swift-2 and grpc-kotlin, as use cases for the feature.

Why Cloudflare isn’t using gRPC itself

Cloudflare’s announcement is explicit that the company does not run gRPC internally. “At Cloudflare, we use Cap’n Proto and Cap’n Web and the JavaScript-native RPC system that is built into Cloudflare Workers instead of gRPC,” the post states, adding: “And when we ship things, we always aim to be using them ourselves.” The company frames the private-beta rollout as a chance to “work closely with a smaller set of developers using gRPC” before a wider release, according to Cloudflare.

Private beta, and a gap with Cloudflare’s own social messaging

Cloudflare’s post states plainly: “We’re introducing everything from this post in private beta — you can sign up here,” gating the feature behind a signup form. InfoQ reports that this private-beta framing sits at odds with Cloudflare’s own social media messaging, noting that the company’s social copy announced gRPC support “is now available” and described serving gRPC natively at the edge without translation layers — language InfoQ contrasts with the signup-gated private beta described in the blog post itself.

UDP next on the roadmap

Cloudflare’s post frames TCP and gRPC as a starting point rather than an end state, saying the company is “excited to continue to push the bounds of what types of traffic the Workers platform can serve, going beyond TCP and into UDP-based protocols.” No timeline was given for UDP support.

What We Don’t Know

Cloudflare has not published a timeline for when the private beta will open more broadly or when UDP-based protocol support might arrive. The exact wording of the social media post InfoQ contrasts with Cloudflare’s blog language was not independently verified beyond the “is now available” fragment InfoQ quoted.

Analysis

The move extends Workers beyond its original HTTP-request-response model into territory it has avoided since its 2017 launch, and it does so by leaning on infrastructure Cloudflare already runs for other purposes: Spectrum for non-HTTP ingress, and a gRPC-to-gRPC-web conversion path the company says it has operated internally since 2020. Framing gRPC as merely “the first protocol” built on top of the new socket layer, rather than the end goal, positions inbound TCP support itself — and the stated follow-on interest in UDP — as the more consequential platform change for Workers’ long-term positioning as a general-purpose network edge, not just an HTTP one.