Introduction
Classio is a lightweight, self-hosted alternative to Cloudflare Workers that lets you deploy serverless functions to your own infrastructure. Built with Bun, it demonstrates the core concepts of a serverless platform in under 1000 lines of code.
System Architecture
The platform follows a clean three-tier design:
API Server
The control plane that handles deployments. When you deploy code, it stores the bundled JavaScript in SQLite and notifies the runtime to refresh. It also validates TLS certificate requests for custom domains.
Runtime Worker
The data plane that executes user code. It extracts the subdomain from each request (like myapp.localhost:3001), fetches the corresponding code, and runs it in a sandboxed environment. Results are cached in memory for performance.
CLI Tool
The developer interface that bundles your TypeScript/JavaScript project and sends it to the API. One command deploys your entire app.
How Deployment Works
The flow is beautifully simple:
- You write a handler function in
index.ts - Run
classio deploy -s myappfrom your terminal - The CLI bundles your code using Bun's fast bundler
- Bundled code is sent to the API server via HTTP POST
- API server stores it in SQLite and invalidates the runtime cache
- Your app is live at
http://myapp.localhost:3001
Each deployment is atomicâeither everything succeeds or nothing changes.
What Could Be Better
While Classio demonstrates the core concepts effectively, there are several areas that would need attention for production use.
Security Gaps
The biggest concern is code execution. Currently, user code runs via eval() which is inherently unsafe. There's no sandboxing, resource limits, or timeout enforcement. A malicious deployment could consume unlimited CPU/memory or access the host system.
Authentication is also missingâanyone can deploy to any subdomain without verification.
Scalability Bottlenecks
The in-memory cache doesn't survive restarts or scale horizontally. SQLite is great for prototypes but struggles under heavy load. There's no load balancing across multiple runtime workers.
Developer Experience
Error messages from the sandbox are cryptic. There's no logging dashboard to debug production issues. Critical features like environment variables, secrets management, and rollback capabilities are absent.
You also can't test locally before deployingâevery change requires a full deployment cycle.
Path to Production
To make this production-ready, here's what needs attention:
- Isolate execution environments using V8 isolates or WebAssembly runtimes to safely run untrusted code with strict resource limits
- Add proper authentication with API keys or OAuth, ensuring only authorized users can deploy to specific subdomains
- Replace SQLite with Postgres and add Redis for distributed caching. This enables horizontal scaling and persistence
- Build observability with structured logging, metrics, and real-time debugging tools so developers can monitor their apps
- Implement versioning to allow instant rollbacks and blue-green deployments for zero-downtime updates
- Add rate limiting at both the deployment and runtime layers to prevent abuse
Why This Matters
Classio proves you don't need thousands of lines of complex infrastructure code to build a serverless platform. The core conceptsâbundling, storage, and isolated executionâare straightforward.
It's an excellent learning resource for understanding how platforms like Vercel, Netlify, and Cloudflare Workers operate under the hood. The simplicity makes it perfect for experimentation and education.
For production use, you'd need significant hardening. But as a foundation for learning or building internal tools, it's a solid starting point.
Conclusion
Explore the code: github.com/Bhup-GitHUB/cf-workers-clone
Classio demonstrates that building a serverless platform doesn't require massive complexity. The core ideas are simple, and understanding them gives valuable insight into how modern deployment platforms work. Whether you're learning system design or building internal tools, projects like Classio prove that sometimes the best code is the code you can understand and modify.
