Cloudflare Workers add inbound TCP support with gRPC as first protocol in private beta

Cloudflare Workers can now accept inbound TCP connections, ending an eight-year limitation to HTTP-only workloads. The change is implemented through a new `connect(socket)` handler routed via Spectrum, Cloudflare’s ingress proxy for non-HTTP traffic. This allows Workers to read and write raw sockets directly, pass them to Durable Objects, or forward them to containers. The immediate use case is gRPC, but the primitive is protocol-agnostic, opening the door to custom binary protocols, message brokers, or database proxies. The restriction lift is significant for edge computing, where HTTP-only constraints have historically limited workload diversity.

gRPC support is split into two tiers. Containers running in Cloudflare’s environment get full-duplex gRPC, with examples provided for unmodified Go and Python servers. Workers themselves, however, are limited to unary and server-streaming gRPC due to platform constraints. The implementation relies on gRPC-web translation, converting incoming gRPC to gRPC-web for Workers and reversing the process for outgoing traffic. This mirrors how browsers handle gRPC, but it introduces limitations: Workers cannot natively support bidirectional streaming, cancellation, or flow control at the HTTP/2 frame level. The trade-off is compatibility with existing clients, which require no changes to work with Workers.

The private beta status is notable. Cloudflare explicitly states it does not use gRPC internally, opting for Cap’n Proto and its JavaScript-native RPC system instead. This admission is unusual for a vendor announcement and sets clear expectations about maturity. The company is prioritizing early adopter feedback to refine the implementation before general availability. For engineers, this means the feature is functional but may lack edge-case robustness, particularly around backpressure control for gRPC streams. Teams evaluating this should treat it as a preview rather than a production-ready solution.

The practical implications vary by use case. For gRPC workloads, Workers can now sit in front of existing backends or serve mobile clients without protocol changes. The open-source `@connectrpc/connect` package simplifies server-side adoption. However, the HTTP/2 frame-level limitations mean Workers are not a drop-in replacement for full gRPC servers. For non-gRPC workloads, the inbound TCP primitive enables entirely new categories of edge applications, such as custom protocol gateways or lightweight message brokers. The constraint is that these workloads must fit within Cloudflare’s container environment, which may not suit all legacy or high-throughput use cases.