Deno's Celld Runs Cloudflare Durable Objects on Your Own Hardware, No Consensus

Deno Land has released celld, an open-source daemon that lets you run Cloudflare Workers and Durable Objects on your own machines. Each Durable Object becomes its own named SQLite database that is continuously replicated to an S3-compatible bucket you control. Every node embeds V8 and executes Wrangler bundles, and the whole fleet coordinates through the shared bucket alone — there is no control plane, membership protocol, failure detector, or consensus service. Ownership is enforced by object-storage compare-and-swap, guaranteeing exactly one node owns a given cell at a time; when a cell moves or wakes, its new owner restores the database from the bucket and resumes. The bucket is treated as the durable source of truth, making individual nodes disposable.

The design leans on per-object sharding to sidestep the contention and blast-radius problems of a single shared database, and idle cells hibernate to near-zero cost. Security is squarely the operator’s responsibility: peer-to-peer HTTP does not terminate TLS, so nodes must sit on a trusted private network or an encrypted overlay like WireGuard or Tailscale, and a literal public advertise address is rejected unless an explicit unsafe flag is passed. Peer requests are HMAC-authenticated against a fleet secret written into the bucket, which means anyone with the bucket credentials effectively holds fleet-administrator access. A diagnose command probes live peers and surfaces expired leases, unreachable nodes, and resource pressure, while opt-in shedding fences least-recently-used cells when watermarks are exceeded.

Notably, the project disables pull requests outright, with maintainers arguing that coding agents make it too cheap to submit large, low-context changes that cost more review time than they save; contributions must arrive as emailed git patches under a CLA assigning rights to Deno Land. The runtime and its Workers/Durable Objects compatibility surface are still evolving, with conformance and fault-injection simulation gating each release. The result is a credible path to self-hosting a Cloudflare-style stateful edge runtime without lock-in to Cloudflare’s platform.