Kenton Varda

Kenton Varda created and leads Cloudflare Workers, co-founded Sandstorm, and was the primary author of Protocol Buffers v2. His work makes distributed applications easier to build, isolate, and customize—a foundation for safely running software written by AI.

From Google to programmable infrastructure

At Google from 2005 to 2013, Varda worked on Universal Search infrastructure, Google Drive sharing and access control, and Protocol Buffers v2, helping release the serialization system as open source. He subsequently created Cap’n Proto, a serialization and remote-procedure-call system designed to reduce encoding overhead and express permissions through specific references, an approach known as object-capability security.

With Jade Wang, he co-founded Sandstorm, which made self-hosted applications individually isolated and permission-controlled. Cloudflare acquired Sandstorm in 2017; Varda joined the company and started Workers, which became broadly available in 2018. He later helped expand the platform with Durable Objects, resource-specific security bindings, and workerd, its open-source runtime.

Giving users software they can safely reshape

• Personal applications should behave like shareable documents. Varda’s Gadgets architecture gives each user a separate application instance that AI can modify without changing anyone else’s software. Reusable blueprints share code without personal data, while the platform manages collaboration and access control. Examples include a collaborative whiteboard, an email filter, and a GitHub pull-request review assistant.

• AI-generated code needs containment, not presumed trustworthiness. Gadget interfaces execute inside null-origin sandboxed iframes under restrictive Content Security Policy. A controlled postMessage channel connects them through Cap’n Web RPC to isolated Workers and Durable Objects, limiting what vulnerable client or server code can reach.

• Generated applications require isolated execution and state. Dynamic Workers sandbox code created on demand, while Durable Object Facets provide separate persistent state and SQLite databases. His Code Mode approach lets agents orchestrate tools by writing executable code.

Varda also runs Workers-based applications locally through workerd. His independent projects include lanparty, which network-boots desktop machines from a shared image, and home-container, which containerizes a user’s home directory.