celld
Self-hosted, distributed Durable Objects
- Your Cloudflare app runs unchanged — Workers, Durable Objects, KV, Queues, D1, R2, Workflows, Cron, static assets (supported APIs →)
- Your data lives in a bucket you own
- Orders of magnitude cheaper at scale
Get it
$ curl -fsSL celld.dev/install.sh | sh$ docker run ghcr.io/denoland/celld❯ create a distributed chat app with vite, use celld.dev and exe.dev, 2 VMsKey characteristics
| Durability | ||
|---|---|---|
| Writers per cell (epoch-fenced) | 1 | |
| Acknowledged writes lost on kill | 0 | RPO=0 |
| Durable write latency (one node, region-local) | ~90 | ms |
| Failover after node loss, 0 lost | ~20 | s |
| Speed (warm) | ||
| Stateless request p50 / p99 | 0.2 / 0.3 | ms |
| Stateless throughput / worker thread | ~94k | req/s |
| Wake a hibernated cell | ~4 | ms |
| Density & cost | ||
| RAM per resident cell | 0.47 | MB |
| Resident cells / 8 GB node | 2,500 | cells |
| Inactive cell cost | ~0 | bucket ops |
| $ / resident cell-month | ~$0.02 | |
| Compatibility | ||
| Supported services and APIs | docs → | |
- Speed and density: one node, trivial cells, an Apple M-series laptop over loopback. Fleet vCPUs are slower — activation p50 is 35.9 ms on a 2 vCPU node.
- Durability: a 4 vCPU / 8 GB fleet in one region, against a region-local bucket. Failover is SIGKILL of a loaded node with every room verified after recovery. How this is measured →
Monthly cost vs resident fleet size
- Durable Objects: Workers Paid, $5/mo plus $4.15 per resident cell-month; its free plan covers toy scale.
- celld: whole $48 / 8 GB nodes (DigitalOcean us-east list), capped at 2,500 resident cells each; capacity is added in steps.
- Base cost before workload: application traffic and writes add compute and bucket usage. Click a dot for the modeled bill.
Supported services
| Service | What it is | Status | Example |
|---|---|---|---|
| Workers | stateless request handlers | Supported | examples/hello → |
| Durable Objects / Cells | single-threaded actors with durable storage | Supported | examples/counter → |
| Durable Object Facets | child objects inside a Durable Object | Experimental | docs → |
| KV | key-value store | Supported | examples/kv → |
| Queues | message queue | Supported | docs → |
| D1 | SQL database | Supported | examples/d1 → |
| R2 | S3-style object storage | Supported | examples/r2 → |
| Workflows | durable multi-step execution | Supported | examples/workflow → |
| Cron Triggers | scheduled handlers | Supported | examples/cron → |
| Static assets | files served from a directory | Supported | docs → |
| WebAssembly | compiled modules imported by a Worker | Supported | examples/wasm → |
| Dynamic Workers | Workers loaded at runtime | Experimental | docs → |
celld deployreads thewrangler.jsonyou already have; an unknown key stops the deploy rather than silently doing nothing.- A KV namespace, a D1 database, a queue, and a Workflow are each a cell: the same lease, SQLite database, LTX replication, and failover as a Durable Object. R2 keeps its index in a cell and its bytes in your bucket.
- A KV namespace and a queue each have one writer. Add namespaces or queues for write capacity.
- Out of scope: anything that needs Cloudflare's network, its GPUs, or a browser farm. Every gap is listed on the compatibility page →
How it works
The bucket is the coordinator — no membership protocol, no failure detector, no consensus. Ownership is a record in your bucket, claimed with one atomic write. celld continuously replicates each cell's SQLite state to that bucket as LTX segments.
Functional block diagram — one fleet, one bucket
Reliability
Durable Objects is a strong programming model. celld keeps that model while moving placement, state, and operational evidence into infrastructure you choose.
Two public records from the same month.
The Orange Cloud Report scores Durable Objects 2 out of 10 for reliability
“technically impressive, operationally terrifying. Should have stayed an internal primitive.”
Cloudflare status: Durable Objects increased errors, major impact
What changes when you run the model yourself:
No shared machine to lose
A cell's identity isn't fused to a machine — ownership is a lease in your bucket, granted by compare-and-swap. Lose a node and another acquires the lease and restores the cell in seconds: your fleet reading your storage, not a vendor restoring a placement you can't see.
A failure domain you choose
Your fleet still depends on its machines, network, and bucket provider. What changes is tenancy: no shared Durable Objects scheduler or placement layer can couple your application to another customer's workload.
A failure you can read
When a cell misbehaves the evidence is on your disk — the ownership record, the SQLite and LTX files, and the logs. You answer “what happened to my cell” with sqlite3 and grep, not a status page that declines to say.
Self-hosting is not automatically more reliable. It makes the failure domain explicit and inspectable: your nodes, your bucket provider, and your operational choices.
And to be clear about the tone: we love Cloudflare — this very page is served by a Cloudflare Worker. The Durable Objects model — a single-threaded object with its own storage, addressed by name — is one of the best primitives distributed systems has gained in years, and that design is Kenton Varda's and the Cloudflare Workers team's. celld is a love letter to their idea; a primitive this good deserves to run anywhere.
A stateful distributed system that rests entirely on S3.
LTX is Litestream's replica format, from Ben Johnson
