Kent C. Dodds shares how he replaced a Cloudflare Container-based FFmpeg audio pipeline with Cloudflare Sandboxes, eliminating heartbeat/shutdown coordination plumbing. The new design uses a one-shot sandbox.exec() call directly from the queue worker, keeping R2 credentials in the worker and passing only presigned URLs to the sandbox. The sandbox image is minimal: base Cloudflare sandbox image plus FFmpeg and a shell script. Two production bugs surfaced post-merge — a sandbox ID length limit (63 chars max) and a broken Dockerfile that replaced the required Cloudflare sandbox runtime with a plain Debian base. Both were diagnosed and fixed with help from a Cursor agent and the Cloudflare MCP server. The entire migration, including two PR iterations, took under an hour of the author's own time.
Table of contents
Quick recapThe first sandbox attemptWhat the merged version actually looks likeHow I justified moving this fastHow long this actually took meWhat I still missedThe monorepo wrinkleWhat I'd take away from thisSort: