Introduction
celld-operator is a Kubernetes operator that turns
celld, Deno Land's open-source daemon for
running Cloudflare Workers and Durable Objects on your own machines, into a complete
self-hosted platform. One WorkerApp custom resource provisions and operates a
full celld fleet: workload, networking, security policy, ingress, gated rollouts,
metrics, and autoscaling.
Why an operator?
celld deliberately ships with no multi-tenant scheduler, no account service, and no managed ingress. Its own limitations page says so plainly: a fleet runs one application deployment, and everything around it is your problem. celld supplies the runtime and the data plane; celld-operator supplies the control plane, built almost entirely from Kubernetes-native objects, without patching celld itself.
That last part is a design constraint, not an accident. celld is a fast-moving alpha the
operator does not control, so the operator's celld-facing surface stays thin:
environment variables, signals, and two HTTP endpoints (/__celld/health and
the internal /state).
Core concepts
| Concept | Meaning |
|---|---|
| Cell | A Durable Object: a small named server with a private SQLite database. One cell per user, document, chat room, or AI agent. Each cell has exactly one writer at a time, fenced by object-storage compare-and-swap. |
| Fleet | A set of celld nodes sharing one bucket prefix and serving one application deployment. On Kubernetes, a fleet is a StatefulSet of celld pods. |
| Bucket | The object-storage bucket (S3-compatible or GCS) that holds deployments, per-cell SQLite replicas, ownership leases, and the peer-auth secret. The bucket is the source of truth; nodes are replaceable. |
| WorkerApp | The custom resource this operator reconciles. One WorkerApp = one fleet = one application. Tenancy lives at the Kubernetes layer: each app gets its own namespace-scoped resources, bucket prefix, and credentials. |
What the operator gives you
- Fleet provisioning: StatefulSet, Services, NetworkPolicies, PodDisruptionBudget, and (when Istio is present) mesh AuthorizationPolicies, all derived from one resource. See Architecture.
- Ingress: hostnames routed through Gateway API, classic Istio, or plain Ingress, with drain-aware retry policy. See Networking & ingress.
- Gated rollouts: celld's documented rolling-update rule (fleet-wide
restoring=0between restarts) encoded in a controller instead of a runbook. See Deploying updates. - Autoscaling: KEDA ScaledObjects driven by resident-cell utilization metrics the operator itself exports. See Autoscaling.
- Observability: celld's built-in tracing wired to your bucket or your OTLP collector, plus Prometheus metrics for capacity and health. See Observability.
- An honest tenancy story: per-fleet blast radius enforced by Kubernetes and prefix-scoped IAM. See Security.
What it is not
This is a platform for your applications, or your customers' applications under your operation. It is not a public PaaS for anonymous hostile code: celld's security documentation states it is not safe for hostile multi-tenant use, and the operator does not pack untrusted tenants into shared celld nodes. The unit of tenancy is a fleet (two to three pods minimum for high availability), not an isolate.
The operator also does not fill every Cloudflare platform gap. KV, R2, and the Cache API are explicitly not planned upstream; the compatibility matrix tells you exactly what runs, and gaps fail loudly rather than silently.
Status: alpha. celld itself is an alpha and this operator tracks it
release-for-release. Upstream ships security fixes for its latest release only, and the
operator's support policy mirrors that. The API group is
celld-operator.io/v1alpha1 and may change.
Where to go next
- Install the operator: Helm or kustomize, plus optional integrations.
- Quick start: from a Wrangler project to a converged fleet.
- Architecture: why everything is the way it is.
- WorkerApp reference: every field, default, and condition.