Devops

Codex compatibility note:

>

- Invoke repository skills with $skill-name in Codex; this mirrored copy rewrites legacy Claude /skill-name references.

- Task tracker mandate: BEFORE executing any workflow or skill step, create/update task tracking for all steps and keep it synchronized as progress changes.

- User-question prompts mean to ask the user directly in Codex.

- Ignore Claude-specific mode-switch instructions when they appear.

- Strict execution contract: when a user explicitly invokes a skill, execute that skill protocol as written.

- Subagent authorization: when a skill is user-invoked or AI-detected and its protocol requires subagents, that skill activation authorizes use of the required spawn_agent subagent(s) for that task.

- Do not skip, reorder, or merge protocol steps unless the user explicitly approves the deviation first.

- For workflow skills, execute each listed child-skill step explicitly and report step-by-step evidence.

- If a required step/tool cannot run in this environment, stop and ask the user before adapting.

<!-- CODEX:PROJECT-REFERENCE-LOADING:START -->

Codex Project-Reference Loading (No Hooks)

Codex does not receive Claude hook-based doc injection. When coding, planning, debugging, testing, or reviewing, open project docs explicitly using this routing.

Always read:

• docs/project-config.json (project-specific paths, commands, modules, and workflow/test settings)
• docs/project-reference/docs-index-reference.md (routes to the full docs/project-reference/* catalog)
• docs/project-reference/lessons.md (always-on guardrails and anti-patterns)

Situation-based docs:

• Backend/CQRS/API/domain/entity changes: backend-patterns-reference.md, domain-entities-reference.md, project-structure-reference.md
• Frontend/UI/styling/design-system: frontend-patterns-reference.md, scss-styling-guide.md, design-system/README.md
• Spec/test-case planning or TC mapping: feature-docs-reference.md
• Integration test implementation/review: integration-test-reference.md
• E2E test implementation/review: e2e-test-reference.md
• Code review/audit work: code-review-rules.md plus domain docs above based on changed files

Do not read all docs blindly. Start from docs-index-reference.md, then open only relevant files for the task.

<!-- CODEX:PROJECT-REFERENCE-LOADING:END -->

Quick Summary

Goal: Deploy and manage cloud infrastructure across Cloudflare (Workers, R2, D1), Docker containers, and Google Cloud Platform.

Workflow:

1. Platform Selection — Choose Cloudflare (edge/low-latency), Docker (containers/microservices), or GCP (enterprise/K8s) 2. Project Setup — Initialize with Wrangler CLI, Dockerfile, or gcloud CLI 3. Local Development — Test locally before deploying 4. Deploy & Verify — Deploy to target platform with health checks

Key Rules:

• Run containers as non-root user; scan images for vulnerabilities
• Use multi-stage Docker builds to minimize image size
• Store secrets in environment variables, never in code
• Use R2 over S3 when zero egress cost matters

Be skeptical. Apply critical thinking, sequential thinking. Every claim needs traced proof, confidence percentages (Idea should be more than 80%).

DevOps Skill

Comprehensive guide for deploying and managing cloud infrastructure across Cloudflare edge platform, Docker containerization, and Google Cloud Platform.

When to Use This Skill

Use this skill when:

• Deploying serverless applications to Cloudflare Workers
• Containerizing applications with Docker
• Managing Google Cloud infrastructure with gcloud CLI
• Setting up CI/CD pipelines across platforms
• Optimizing cloud infrastructure costs
• Implementing multi-region deployments
• Building edge-first architectures
• Managing container orchestration with Kubernetes
• Configuring cloud storage solutions (R2, Cloud Storage)
• Automating infrastructure with scripts and IaC

Platform Selection Guide

When to Use Cloudflare

Best For:

• Edge-first applications with global distribution
• Ultra-low latency requirements (<50ms)
• Static sites with serverless functions
• Zero egress cost scenarios (R2 storage)
• WebSocket/real-time applications (Durable Objects)
• AI/ML at the edge (Workers AI)

Key Products:

• Workers (serverless functions)
• R2 (object storage, S3-compatible)
• D1 (SQLite database with global replication)
• KV (key-value store)
• Pages (static hosting + functions)
• Durable Objects (stateful compute)
• Browser Rendering (headless browser automation)

Cost Profile: Pay-per-request, generous free tier, zero egress fees

When to Use Docker

Best For:

• Local development consistency
• Microservices architectures
• Multi-language stack applications
• Traditional VPS/VM deployments
• Kubernetes orchestration
• CI/CD build environments
• Database containerization (dev/test)

Key Capabilities:

• Application isolation and portability
• Multi-stage builds for optimization
• Docker Compose for multi-container apps
• Volume management for data persistence
• Network configuration and service discovery
• Cross-platform compatibility (amd64, arm64)

Cost Profile: Infrastructure cost only (compute + storage)

When to Use Google Cloud

Best For:

• Enterprise-scale applications
• Data analytics and ML pipelines (BigQuery, Vertex AI)
• Hybrid/multi-cloud deployments
• Kubernetes at scale (GKE)
• Managed databases (Cloud SQL, Firestore, Spanner)
• Complex IAM and compliance requirements

Key Services:

• Compute Engine (VMs)
• GKE (managed Kubernetes)
• Cloud Run (containerized serverless)
• App Engine (PaaS)
• Cloud Storage (object storage)
• Cloud SQL (managed databases)

Cost Profile: Varied pricing, sustained use discounts, committed use contracts

Quick Start

Cloudflare Workers

# Install Wrangler CLI
npm install -g wrangler

# Create and deploy Worker
wrangler init my-worker
cd my-worker
wrangler deploy

See: references/cloudflare-workers-basics.md

Docker Container

# Create Dockerfile
cat > Dockerfile <<EOF
FROM node:20-alpine
WORKDIR /app
COPY package*.json ./
RUN npm ci --production
COPY . .
EXPOSE 3000
CMD ["node", "server.js"]
EOF

# Build and run
docker build -t myapp .
docker run -p 3000:3000 myapp

See: references/docker-basics.md

Google Cloud Deployment

# Install and authenticate
curl https://sdk.cloud.google.com | bash
gcloud init
gcloud auth login

# Deploy to Cloud Run
gcloud run deploy my-service \
  --image gcr.io/project/image \
  --region us-central1

See: references/gcloud-platform.md

Reference Navigation

Cloudflare Platform

• cloudflare-platform.md - Edge computing overview, key components
• cloudflare-workers-basics.md - Getting started, handler types, basic patterns
• cloudflare-workers-advanced.md - Advanced patterns, performance, optimization
• cloudflare-workers-apis.md - Runtime APIs, bindings, integrations
• cloudflare-r2-storage.md - R2 object storage, S3 compatibility, best practices
• cloudflare-d1-kv.md - D1 SQLite database, KV store, use cases
• browser-rendering.md - Puppeteer/Playwright automation on Cloudflare

Docker Containerization

• docker-basics.md - Core concepts, Dockerfile, images, containers
• docker-compose.md - Multi-container apps, networking, volumes

Google Cloud Platform

• gcloud-platform.md - GCP overview, gcloud CLI, authentication
• gcloud-services.md - Compute Engine, GKE, Cloud Run, App Engine

Python Utilities

• scripts/cloudflare-deploy.py - Automate Cloudflare Worker deployments
• scripts/docker-optimize.py - Analyze and optimize Dockerfiles

Common Workflows

Edge + Container Hybrid

# Cloudflare Workers (API Gateway)
# -> Docker containers on Cloud Run (Backend Services)
# -> R2 (Object Storage)

# Benefits:
# - Edge caching and routing
# - Containerized business logic
# - Global distribution

Multi-Stage Docker Build

# Build stage
FROM node:20-alpine AS build
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

# Production stage
FROM node:20-alpine
WORKDIR /app
COPY --from=build /app/dist ./dist
COPY --from=build /app/node_modules ./node_modules
USER node
CMD ["node", "dist/server.js"]

CI/CD Pipeline Pattern

# 1. Build: Docker multi-stage build
# 2. Test: Run tests in container
# 3. Push: Push to registry (GCR, Docker Hub)
# 4. Deploy: Deploy to Cloudflare Workers / Cloud Run
# 5. Verify: Health checks and smoke tests

Best Practices

Security

• Run containers as non-root user
• Use service account impersonation (GCP)
• Store secrets in environment variables, not code
• Scan images for vulnerabilities (Docker Scout)
• Use API tokens with minimal permissions

Performance

• Multi-stage Docker builds to reduce image size
• Edge caching with Cloudflare KV
• Use R2 for zero egress cost storage
• Implement health checks for containers
• Set appropriate timeouts and resource limits

Cost Optimization

• Use Cloudflare R2 instead of S3 for large egress
• Implement caching strategies (edge + KV)
• Right-size container resources
• Use sustained use discounts (GCP)
• Monitor usage with cloud provider dashboards

Development

• Use Docker Compose for local development
• Wrangler dev for local Worker testing
• Named gcloud configurations for multi-environment
• Version control infrastructure code
• Implement automated testing in CI/CD

Decision Matrix

Resources

• Cloudflare Docs: https://developers.cloudflare.com
• Docker Docs: https://docs.docker.com
• GCP Docs: https://cloud.google.com/docs
• Wrangler CLI: https://developers.cloudflare.com/workers/wrangler/
• gcloud CLI: https://cloud.google.com/sdk/gcloud

Implementation Checklist

Cloudflare Workers

• [ ] Install Wrangler CLI
• [ ] Create Worker project
• [ ] Configure wrangler.toml (bindings, routes)
• [ ] Test locally with wrangler dev
• [ ] Deploy with wrangler deploy

Docker

• [ ] Write Dockerfile with multi-stage builds
• [ ] Create .dockerignore file
• [ ] Test build locally
• [ ] Push to registry
• [ ] Deploy to target platform

Google Cloud

• [ ] Install gcloud CLI
• [ ] Authenticate with service account
• [ ] Create project and enable APIs
• [ ] Configure IAM permissions
• [ ] Deploy and monitor resources

Related

• databases
• api-design

---

[IMPORTANT] Use task tracking to break ALL work into small tasks BEFORE starting — including tasks for each file read. This prevents context loss from long files. For simple tasks, AI MUST ATTENTION ask user whether to skip.

<!-- SYNC:ai-mistake-prevention -->

AI Mistake Prevention — Failure modes to avoid on every task:

>

Check downstream references before deleting. Deleting components causes documentation and code staleness cascades. Map all referencing files before removal.

Verify AI-generated content against actual code. AI hallucinates APIs, class names, and method signatures. Always grep to confirm existence before documenting or referencing.

Trace full dependency chain after edits. Changing a definition misses downstream variables and consumers derived from it. Always trace the full chain.

Trace ALL code paths when verifying correctness. Confirming code exists is not confirming it executes. Always trace early exits, error branches, and conditional skips — not just happy path.

When debugging, ask "whose responsibility?" before fixing. Trace whether bug is in caller (wrong data) or callee (wrong handling). Fix at responsible layer — never patch symptom site.

Assume existing values are intentional — ask WHY before changing. Before changing any constant, limit, flag, or pattern: read comments, check git blame, examine surrounding code.

Verify ALL affected outputs, not just the first. Changes touching multiple stacks require verifying EVERY output. One green check is not all green checks.

Holistic-first debugging — resist nearest-attention trap. When investigating any failure, list EVERY precondition first (config, env vars, DB names, endpoints, DI registrations, data preconditions), then verify each against evidence before forming any code-layer hypothesis.

Surgical changes — apply the diff test. Bug fix: every changed line must trace directly to the bug. Don't restyle or improve adjacent code. Enhancement task: implement improvements AND announce them explicitly.

Surface ambiguity before coding — don't pick silently. If request has multiple interpretations, present each with effort estimate and ask. Never assume all-records, file-based, or more complex path.

<!-- /SYNC:ai-mistake-prevention -->

<!-- SYNC:critical-thinking-mindset -->

Critical Thinking Mindset — Apply critical thinking, sequential thinking. Every claim needs traced proof, confidence >80% to act.

Anti-hallucination: Never present guess as fact — cite sources for every claim, admit uncertainty freely, self-check output for errors, cross-reference independently, stay skeptical of own confidence — certainty without evidence root of all hallucination.

<!-- /SYNC:critical-thinking-mindset -->

<!-- SYNC:critical-thinking-mindset:reminder -->

MUST ATTENTION apply critical thinking — every claim needs traced proof, confidence >80% to act. Anti-hallucination: never present guess as fact.

<!-- /SYNC:critical-thinking-mindset:reminder -->

<!-- SYNC:ai-mistake-prevention:reminder -->

MUST ATTENTION apply AI mistake prevention — holistic-first debugging, fix at responsible layer, surface ambiguity before coding, re-read files after compaction.

<!-- /SYNC:ai-mistake-prevention:reminder -->

Closing Reminders

• MANDATORY IMPORTANT MUST ATTENTION break work into small todo tasks using task tracking BEFORE starting
• MANDATORY IMPORTANT MUST ATTENTION search codebase for 3+ similar patterns before creating new code
• MANDATORY IMPORTANT MUST ATTENTION cite file:line evidence for every claim (confidence >80% to act)
• MANDATORY IMPORTANT MUST ATTENTION add a final review todo task to verify work quality

[TASK-PLANNING] Before acting, analyze task scope and systematically break it into small todo tasks and sub-tasks using task tracking.

<!-- CODEX:SYNC-PROMPT-PROTOCOLS:START -->

Hookless Prompt Protocol Mirror (Auto-Synced)

Source: .claude/hooks/lib/prompt-injections.cjs + .claude/.ck.json

[WORKFLOW-EXECUTION-PROTOCOL] [BLOCKING] Workflow Execution Protocol — MANDATORY IMPORTANT MUST CRITICAL. Do not skip for any reason.

Generic portability boundary: Reusable skills and protocol text stay project-neutral; project-specific conventions are discovered from docs/project-config.json and docs/project-reference/. Apply shared AI-SDD from shared/sdd-artifact-contract.md. Read docs/project-config.json and docs/project-reference/docs-index-reference.md, then open the project reference docs named there. Any supported AI tool may execute when this shared context and local docs are available.

1. DETECT: Match prompt against workflow catalog 2. ANALYZE: Find best-match workflow AND evaluate if a custom step combination would fit better 3. ASK (REQUIRED FORMAT): Use a direct user question with this structure unless the user explicitly invoked a workflow/skill and the local protocol treats explicit invocation as confirmation:

• Question: "Which workflow do you want to activate?"
• Option 1: "Activate [BestMatch Workflow] (Recommended)"
• Option 2: "Activate custom workflow: [step1 → step2 → ...]" (include one-line rationale)

4. ACTIVATE (if confirmed): Call $workflow-start <workflowId> for standard; sequence custom steps manually 5. CREATE TASKS: task tracking for ALL workflow steps 6. EXECUTE: Follow each step in sequence [CRITICAL-THINKING-MINDSET] Apply critical thinking, sequential thinking. Every claim needs traced proof, confidence >80% to act. Anti-hallucination principle: Never present guess as fact — cite sources for every claim, admit uncertainty freely, self-check output for errors, cross-reference independently, stay skeptical of own confidence — certainty without evidence root of all hallucination. AI Attention principle (Primacy-Recency): Put the 3 most critical rules at both top and bottom of long prompts/protocols so instruction adherence survives long context windows. Goal-driven execution: Define success criteria first, loop until verified, and stop only when observable checks pass. Tests verify intent: Tests must protect business rules/invariants and fail when the protected intent breaks, not only mirror current behavior.

[LESSON-LEARNED-REMINDER] [BLOCKING] Task Planning & Continuous Improvement — MANDATORY. Do not skip.

Break work into small tasks (task tracking) before starting. Add final task: "Analyze AI mistakes & lessons learned".

Extract lessons — ROOT CAUSE ONLY, not symptom fixes:

1. Name the FAILURE MODE (reasoning/assumption failure), not symptom — "assumed API existed without reading source" not "used wrong enum value". 2. Generality test: does this failure mode apply to ≥3 contexts/codebases? If not, abstract one level up. 3. Write as a universal rule — strip project-specific names/paths/classes. Useful on any codebase. 4. Consolidate: multiple mistakes sharing one failure mode → ONE lesson. 5. Recurrence gate: "Would this recur in future session WITHOUT this reminder?" — No → skip $learn. 6. Auto-fix gate: "Could $code-review/$code-simplifier/$security/$lint catch this?" — Yes → improve review skill instead. 7. BOTH gates pass → ask user to run $learn. [TASK-PLANNING] [MANDATORY] BEFORE executing any workflow or skill step, create/update task tracking for all planned steps, then keep it synchronized as each step starts/completes.

<!-- CODEX:SYNC-PROMPT-PROTOCOLS:END -->

Cloudflare Browser Rendering

Headless browser automation with Puppeteer/Playwright on Cloudflare Workers.

Setup

wrangler.toml:

name = "browser-worker"
main = "src/index.ts"
compatibility_date = "2024-01-01"

browser = { binding = "MYBROWSER" }

Basic Screenshot Worker

import puppeteer from '@cloudflare/puppeteer';

export default {
    async fetch(request: Request, env: Env): Promise<Response> {
        const browser = await puppeteer.launch(env.MYBROWSER);
        const page = await browser.newPage();

        await page.goto('https://example.com', { waitUntil: 'networkidle2' });
        const screenshot = await page.screenshot({ type: 'png' });

        await browser.close();

        return new Response(screenshot, {
            headers: { 'Content-Type': 'image/png' }
        });
    }
};

Session Reuse (Cost Optimization)

// Disconnect instead of close
await browser.disconnect();

// Retrieve and reconnect
const sessions = await puppeteer.sessions(env.MYBROWSER);
const freeSession = sessions.find(s => !s.connectionId);

if (freeSession) {
    const browser = await puppeteer.connect(env.MYBROWSER, freeSession.sessionId);
}

PDF Generation

const browser = await puppeteer.launch(env.MYBROWSER);
const page = await browser.newPage();

await page.setContent(`
  <!DOCTYPE html>
  <html>
    <head>
      <style>
        body { font-family: Arial; padding: 50px; }
        h1 { color: #2c3e50; }
      </style>
    </head>
    <body>
      <h1>Certificate</h1>
      <p>Awarded to: <strong>John Doe</strong></p>
    </body>
  </html>
`);

const pdf = await page.pdf({
    format: 'A4',
    printBackground: true,
    margin: { top: '1cm', right: '1cm', bottom: '1cm', left: '1cm' }
});

await browser.close();

return new Response(pdf, {
    headers: { 'Content-Type': 'application/pdf' }
});

Durable Objects for Persistent Sessions

export class Browser {
    state: DurableObjectState;
    browser: any;
    lastUsed: number;

    constructor(state: DurableObjectState, env: Env) {
        this.state = state;
        this.lastUsed = Date.now();
    }

    async fetch(request: Request, env: Env) {
        if (!this.browser) {
            this.browser = await puppeteer.launch(env.MYBROWSER);
        }

        this.lastUsed = Date.now();
        await this.state.storage.setAlarm(Date.now() + 10000);

        const page = await this.browser.newPage();
        const url = new URL(request.url).searchParams.get('url');
        await page.goto(url);
        const screenshot = await page.screenshot();
        await page.close();

        return new Response(screenshot, {
            headers: { 'Content-Type': 'image/png' }
        });
    }

    async alarm() {
        if (Date.now() - this.lastUsed > 60000) {
            await this.browser?.close();
            this.browser = null;
        } else {
            await this.state.storage.setAlarm(Date.now() + 10000);
        }
    }
}

AI-Powered Web Scraper

import { Ai } from '@cloudflare/ai';

export default {
    async fetch(request: Request, env: Env): Promise<Response> {
        const browser = await puppeteer.launch(env.MYBROWSER);
        const page = await browser.newPage();
        await page.goto('https://news.ycombinator.com');
        const content = await page.content();
        await browser.close();

        const ai = new Ai(env.AI);
        const response = await ai.run('@cf/meta/llama-3-8b-instruct', {
            messages: [
                {
                    role: 'system',
                    content: 'Extract top 5 article titles and URLs as JSON'
                },
                { role: 'user', content: content }
            ]
        });

        return Response.json(response);
    }
};

Crawler with Queues

export default {
    async queue(batch: MessageBatch<any>, env: Env): Promise<void> {
        const browser = await puppeteer.launch(env.MYBROWSER);

        for (const message of batch.messages) {
            const page = await browser.newPage();
            await page.goto(message.body.url);

            const links = await page.evaluate(() => {
                return Array.from(document.querySelectorAll('a')).map(a => a.href);
            });

            for (const link of links) {
                await env.QUEUE.send({ url: link });
            }

            await page.close();
            message.ack();
        }

        await browser.close();
    }
};

Configuration

Timeout

await page.goto(url, {
    timeout: 60000, // 60 seconds max
    waitUntil: 'networkidle2'
});

await page.waitForSelector('.content', { timeout: 45000 });

Viewport

await page.setViewport({ width: 1920, height: 1080 });

Screenshot Options

const screenshot = await page.screenshot({
    type: 'png', // 'png' | 'jpeg' | 'webp'
    quality: 90, // JPEG/WebP only
    fullPage: true, // Full scrollable page
    clip: {
        // Crop
        x: 0,
        y: 0,
        width: 800,
        height: 600
    }
});

Limits & Pricing

Free Plan

• 10 minutes/day
• 3 concurrent browsers
• 3 new browsers/minute

Paid Plan

• 10 hours/month included
• 30 concurrent browsers
• 30 new browsers/minute
• $0.09/hour overage
• $2.00/concurrent browser overage

Cost Optimization

1. Use disconnect() instead of close() 2. Enable Keep-Alive (10 min max) 3. Pool tabs with browser contexts 4. Cache auth state with KV 5. Implement Durable Objects cleanup

Best Practices

Session Management

• Always use disconnect() for reuse
• Implement session pooling
• Track session IDs and states

Performance

• Cache content in KV
• Use browser contexts vs multiple browsers
• Choose appropriate waitUntil strategy
• Set realistic timeouts

Error Handling

• Handle timeout errors gracefully
• Check session availability before connecting
• Validate responses before caching

Security

• Validate user-provided URLs
• Implement authentication
• Sanitize extracted content
• Set appropriate CORS headers

Troubleshooting

Timeout Errors:

await page.goto(url, {
    timeout: 60000,
    waitUntil: 'domcontentloaded' // Faster than networkidle2
});

Memory Issues:

await page.close(); // Close pages
await browser.disconnect(); // Reuse session

Font Rendering: Use supported fonts (Noto Sans, Roboto, etc.) or inject custom:

<link href="https://fonts.googleapis.com/css2?family=Poppins" rel="stylesheet" />

Key Methods

Puppeteer

• puppeteer.launch(binding) - Start browser
• puppeteer.connect(binding, sessionId) - Reconnect
• puppeteer.sessions(binding) - List sessions
• browser.newPage() - Create page
• browser.disconnect() - Disconnect (keep alive)
• browser.close() - Close (terminate)
• page.goto(url, options) - Navigate
• page.screenshot(options) - Capture
• page.pdf(options) - Generate PDF
• page.content() - Get HTML
• page.evaluate(fn) - Execute JS

Resources

• Docs: https://developers.cloudflare.com/browser-rendering/
• Puppeteer: https://pptr.dev/
• Examples: https://developers.cloudflare.com/workers/examples/

Cloudflare D1 & KV

D1 (SQLite Database)

Setup

# Create database
wrangler d1 create my-database

# Add to wrangler.toml
[[d1_databases]]
binding = "DB"
database_name = "my-database"
database_id = "YOUR_DATABASE_ID"

# Apply schema
wrangler d1 execute my-database --file=./schema.sql

Usage

// Query
const result = await env.DB.prepare('SELECT * FROM users WHERE id = ?').bind(userId).first();

// Insert
await env.DB.prepare('INSERT INTO users (name, email) VALUES (?, ?)').bind('Alice', 'alice@example.com').run();

// Batch (atomic)
await env.DB.batch([
    env.DB.prepare('UPDATE accounts SET balance = balance - 100 WHERE id = ?').bind(user1),
    env.DB.prepare('UPDATE accounts SET balance = balance + 100 WHERE id = ?').bind(user2)
]);

// All results
const { results } = await env.DB.prepare('SELECT * FROM users').all();

Features

• Global read replication (low-latency reads)
• Single-writer consistency
• Standard SQLite syntax
• 25GB database size limit
• ACID transactions with batch

KV (Key-Value Store)

Setup

# Create namespace
wrangler kv:namespace create MY_KV

# Add to wrangler.toml
[[kv_namespaces]]
binding = "KV"
id = "YOUR_NAMESPACE_ID"

Usage

// Put with TTL
await env.KV.put('session:token', JSON.stringify(data), {
    expirationTtl: 3600,
    metadata: { userId: '123' }
});

// Get
const value = await env.KV.get('session:token');
const json = await env.KV.get('session:token', 'json');
const buffer = await env.KV.get('session:token', 'arrayBuffer');
const stream = await env.KV.get('session:token', 'stream');

// Get with metadata
const { value, metadata } = await env.KV.getWithMetadata('session:token');

// Delete
await env.KV.delete('session:token');

// List
const list = await env.KV.list({ prefix: 'user:' });

Features

• Sub-millisecond reads (edge-cached)
• Eventual consistency (~60 seconds globally)
• 25MB value size limit
• Automatic expiration (TTL)

Use Cases

D1

• Relational data
• Complex queries with JOINs
• ACID transactions
• User accounts, orders, inventory

KV

• Cache
• Sessions
• Feature flags
• Rate limiting
• Real-time counters

Decision Matrix

Resources

• D1: https://developers.cloudflare.com/d1/
• KV: https://developers.cloudflare.com/kv/

Cloudflare Platform Overview

Cloudflare Developer Platform: comprehensive edge computing ecosystem for full-stack applications on global network across 300+ cities.

Core Concepts

Edge Computing Model

Global Network:

• Code runs on servers in 300+ cities globally
• Requests execute from nearest location
• Ultra-low latency (<50ms typical)
• Automatic failover and redundancy

V8 Isolates:

• Lightweight execution environments (faster than containers)
• Millisecond cold starts
• Zero infrastructure management
• Automatic scaling
• Pay-per-request pricing

Key Components

Workers - Serverless functions on edge

• HTTP/scheduled/queue/email handlers
• JavaScript/TypeScript/Python/Rust support
• Max 50ms CPU (free), 30s (paid)
• 128MB memory limit

D1 - SQLite database with global read replication

• Standard SQLite syntax
• Single-writer consistency
• Global read replication
• 25GB database size limit
• Batch operations for transactions

KV - Distributed key-value store

• Sub-millisecond reads (edge-cached)
• Eventual consistency (~60s globally)
• 25MB value size limit
• Automatic TTL expiration
• Best for: cache, sessions, feature flags

R2 - Object storage (S3-compatible)

• Zero egress fees (huge cost advantage)
• Unlimited storage
• 5TB object size limit
• S3-compatible API
• Multipart upload support

Durable Objects - Stateful compute with WebSockets

• Single-instance coordination (strong consistency)
• Persistent storage (1GB limit paid)
• WebSocket support
• Automatic hibernation

Queues - Message queue system

• At-least-once delivery
• Automatic retries (exponential backoff)
• Dead-letter queue support
• Batch processing

Pages - Static site hosting + serverless functions

• Git integration (auto-deploy)
• Directory-based routing
• Framework support (Next.js, Remix, Astro, SvelteKit)
• Built-in preview deployments

Workers AI - Run AI models on edge

• LLMs (Llama 3, Mistral, Gemma, Qwen)
• Image generation (Stable Diffusion, DALL-E)
• Embeddings (BGE, GTE)
• Speech recognition (Whisper)
• No GPU management required

Browser Rendering - Headless browser automation

• Puppeteer/Playwright support
• Screenshots, PDFs, web scraping
• Session reuse for cost optimization
• MCP server support for AI agents

Architecture Patterns

Full-Stack Application

┌─────────────────────────────────────────┐
│    Cloudflare Pages (Frontend)          │
│    Next.js / Remix / Astro               │
└──────────────────┬──────────────────────┘
                   │
┌──────────────────▼──────────────────────┐
│    Workers (API Layer)                   │
│    - Routing                             │
│    - Authentication                      │
│    - Business logic                      │
└─┬──────┬──────┬──────┬──────┬───────────┘
  │      │      │      │      │
  ▼      ▼      ▼      ▼      ▼
┌────┐ ┌────┐ ┌────┐ ┌────┐ ┌────────────┐
│ D1 │ │ KV │ │ R2 │ │ DO │ │ Workers AI │
└────┘ └────┘ └────┘ └────┘ └────────────┘

Polyglot Storage Pattern

export default {
    async fetch(request: Request, env: Env) {
        // KV: Fast cache
        const cached = await env.KV.get(key);
        if (cached) return new Response(cached);

        // D1: Structured data
        const user = await env.DB.prepare('SELECT * FROM users WHERE id = ?').bind(userId).first();

        // R2: Media files
        const avatar = await env.R2_BUCKET.get(`avatars/${user.id}.jpg`);

        // Durable Objects: Real-time
        const chat = env.CHAT_ROOM.get(env.CHAT_ROOM.idFromName(roomId));

        // Queue: Async processing
        await env.EMAIL_QUEUE.send({ to: user.email, template: 'welcome' });

        return new Response(JSON.stringify({ user }));
    }
};

Wrangler CLI Essentials

Installation

npm install -g wrangler
wrangler login
wrangler init my-worker

Core Commands

# Development
wrangler dev                    # Local dev server
wrangler dev --remote          # Dev on real edge

# Deployment
wrangler deploy                # Deploy to production
wrangler deploy --dry-run      # Preview changes

# Logs
wrangler tail                  # Real-time logs
wrangler tail --format pretty  # Formatted logs

# Versions
wrangler deployments list      # List deployments
wrangler rollback [version]    # Rollback

# Secrets
wrangler secret put SECRET_NAME
wrangler secret list

Resource Management

# D1
wrangler d1 create my-db
wrangler d1 execute my-db --file=schema.sql

# KV
wrangler kv:namespace create MY_KV
wrangler kv:key put --binding=MY_KV "key" "value"

# R2
wrangler r2 bucket create my-bucket
wrangler r2 object put my-bucket/file.txt --file=./file.txt

Configuration (wrangler.toml)

name = "my-worker"
main = "src/index.ts"
compatibility_date = "2024-01-01"

# Environment variables
[vars]
ENVIRONMENT = "production"

# D1 Database
[[d1_databases]]
binding = "DB"
database_name = "my-database"
database_id = "YOUR_DATABASE_ID"

# KV Namespace
[[kv_namespaces]]
binding = "KV"
id = "YOUR_NAMESPACE_ID"

# R2 Bucket
[[r2_buckets]]
binding = "R2_BUCKET"
bucket_name = "my-bucket"

# Durable Objects
[[durable_objects.bindings]]
name = "COUNTER"
class_name = "Counter"
script_name = "my-worker"

# Queues
[[queues.producers]]
binding = "MY_QUEUE"
queue = "my-queue"

# Workers AI
[ai]
binding = "AI"

# Cron triggers
[triggers]
crons = ["0 0 * * *"]

Best Practices

Performance

• Keep Workers lightweight (<1MB bundled)
• Use bindings over fetch (faster than HTTP)
• Leverage KV and Cache API for frequently accessed data
• Use D1 batch for multiple queries
• Stream large responses

Security

• Use wrangler secret for API keys
• Separate production/staging/development environments
• Validate user input
• Implement rate limiting (KV or Durable Objects)
• Configure proper CORS headers

Cost Optimization

• R2 for large files (zero egress fees vs S3)
• KV for caching (reduce D1/R2 requests)
• Request deduplication with caching
• Efficient D1 queries (proper indexing)
• Monitor usage via Cloudflare Analytics

Decision Matrix

Resources

• Docs: https://developers.cloudflare.com
• Wrangler: https://developers.cloudflare.com/workers/wrangler/
• Discord: https://discord.cloudflare.com
• Examples: https://developers.cloudflare.com/workers/examples/
• Status: https://www.cloudflarestatus.com

Cloudflare R2 Storage

S3-compatible object storage with zero egress fees.

Quick Start

Create Bucket

wrangler r2 bucket create my-bucket
wrangler r2 bucket create my-bucket --location=wnam

Locations: wnam, enam, weur, eeur, apac

Upload Object

wrangler r2 object put my-bucket/file.txt --file=./local-file.txt

Workers Binding

wrangler.toml:

[[r2_buckets]]
binding = "MY_BUCKET"
bucket_name = "my-bucket"

Worker:

// Put
await env.MY_BUCKET.put('user-uploads/photo.jpg', imageData, {
    httpMetadata: {
        contentType: 'image/jpeg',
        cacheControl: 'public, max-age=31536000'
    },
    customMetadata: {
        uploadedBy: userId,
        uploadDate: new Date().toISOString()
    }
});

// Get
const object = await env.MY_BUCKET.get('large-file.mp4');
if (!object) {
    return new Response('Not found', { status: 404 });
}

return new Response(object.body, {
    headers: {
        'Content-Type': object.httpMetadata.contentType,
        ETag: object.etag
    }
});

// List
const listed = await env.MY_BUCKET.list({
    prefix: 'user-uploads/',
    limit: 100
});

// Delete
await env.MY_BUCKET.delete('old-file.txt');

// Head (check existence)
const object = await env.MY_BUCKET.head('file.txt');
if (object) {
    console.log('Size:', object.size);
}

S3 API Integration

AWS CLI

# Configure
aws configure
# Access Key ID: <your-key-id>
# Secret Access Key: <your-secret>
# Region: auto

# Operations
aws s3api list-buckets --endpoint-url https://<accountid>.r2.cloudflarestorage.com

aws s3 cp file.txt s3://my-bucket/ --endpoint-url https://<accountid>.r2.cloudflarestorage.com

# Presigned URL
aws s3 presign s3://my-bucket/file.txt --endpoint-url https://<accountid>.r2.cloudflarestorage.com --expires-in 3600

JavaScript (AWS SDK v3)

import { S3Client, PutObjectCommand } from '@aws-sdk/client-s3';

const s3 = new S3Client({
    region: 'auto',
    endpoint: `https://${accountId}.r2.cloudflarestorage.com`,
    credentials: {
        accessKeyId: process.env.R2_ACCESS_KEY_ID,
        secretAccessKey: process.env.R2_SECRET_ACCESS_KEY
    }
});

await s3.send(
    new PutObjectCommand({
        Bucket: 'my-bucket',
        Key: 'file.txt',
        Body: fileContents
    })
);

Python (Boto3)

import boto3

s3 = boto3.client(
    service_name='s3',
    endpoint_url=f'https://{account_id}.r2.cloudflarestorage.com',
    aws_access_key_id=access_key_id,
    aws_secret_access_key=secret_access_key,
    region_name='auto'
)

s3.upload_fileobj(file_obj, 'my-bucket', 'file.txt')
s3.download_file('my-bucket', 'file.txt', './local-file.txt')

Multipart Uploads

For files >100MB:

const multipart = await env.MY_BUCKET.createMultipartUpload('large-file.mp4');

// Upload parts (5MiB - 5GiB each, max 10,000 parts)
const part1 = await multipart.uploadPart(1, chunk1);
const part2 = await multipart.uploadPart(2, chunk2);

// Complete
const object = await multipart.complete([part1, part2]);

Rclone (Large Files)

rclone config  # Configure Cloudflare R2

# Upload with optimization
rclone copy large-video.mp4 r2:my-bucket/ \
  --s3-upload-cutoff=100M \
  --s3-chunk-size=100M

Public Buckets

Enable Public Access

1. Dashboard → R2 → Bucket → Settings → Public Access 2. Add custom domain (recommended) or use r2.dev

r2.dev (rate-limited):

https://pub-<hash>.r2.dev/file.txt

Custom domain (production): Cloudflare handles DNS/TLS automatically

CORS Configuration

wrangler r2 bucket cors put my-bucket --rules '[
  {
    "AllowedOrigins": ["https://example.com"],
    "AllowedMethods": ["GET", "PUT", "POST"],
    "AllowedHeaders": ["*"],
    "ExposeHeaders": ["ETag"],
    "MaxAgeSeconds": 3600
  }
]'

Lifecycle Rules

wrangler r2 bucket lifecycle put my-bucket --rules '[
  {
    "action": {"type": "AbortIncompleteMultipartUpload"},
    "filter": {},
    "abortIncompleteMultipartUploadDays": 7
  },
  {
    "action": {"type": "Transition", "storageClass": "InfrequentAccess"},
    "filter": {"prefix": "archives/"},
    "daysFromCreation": 90
  }
]'

Event Notifications

wrangler r2 bucket notification create my-bucket \
  --queue=my-queue \
  --event-type=object-create

Supported events: object-create, object-delete

Data Migration

Sippy (Incremental)

wrangler r2 bucket sippy enable my-bucket \
  --provider=aws \
  --bucket=source-bucket \
  --region=us-east-1 \
  --access-key-id=$AWS_KEY \
  --secret-access-key=$AWS_SECRET

Objects migrate on first request.

Super Slurper (Bulk)

Use dashboard for one-time complete migration from AWS, GCS, Azure.

Best Practices

Performance

• Use Cloudflare Cache with custom domains
• Multipart uploads for files >100MB
• Rclone for batch operations
• Location hints match user geography

Security

• Never commit Access Keys
• Use environment variables
• Bucket-scoped tokens for least privilege
• Presigned URLs for temporary access
• Enable Cloudflare Access for protection

Cost Optimization

• Infrequent Access storage for archives (30+ days)
• Lifecycle rules to auto-transition/delete
• Larger multipart chunks = fewer Class A operations
• Monitor usage via dashboard

Naming

• Bucket names: lowercase, hyphens, 3-63 chars
• Avoid sequential prefixes (use hashed for performance)
• No dots in bucket names if using custom domains with TLS

Limits

• Buckets per account: 1,000
• Object size: 5TB max
• Lifecycle rules: 1,000 per bucket
• Event notification rules: 100 per bucket
• r2.dev rate limit: 1,000 req/min (use custom domains)

Troubleshooting

401 Unauthorized:

• Verify Access Keys
• Check endpoint URL includes account ID
• Ensure region is "auto"

403 Forbidden:

• Check bucket permissions
• Verify CORS configuration
• Confirm bucket exists

Presigned URLs not working:

• Verify CORS configuration
• Check URL expiry time
• Ensure origin matches CORS rules

Resources

• Docs: https://developers.cloudflare.com/r2/
• Wrangler: https://developers.cloudflare.com/r2/reference/wrangler-commands/
• S3 Compatibility: https://developers.cloudflare.com/r2/api/s3/api/
• Workers API: https://developers.cloudflare.com/r2/api/workers/

Cloudflare Workers Advanced Patterns

Advanced techniques for optimization, performance, and complex workflows.

Session Reuse and Connection Pooling

Durable Objects for Persistent Sessions

export class Browser {
    state: DurableObjectState;
    browser: any;
    lastUsed: number;

    constructor(state: DurableObjectState, env: Env) {
        this.state = state;
        this.lastUsed = Date.now();
    }

    async fetch(request: Request, env: Env) {
        if (!this.browser) {
            this.browser = await puppeteer.launch(env.MYBROWSER);
        }

        this.lastUsed = Date.now();
        await this.state.storage.setAlarm(Date.now() + 10000);

        const page = await this.browser.newPage();
        await page.goto(new URL(request.url).searchParams.get('url'));
        const screenshot = await page.screenshot();
        await page.close();

        return new Response(screenshot);
    }

    async alarm() {
        if (Date.now() - this.lastUsed > 60000) {
            await this.browser?.close();
            this.browser = null;
        } else {
            await this.state.storage.setAlarm(Date.now() + 10000);
        }
    }
}

Multi-Tier Caching Strategy

const CACHE_TTL = 3600;

export default {
    async fetch(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {
        const cache = caches.default;
        const cacheKey = new Request(request.url);

        // 1. Check edge cache
        let response = await cache.match(cacheKey);
        if (response) return response;

        // 2. Check KV cache
        const kvCached = await env.MY_KV.get(request.url);
        if (kvCached) {
            response = new Response(kvCached);
            ctx.waitUntil(cache.put(cacheKey, response.clone()));
            return response;
        }

        // 3. Fetch from origin
        response = await fetch(request);

        // 4. Store in both caches
        ctx.waitUntil(
            Promise.all([
                cache.put(cacheKey, response.clone()),
                env.MY_KV.put(request.url, await response.clone().text(), {
                    expirationTtl: CACHE_TTL
                })
            ])
        );

        return response;
    }
};

WebSocket with Durable Objects

export class ChatRoom {
    state: DurableObjectState;
    sessions: Set<WebSocket>;

    constructor(state: DurableObjectState) {
        this.state = state;
        this.sessions = new Set();
    }

    async fetch(request: Request) {
        const pair = new WebSocketPair();
        const [client, server] = Object.values(pair);

        this.state.acceptWebSocket(server);
        this.sessions.add(server);

        return new Response(null, { status: 101, webSocket: client });
    }

    async webSocketMessage(ws: WebSocket, message: string) {
        // Broadcast to all connected clients
        for (const session of this.sessions) {
            session.send(message);
        }
    }

    async webSocketClose(ws: WebSocket) {
        this.sessions.delete(ws);
    }
}

Queue-Based Crawler

export default {
    async queue(batch: MessageBatch<any>, env: Env): Promise<void> {
        const browser = await puppeteer.launch(env.MYBROWSER);

        for (const message of batch.messages) {
            const page = await browser.newPage();
            await page.goto(message.body.url);

            // Extract links
            const links = await page.evaluate(() => {
                return Array.from(document.querySelectorAll('a')).map(a => a.href);
            });

            // Queue new links
            for (const link of links) {
                await env.QUEUE.send({ url: link });
            }

            await page.close();
            message.ack();
        }

        await browser.close();
    }
};

Authentication Pattern

import { sign, verify } from 'hono/jwt';

async function authenticate(request: Request, env: Env): Promise<any> {
    const authHeader = request.headers.get('Authorization');

    if (!authHeader?.startsWith('Bearer ')) {
        throw new Error('Missing token');
    }

    const token = authHeader.substring(7);
    const payload = await verify(token, env.JWT_SECRET);

    return payload;
}

export default {
    async fetch(request: Request, env: Env): Promise<Response> {
        try {
            const user = await authenticate(request, env);
            return new Response(`Hello ${user.name}`);
        } catch (error) {
            return new Response('Unauthorized', { status: 401 });
        }
    }
};

Code Splitting

// Lazy load large dependencies
export default {
    async fetch(request: Request): Promise<Response> {
        const url = new URL(request.url);

        if (url.pathname === '/heavy') {
            const { processHeavy } = await import('./heavy');
            return processHeavy(request);
        }

        return new Response('OK');
    }
};

Batch Operations with D1

// Efficient bulk inserts
const statements = users.map(user => env.DB.prepare('INSERT INTO users (name, email) VALUES (?, ?)').bind(user.name, user.email));

await env.DB.batch(statements);

Stream Processing

const { readable, writable } = new TransformStream({
    transform(chunk, controller) {
        // Process chunk
        controller.enqueue(chunk);
    }
});

response.body.pipeTo(writable);
return new Response(readable);

AI-Powered Web Scraper

import { Ai } from '@cloudflare/ai';

export default {
    async fetch(request: Request, env: Env): Promise<Response> {
        // Render page
        const browser = await puppeteer.launch(env.MYBROWSER);
        const page = await browser.newPage();
        await page.goto('https://news.ycombinator.com');
        const content = await page.content();
        await browser.close();

        // Extract with AI
        const ai = new Ai(env.AI);
        const response = await ai.run('@cf/meta/llama-3-8b-instruct', {
            messages: [
                {
                    role: 'system',
                    content: 'Extract top 5 article titles and URLs as JSON array'
                },
                { role: 'user', content: content }
            ]
        });

        return Response.json(response);
    }
};

Performance Optimization

Bundle Size

• Keep Workers <1MB bundled
• Remove unused dependencies
• Use code splitting
• Check with: wrangler deploy --dry-run --outdir=dist

Cold Starts

• Minimize initialization code
• Use bindings over fetch
• Avoid large imports at top level

Memory Management

• Close pages when done: await page.close()
• Disconnect browsers: await browser.disconnect()
• Implement cleanup alarms in Durable Objects

Request Optimization

• Use server-side filtering with --filter
• Batch operations with D1 .batch()
• Stream large responses
• Implement proper caching

Monitoring & Debugging

# Real-time logs
wrangler tail --format pretty

# Filter by status
wrangler tail --status error

# Check deployments
wrangler deployments list

# Rollback
wrangler rollback [version-id]

Production Checklist

• [ ] Multi-stage error handling implemented
• [ ] Rate limiting configured
• [ ] Caching strategy in place
• [ ] Secrets managed with wrangler secret
• [ ] Health checks implemented
• [ ] Monitoring alerts configured
• [ ] Session reuse for browser rendering
• [ ] Resource cleanup (pages, browsers)
• [ ] Proper timeout configurations
• [ ] CI/CD pipeline set up

Resources

• Advanced Patterns: https://developers.cloudflare.com/workers/examples/
• Durable Objects: https://developers.cloudflare.com/workers/runtime-apis/durable-objects/
• Performance: https://developers.cloudflare.com/workers/platform/limits/

Cloudflare Workers Runtime APIs

Key runtime APIs for Workers development.

Fetch API

// Subrequest
const response = await fetch('https://api.example.com/data', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ key: 'value' }),
    cf: {
        cacheTtl: 3600,
        cacheEverything: true
    }
});

const data = await response.json();

Headers API

// Read headers
const userAgent = request.headers.get('User-Agent');

// Cloudflare-specific
const country = request.cf?.country;
const colo = request.cf?.colo;
const clientIP = request.headers.get('CF-Connecting-IP');

// Set headers
const headers = new Headers();
headers.set('Content-Type', 'application/json');
headers.append('X-Custom-Header', 'value');

HTMLRewriter

export default {
    async fetch(request: Request): Promise<Response> {
        const response = await fetch(request);

        return new HTMLRewriter()
            .on('title', {
                element(element) {
                    element.setInnerContent('New Title');
                }
            })
            .on('a[href]', {
                element(element) {
                    const href = element.getAttribute('href');
                    element.setAttribute('href', href.replace('http://', 'https://'));
                }
            })
            .transform(response);
    }
};

WebSockets

export default {
    async fetch(request: Request): Promise<Response> {
        const upgradeHeader = request.headers.get('Upgrade');
        if (upgradeHeader !== 'websocket') {
            return new Response('Expected WebSocket', { status: 426 });
        }

        const pair = new WebSocketPair();
        const [client, server] = Object.values(pair);

        server.accept();

        server.addEventListener('message', event => {
            server.send(`Echo: ${event.data}`);
        });

        return new Response(null, {
            status: 101,
            webSocket: client
        });
    }
};

Streams API

const { readable, writable } = new TransformStream();

const writer = writable.getWriter();
writer.write(new TextEncoder().encode('chunk 1'));
writer.write(new TextEncoder().encode('chunk 2'));
writer.close();

return new Response(readable, {
    headers: { 'Content-Type': 'text/plain' }
});

Web Crypto API

// Generate hash
const data = new TextEncoder().encode('message');
const hashBuffer = await crypto.subtle.digest('SHA-256', data);
const hashArray = Array.from(new Uint8Array(hashBuffer));
const hashHex = hashArray.map(b => b.toString(16).padStart(2, '0')).join('');

// HMAC signature
const key = await crypto.subtle.importKey('raw', new TextEncoder().encode('secret'), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign', 'verify']);

const signature = await crypto.subtle.sign('HMAC', key, data);
const valid = await crypto.subtle.verify('HMAC', key, signature, data);

// Random values
const randomBytes = crypto.getRandomValues(new Uint8Array(32));
const uuid = crypto.randomUUID();

Encoding APIs

// TextEncoder
const encoder = new TextEncoder();
const bytes = encoder.encode('Hello');

// TextDecoder
const decoder = new TextDecoder();
const text = decoder.decode(bytes);

// Base64
const base64 = btoa('Hello');
const decoded = atob(base64);

URL API

const url = new URL(request.url);
const hostname = url.hostname;
const pathname = url.pathname;
const search = url.search;

// Query parameters
const name = url.searchParams.get('name');
url.searchParams.set('page', '2');
url.searchParams.delete('old');

FormData API

// Parse form data
const formData = await request.formData();
const name = formData.get('name');
const file = formData.get('file');

// Create form data
const form = new FormData();
form.append('name', 'value');
form.append('file', blob, 'filename.txt');

Response Types

// Text
return new Response('Hello');

// JSON
return Response.json({ message: 'Hello' });

// Stream
return new Response(readable);

// Redirect
return Response.redirect('https://example.com', 302);

// Error
return new Response('Not Found', { status: 404 });

Request Cloning

// Clone for multiple reads
const clone = request.clone();
const body1 = await request.json();
const body2 = await clone.json();

AbortController

const controller = new AbortController();
const { signal } = controller;

setTimeout(() => controller.abort(), 5000);

try {
    const response = await fetch('https://slow-api.com', { signal });
} catch (error) {
    if (error.name === 'AbortError') {
        console.log('Request timed out');
    }
}

Scheduling APIs

// setTimeout
const timeoutId = setTimeout(() => {
    console.log('Delayed');
}, 1000);

// setInterval
const intervalId = setInterval(() => {
    console.log('Repeated');
}, 1000);

// Clear
clearTimeout(timeoutId);
clearInterval(intervalId);

Console API

console.log('Info message');
console.error('Error message');
console.warn('Warning message');
console.debug('Debug message');

// Structured logging
console.log(
    JSON.stringify({
        level: 'info',
        message: 'Request processed',
        url: request.url,
        timestamp: new Date().toISOString()
    })
);

Performance API

const start = performance.now();
await processRequest();
const duration = performance.now() - start;
console.log(`Processed in ${duration}ms`);

Bindings Reference

KV Operations

await env.KV.put(key, value, { expirationTtl: 3600, metadata: { userId: '123' } });
const value = await env.KV.get(key, 'json');
const { value, metadata } = await env.KV.getWithMetadata(key);
await env.KV.delete(key);
const list = await env.KV.list({ prefix: 'user:' });

D1 Operations

const result = await env.DB.prepare('SELECT * FROM users WHERE id = ?').bind(userId).first();
const { results } = await env.DB.prepare('SELECT * FROM users').all();
await env.DB.prepare('INSERT INTO users (name) VALUES (?)').bind(name).run();
await env.DB.batch([stmt1, stmt2, stmt3]);

R2 Operations

await env.R2.put(key, value, { httpMetadata: { contentType: 'image/jpeg' } });
const object = await env.R2.get(key);
await env.R2.delete(key);
const list = await env.R2.list({ prefix: 'uploads/' });
const multipart = await env.R2.createMultipartUpload(key);

Queue Operations

await env.QUEUE.send({ type: 'email', to: 'user@example.com' });
await env.QUEUE.sendBatch([{ body: msg1 }, { body: msg2 }]);

Workers AI

const response = await env.AI.run('@cf/meta/llama-3-8b-instruct', {
    messages: [{ role: 'user', content: 'What is edge computing?' }]
});

Resources

• Runtime APIs: https://developers.cloudflare.com/workers/runtime-apis/
• Web Standards: https://developers.cloudflare.com/workers/runtime-apis/web-standards/
• Bindings: https://developers.cloudflare.com/workers/runtime-apis/bindings/

Cloudflare Workers Basics

Getting started with Cloudflare Workers: serverless functions that run on edge network across 300+ cities.

Handler Types

Fetch Handler (HTTP Requests)

export default {
    async fetch(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {
        return new Response('Hello World!');
    }
};

Scheduled Handler (Cron Jobs)

export default {
    async scheduled(event: ScheduledEvent, env: Env, ctx: ExecutionContext): Promise<void> {
        await fetch('https://api.example.com/cleanup');
    }
};

Configure in wrangler.toml:

[triggers]
crons = ["0 0 * * *"]  # Daily at midnight

Queue Handler (Message Processing)

export default {
    async queue(batch: MessageBatch, env: Env, ctx: ExecutionContext): Promise<void> {
        for (const message of batch.messages) {
            await processMessage(message.body);
            message.ack(); // Acknowledge success
        }
    }
};

Email Handler (Email Routing)

export default {
    async email(message: ForwardableEmailMessage, env: Env, ctx: ExecutionContext): Promise<void> {
        await message.forward('destination@example.com');
    }
};

Request/Response Basics

Parsing Request

const url = new URL(request.url);
const method = request.method;
const headers = request.headers;

// Query parameters
const name = url.searchParams.get('name');

// JSON body
const data = await request.json();

// Text body
const text = await request.text();

// Form data
const formData = await request.formData();

Creating Response

// Text response
return new Response('Hello', { status: 200 });

// JSON response
return new Response(JSON.stringify({ message: 'Hello' }), {
    status: 200,
    headers: { 'Content-Type': 'application/json' }
});

// Stream response
return new Response(readable, {
    headers: { 'Content-Type': 'text/plain' }
});

// Redirect
return Response.redirect('https://example.com', 302);

Routing Patterns

URL-Based Routing

export default {
    async fetch(request: Request): Promise<Response> {
        const url = new URL(request.url);

        switch (url.pathname) {
            case '/':
                return new Response('Home');
            case '/about':
                return new Response('About');
            default:
                return new Response('Not Found', { status: 404 });
        }
    }
};

Using Hono Framework (Recommended)

import { Hono } from 'hono';

const app = new Hono();

app.get('/', c => c.text('Home'));
app.get('/api/users/:id', async c => {
    const id = c.req.param('id');
    const user = await getUser(id);
    return c.json(user);
});

export default app;

Working with Bindings

Environment Variables

# wrangler.toml
[vars]
API_URL = "https://api.example.com"

const apiUrl = env.API_URL;

KV Namespace

// Put with TTL
await env.KV.put('session:token', JSON.stringify(data), {
    expirationTtl: 3600
});

// Get
const data = await env.KV.get('session:token', 'json');

// Delete
await env.KV.delete('session:token');

// List with prefix
const list = await env.KV.list({ prefix: 'user:123:' });

D1 Database

// Query
const result = await env.DB.prepare('SELECT * FROM users WHERE id = ?').bind(userId).first();

// Insert
await env.DB.prepare('INSERT INTO users (name, email) VALUES (?, ?)').bind('Alice', 'alice@example.com').run();

// Batch (atomic)
await env.DB.batch([
    env.DB.prepare('UPDATE accounts SET balance = balance - 100 WHERE id = ?').bind(1),
    env.DB.prepare('UPDATE accounts SET balance = balance + 100 WHERE id = ?').bind(2)
]);

R2 Bucket

// Put object
await env.R2_BUCKET.put('path/to/file.jpg', fileBuffer, {
    httpMetadata: {
        contentType: 'image/jpeg'
    }
});

// Get object
const object = await env.R2_BUCKET.get('path/to/file.jpg');
if (!object) {
    return new Response('Not found', { status: 404 });
}

// Stream response
return new Response(object.body, {
    headers: {
        'Content-Type': object.httpMetadata?.contentType || 'application/octet-stream'
    }
});

// Delete
await env.R2_BUCKET.delete('path/to/file.jpg');

Context API

waitUntil (Background Tasks)

export default {
    async fetch(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {
        // Run analytics after response sent
        ctx.waitUntil(
            fetch('https://analytics.example.com/log', {
                method: 'POST',
                body: JSON.stringify({ url: request.url })
            })
        );

        return new Response('OK');
    }
};

passThroughOnException

// Continue to origin on error
ctx.passThroughOnException();

// Your code that might throw
const data = await riskyOperation();

Error Handling

export default {
    async fetch(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {
        try {
            const response = await processRequest(request, env);
            return response;
        } catch (error) {
            console.error('Error:', error);

            // Log to external service
            ctx.waitUntil(
                fetch('https://logging.example.com/error', {
                    method: 'POST',
                    body: JSON.stringify({
                        error: error.message,
                        url: request.url
                    })
                })
            );

            return new Response('Internal Server Error', { status: 500 });
        }
    }
};

CORS

function corsHeaders(origin: string) {
    return {
        'Access-Control-Allow-Origin': origin,
        'Access-Control-Allow-Methods': 'GET, POST, PUT, DELETE, OPTIONS',
        'Access-Control-Allow-Headers': 'Content-Type, Authorization',
        'Access-Control-Max-Age': '86400'
    };
}

export default {
    async fetch(request: Request): Promise<Response> {
        const origin = request.headers.get('Origin') || '*';

        // Handle preflight
        if (request.method === 'OPTIONS') {
            return new Response(null, { headers: corsHeaders(origin) });
        }

        // Handle request
        const response = await handleRequest(request);
        const headers = new Headers(response.headers);
        Object.entries(corsHeaders(origin)).forEach(([key, value]) => {
            headers.set(key, value);
        });

        return new Response(response.body, {
            status: response.status,
            headers
        });
    }
};

Cache API

export default {
    async fetch(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {
        const cache = caches.default;
        const cacheKey = new Request(request.url);

        // Check cache
        let response = await cache.match(cacheKey);
        if (response) return response;

        // Fetch from origin
        response = await fetch(request);

        // Cache response
        ctx.waitUntil(cache.put(cacheKey, response.clone()));

        return response;
    }
};

Secrets Management

# Add secret
wrangler secret put API_KEY
# Enter value when prompted

# Use in Worker
const apiKey = env.API_KEY;

Local Development

# Start local dev server
wrangler dev

# Test with remote edge
wrangler dev --remote

# Custom port
wrangler dev --port 8080

# Access at http://localhost:8787

Deployment

# Deploy to production
wrangler deploy

# Deploy to specific environment
wrangler deploy --env staging

# Preview deployment
wrangler deploy --dry-run

Common Patterns

API Gateway

import { Hono } from 'hono';

const app = new Hono();

app.get('/api/users', async c => {
    const users = await c.env.DB.prepare('SELECT * FROM users').all();
    return c.json(users.results);
});

app.post('/api/users', async c => {
    const { name, email } = await c.req.json();
    await c.env.DB.prepare('INSERT INTO users (name, email) VALUES (?, ?)').bind(name, email).run();
    return c.json({ success: true }, 201);
});

export default app;

Rate Limiting

async function rateLimit(ip: string, env: Env): Promise<boolean> {
    const key = `ratelimit:${ip}`;
    const limit = 100;
    const window = 60;

    const current = await env.KV.get(key);
    const count = current ? parseInt(current) : 0;

    if (count >= limit) return false;

    await env.KV.put(key, (count + 1).toString(), {
        expirationTtl: window
    });

    return true;
}

export default {
    async fetch(request: Request, env: Env): Promise<Response> {
        const ip = request.headers.get('CF-Connecting-IP') || 'unknown';

        if (!(await rateLimit(ip, env))) {
            return new Response('Rate limit exceeded', { status: 429 });
        }

        return new Response('OK');
    }
};

Resources

• Docs: https://developers.cloudflare.com/workers/
• Examples: https://developers.cloudflare.com/workers/examples/
• Runtime APIs: https://developers.cloudflare.com/workers/runtime-apis/

Docker Basics

Core concepts and workflows for Docker containerization.

Core Concepts

Containers: Lightweight, isolated processes bundling apps with dependencies. Ephemeral by default.

Images: Read-only blueprints for containers. Layered filesystem for reusability.

Volumes: Persistent storage surviving container deletion.

Networks: Enable container communication.

Dockerfile Best Practices

Essential Instructions

FROM node:20-alpine              # Base image (use specific versions)
WORKDIR /app                     # Working directory
COPY package*.json ./            # Copy dependency files first
RUN npm install --production     # Execute build commands
COPY . .                         # Copy application code
ENV NODE_ENV=production          # Environment variables
EXPOSE 3000                      # Document exposed ports
USER node                        # Run as non-root (security)
CMD ["node", "server.js"]        # Default command

Multi-Stage Builds (Production)

# Stage 1: Build
FROM node:20-alpine AS build
WORKDIR /app
COPY package*.json ./
RUN npm install
COPY . .
RUN npm run build

# Stage 2: Production
FROM node:20-alpine AS production
WORKDIR /app
COPY --from=build /app/dist ./dist
COPY --from=build /app/node_modules ./node_modules
USER node
EXPOSE 3000
CMD ["node", "dist/server.js"]

Benefits: Smaller images, improved security, no build tools in production.

.dockerignore

node_modules
.git
.env
*.log
.DS_Store
README.md
docker-compose.yml
dist
coverage

Building Images

# Build with tag
docker build -t myapp:1.0 .

# Build targeting specific stage
docker build -t myapp:dev --target build .

# Build for multiple platforms
docker buildx build --platform linux/amd64,linux/arm64 -t myapp:1.0 .

# View layers
docker image history myapp:1.0

Running Containers

# Basic run
docker run myapp:1.0

# Background (detached)
docker run -d --name myapp myapp:1.0

# Port mapping (host:container)
docker run -p 8080:3000 myapp:1.0

# Environment variables
docker run -e NODE_ENV=production myapp:1.0

# Volume mount (named volume)
docker run -v mydata:/app/data myapp:1.0

# Bind mount (development)
docker run -v $(pwd)/src:/app/src myapp:1.0

# Resource limits
docker run --memory 512m --cpus 0.5 myapp:1.0

# Interactive terminal
docker run -it myapp:1.0 /bin/sh

Container Management

# List containers
docker ps
docker ps -a

# Logs
docker logs myapp
docker logs -f myapp          # Follow
docker logs --tail 100 myapp  # Last 100 lines

# Execute command
docker exec myapp ls /app
docker exec -it myapp /bin/sh  # Interactive shell

# Stop/start
docker stop myapp
docker start myapp

# Remove
docker rm myapp
docker rm -f myapp  # Force remove running

# Inspect
docker inspect myapp

# Monitor resources
docker stats myapp

# Copy files
docker cp myapp:/app/logs ./logs

Volume Management

# Create volume
docker volume create mydata

# List volumes
docker volume ls

# Remove volume
docker volume rm mydata

# Remove unused volumes
docker volume prune

Network Management

# Create network
docker network create my-network

# List networks
docker network ls

# Connect container
docker network connect my-network myapp

# Disconnect
docker network disconnect my-network myapp

Language-Specific Dockerfiles

Node.js

FROM node:20-alpine AS build
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY . .
RUN npm run build

FROM node:20-alpine
WORKDIR /app
COPY --from=build /app/dist ./dist
COPY --from=build /app/node_modules ./node_modules
USER node
CMD ["node", "dist/server.js"]

Python

FROM python:3.11-slim AS build
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

FROM python:3.11-slim
WORKDIR /app
COPY --from=build /usr/local/lib/python3.11/site-packages /usr/local/lib/python3.11/site-packages
COPY . .
RUN adduser --disabled-password appuser
USER appuser
CMD ["python", "app.py"]

Go

FROM golang:1.21-alpine AS build
WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 go build -o main .

FROM scratch
COPY --from=build /app/main /main
CMD ["/main"]

Security Hardening

# Use specific versions
FROM node:20.11.0-alpine3.19

# Create non-root user
RUN addgroup -g 1001 -S nodejs && \
    adduser -S nodejs -u 1001

# Set ownership
COPY --chown=nodejs:nodejs . .

# Switch to non-root
USER nodejs

Troubleshooting

Container exits immediately

docker logs myapp
docker run -it myapp /bin/sh
docker run -it --entrypoint /bin/sh myapp

Cannot connect

docker ps
docker port myapp
docker network inspect bridge
docker inspect myapp | grep IPAddress

Out of disk space

docker system df
docker system prune -a
docker volume prune

Build cache issues

docker build --no-cache -t myapp .
docker builder prune

Best Practices

• Use specific image versions, not latest
• Run as non-root user
• Multi-stage builds to minimize size
• Implement health checks
• Set resource limits
• Keep images under 500MB
• Scan for vulnerabilities: docker scout cves myapp:1.0

Quick Reference

Resources

• Docs: https://docs.docker.com
• Best Practices: https://docs.docker.com/develop/dev-best-practices/
• Dockerfile Reference: https://docs.docker.com/engine/reference/builder/

Docker Compose

Multi-container application orchestration.

Basic Structure

version: '3.8'

services:
    web:
        build: .
        ports:
            - '3000:3000'
        environment:
            - NODE_ENV=production
            - DATABASE_URL=postgresql://user:pass@db:5432/app
        depends_on:
            - db
            - redis
        volumes:
            - ./src:/app/src
        networks:
            - app-network
        restart: unless-stopped

    db:
        image: postgres:15-alpine
        environment:
            POSTGRES_USER: user
            POSTGRES_PASSWORD: pass
            POSTGRES_DB: app
        volumes:
            - postgres_data:/var/lib/postgresql/data
        networks:
            - app-network
        healthcheck:
            test: ['CMD-SHELL', 'pg_isready -U user']
            interval: 10s
            timeout: 5s
            retries: 5

    redis:
        image: redis:7-alpine
        networks:
            - app-network
        volumes:
            - redis_data:/data

volumes:
    postgres_data:
    redis_data:

networks:
    app-network:
        driver: bridge

Commands

# Start services
docker compose up
docker compose up -d

# Build images before starting
docker compose up --build

# Scale service
docker compose up -d --scale web=3

# Stop services
docker compose down

# Stop and remove volumes
docker compose down --volumes

# Logs
docker compose logs
docker compose logs -f web

# Execute command
docker compose exec web sh
docker compose exec db psql -U user -d app

# List services
docker compose ps

# Restart service
docker compose restart web

# Pull images
docker compose pull

# Validate
docker compose config

Environment-Specific Configs

compose.yml (base):

services:
    web:
        build: .
        ports:
            - '3000:3000'

compose.override.yml (dev, auto-loaded):

services:
    web:
        volumes:
            - ./src:/app/src # Live reload
        environment:
            - NODE_ENV=development
            - DEBUG=true
        command: npm run dev

compose.prod.yml (production):

services:
    web:
        image: registry.example.com/myapp:1.0
        restart: always
        environment:
            - NODE_ENV=production
        deploy:
            replicas: 3
            resources:
                limits:
                    cpus: '0.5'
                    memory: 512M

Usage:

# Development (uses compose.yml + compose.override.yml)
docker compose up

# Production
docker compose -f compose.yml -f compose.prod.yml up -d

Health Checks

services:
    web:
        healthcheck:
            test: ['CMD', 'curl', '-f', 'http://localhost:3000/health']
            interval: 30s
            timeout: 3s
            start_period: 40s
            retries: 3

Resource Limits

services:
    web:
        deploy:
            resources:
                limits:
                    cpus: '0.5'
                    memory: 512M
                reservations:
                    cpus: '0.25'
                    memory: 256M

Logging

services:
    web:
        logging:
            driver: 'json-file'
            options:
                max-size: '10m'
                max-file: '3'

Environment Variables

Using .env file:

# .env
DATABASE_URL=postgresql://user:pass@db:5432/app
API_KEY=secret

services:
    web:
        env_file:
            - .env

Networking

Services on same network communicate via service name:

services:
    web:
        depends_on:
            - db
        environment:
            # Use service name as hostname
            - DATABASE_URL=postgresql://user:pass@db:5432/app

Volume Backup/Restore

# Backup
docker compose run --rm -v app_data:/data -v $(pwd):/backup \
  alpine tar czf /backup/backup.tar.gz /data

# Restore
docker compose run --rm -v app_data:/data -v $(pwd):/backup \
  alpine tar xzf /backup/backup.tar.gz -C /data

Common Stacks

Web + Database + Cache

services:
    web:
        build: .
        depends_on:
            - db
            - redis
    db:
        image: postgres:15-alpine
    redis:
        image: redis:7-alpine

Microservices

services:
    api-gateway:
        build: ./gateway
    user-service:
        build: ./services/users
    order-service:
        build: ./services/orders
    rabbitmq:
        image: rabbitmq:3-management

Best Practices

• Use named volumes for data persistence
• Implement health checks for all services
• Set restart policies for production
• Use environment-specific compose files
• Configure resource limits
• Enable logging with size limits
• Use depends_on for service ordering
• Network isolation with custom networks

Troubleshooting

# View service logs
docker compose logs -f service-name

# Check service status
docker compose ps

# Restart specific service
docker compose restart service-name

# Rebuild service
docker compose up --build service-name

# Remove everything
docker compose down --volumes --rmi all

Resources

• Docs: https://docs.docker.com/compose/
• Compose Specification: https://docs.docker.com/compose/compose-file/
• Best Practices: https://docs.docker.com/compose/production/

Google Cloud Platform with gcloud CLI

Comprehensive guide for gcloud CLI - command-line interface for Google Cloud Platform.

Installation

Linux

curl -O https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-cli-linux-x86_64.tar.gz
tar -xf google-cloud-cli-linux-x86_64.tar.gz
./google-cloud-sdk/install.sh
./google-cloud-sdk/bin/gcloud init

Debian/Ubuntu

echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main" | sudo tee -a /etc/apt/sources.list.d/google-cloud-sdk.list
sudo apt-get update && sudo apt-get install google-cloud-cli

macOS

curl -O https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-cli-darwin-arm.tar.gz
tar -xf google-cloud-cli-darwin-arm.tar.gz
./google-cloud-sdk/install.sh

Authentication

User Account

# Login with browser
gcloud auth login

# Login without browser (remote/headless)
gcloud auth login --no-browser

# List accounts
gcloud auth list

# Switch account
gcloud config set account user@example.com

Service Account

# Activate with key file
gcloud auth activate-service-account SA_EMAIL --key-file=key.json

# Create service account
gcloud iam service-accounts create SA_NAME \
  --display-name="Service Account"

# Create key
gcloud iam service-accounts keys create key.json \
  --iam-account=SA_EMAIL

# Grant role
gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:SA_EMAIL" \
  --role="roles/compute.admin"

Service Account Impersonation (Recommended)

# Impersonate for single command
gcloud compute instances list \
  --impersonate-service-account=SA_EMAIL

# Set default impersonation
gcloud config set auth/impersonate_service_account SA_EMAIL

# Clear impersonation
gcloud config unset auth/impersonate_service_account

Why impersonation? Short-lived credentials, no key files, centralized management.

Configuration Management

Named Configurations

# Create configuration
gcloud config configurations create dev

# List configurations
gcloud config configurations list

# Activate configuration
gcloud config configurations activate dev

# Set properties
gcloud config set project my-project-dev
gcloud config set compute/region us-central1
gcloud config set compute/zone us-central1-a

# View properties
gcloud config list

# Delete configuration
gcloud config configurations delete dev

Multi-Environment Pattern

# Development
gcloud config configurations create dev
gcloud config set project my-project-dev
gcloud config set account dev@example.com

# Staging
gcloud config configurations create staging
gcloud config set project my-project-staging
gcloud config set auth/impersonate_service_account staging-sa@project.iam.gserviceaccount.com

# Production
gcloud config configurations create prod
gcloud config set project my-project-prod
gcloud config set auth/impersonate_service_account prod-sa@project.iam.gserviceaccount.com

Project Management

# List projects
gcloud projects list

# Create project
gcloud projects create PROJECT_ID --name="Project Name"

# Set active project
gcloud config set project PROJECT_ID

# Get current project
gcloud config get-value project

# Enable API
gcloud services enable compute.googleapis.com
gcloud services enable container.googleapis.com

# List enabled APIs
gcloud services list

Output Formats

# JSON (recommended for scripting)
gcloud compute instances list --format=json

# YAML
gcloud compute instances list --format=yaml

# CSV
gcloud compute instances list --format="csv(name,zone,status)"

# Value (single field)
gcloud config get-value project --format="value()"

# Custom table
gcloud compute instances list \
  --format="table(name,zone,machineType,status)"

Filtering

# Server-side filtering (efficient)
gcloud compute instances list --filter="zone:us-central1-a"
gcloud compute instances list --filter="status=RUNNING"
gcloud compute instances list --filter="name~^web-.*"

# Multiple conditions
gcloud compute instances list \
  --filter="zone:us-central1 AND status=RUNNING"

# Negation
gcloud compute instances list --filter="NOT status=TERMINATED"

CI/CD Integration

GitHub Actions

name: Deploy to GCP

on:
    push:
        branches: [main]

jobs:
    deploy:
        runs-on: ubuntu-latest
        steps:
            - uses: actions/checkout@v3

            - id: auth
              uses: google-github-actions/auth@v1
              with:
                  credentials_json: ${{ secrets.GCP_SA_KEY }}

            - name: Set up Cloud SDK
              uses: google-github-actions/setup-gcloud@v1

            - name: Deploy
              run: |
                  gcloud run deploy my-service \
                    --image=gcr.io/${{ secrets.GCP_PROJECT_ID }}/my-image \
                    --region=us-central1

GitLab CI

deploy:
    image: google/cloud-sdk:alpine
    script:
        - echo $GCP_SA_KEY | base64 -d > key.json
        - gcloud auth activate-service-account --key-file=key.json
        - gcloud config set project $GCP_PROJECT_ID
        - gcloud app deploy
    only:
        - main

Best Practices

Security

• Never commit credentials
• Use service account impersonation
• Grant minimal IAM permissions
• Rotate keys regularly

Performance

• Use server-side filtering: --filter
• Limit output: --limit=10
• Project only needed fields: --format="value(name)"
• Batch operations with --async

Maintainability

• Use named configurations for environments
• Document commands
• Use environment variables
• Implement error handling and retries

Troubleshooting

# Check authentication
gcloud auth list

# Re-authenticate
gcloud auth login
gcloud auth application-default login

# Check IAM permissions
gcloud projects get-iam-policy PROJECT_ID \
  --flatten="bindings[].members" \
  --filter="bindings.members:user@example.com"

# View configuration
gcloud config list

# Reset configuration
gcloud config configurations delete default
gcloud init

Quick Reference

Global Flags

Resources

• gcloud Reference: https://cloud.google.com/sdk/gcloud/reference
• Installation: https://cloud.google.com/sdk/docs/install
• Authentication: https://cloud.google.com/docs/authentication
• Cheatsheet: https://cloud.google.com/sdk/docs/cheatsheet

Google Cloud Services

Compute Engine (VMs)

# List instances
gcloud compute instances list

# Create instance
gcloud compute instances create my-instance \
  --zone=us-central1-a \
  --machine-type=e2-medium \
  --image-family=debian-11 \
  --image-project=debian-cloud \
  --boot-disk-size=10GB

# SSH into instance
gcloud compute ssh my-instance --zone=us-central1-a

# Copy files
gcloud compute scp local-file.txt my-instance:~/remote-file.txt \
  --zone=us-central1-a

# Stop instance
gcloud compute instances stop my-instance --zone=us-central1-a

# Delete instance
gcloud compute instances delete my-instance --zone=us-central1-a

Google Kubernetes Engine (GKE)

# Create cluster
gcloud container clusters create my-cluster \
  --zone=us-central1-a \
  --num-nodes=3 \
  --machine-type=e2-medium

# Get credentials
gcloud container clusters get-credentials my-cluster --zone=us-central1-a

# List clusters
gcloud container clusters list

# Resize cluster
gcloud container clusters resize my-cluster \
  --num-nodes=5 \
  --zone=us-central1-a

# Delete cluster
gcloud container clusters delete my-cluster --zone=us-central1-a

Cloud Run (Serverless Containers)

# Deploy container
gcloud run deploy my-service \
  --image=gcr.io/PROJECT_ID/my-image:tag \
  --platform=managed \
  --region=us-central1 \
  --allow-unauthenticated

# List services
gcloud run services list

# Describe service
gcloud run services describe my-service --region=us-central1

# Delete service
gcloud run services delete my-service --region=us-central1

App Engine

# Deploy application
gcloud app deploy app.yaml

# View application
gcloud app browse

# View logs
gcloud app logs tail

# List versions
gcloud app versions list

# Delete version
gcloud app versions delete VERSION_ID

# Set traffic split
gcloud app services set-traffic SERVICE \
  --splits v1=0.5,v2=0.5

Cloud Storage

# Create bucket
gsutil mb gs://my-bucket-name

# Upload file
gsutil cp local-file.txt gs://my-bucket-name/

# Download file
gsutil cp gs://my-bucket-name/file.txt ./

# List contents
gsutil ls gs://my-bucket-name/

# Sync directory
gsutil rsync -r ./local-dir gs://my-bucket-name/remote-dir

# Set permissions
gsutil iam ch user:user@example.com:objectViewer gs://my-bucket-name

# Delete bucket
gsutil rm -r gs://my-bucket-name

Cloud SQL

# Create instance
gcloud sql instances create my-instance \
  --database-version=POSTGRES_14 \
  --tier=db-f1-micro \
  --region=us-central1

# Create database
gcloud sql databases create my-database \
  --instance=my-instance

# Create user
gcloud sql users create my-user \
  --instance=my-instance \
  --password=PASSWORD

# Connect
gcloud sql connect my-instance --user=my-user

# Delete instance
gcloud sql instances delete my-instance

Cloud Functions

# Deploy function
gcloud functions deploy my-function \
  --runtime=python39 \
  --trigger-http \
  --allow-unauthenticated \
  --entry-point=main

# List functions
gcloud functions list

# Describe function
gcloud functions describe my-function

# Call function
gcloud functions call my-function

# Delete function
gcloud functions delete my-function

BigQuery

# List datasets
bq ls

# Create dataset
bq mk my_dataset

# Load data
bq load --source_format=CSV my_dataset.my_table \
  gs://my-bucket/data.csv \
  schema.json

# Query
bq query --use_legacy_sql=false \
  'SELECT * FROM `my_dataset.my_table` LIMIT 10'

# Delete dataset
bq rm -r -f my_dataset

Cloud Build

# Submit build
gcloud builds submit --tag=gcr.io/PROJECT_ID/my-image

# List builds
gcloud builds list

# Describe build
gcloud builds describe BUILD_ID

# Cancel build
gcloud builds cancel BUILD_ID

Artifact Registry

# Create repository
gcloud artifacts repositories create my-repo \
  --repository-format=docker \
  --location=us-central1

# Configure Docker
gcloud auth configure-docker us-central1-docker.pkg.dev

# Push image
docker tag my-image us-central1-docker.pkg.dev/PROJECT_ID/my-repo/my-image
docker push us-central1-docker.pkg.dev/PROJECT_ID/my-repo/my-image

# List repositories
gcloud artifacts repositories list

Networking

# Create VPC network
gcloud compute networks create my-network \
  --subnet-mode=auto

# Create firewall rule
gcloud compute firewall-rules create allow-http \
  --network=my-network \
  --allow=tcp:80

# List networks
gcloud compute networks list

# List firewall rules
gcloud compute firewall-rules list

IAM

# List IAM policy
gcloud projects get-iam-policy PROJECT_ID

# Add IAM binding
gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="user:user@example.com" \
  --role="roles/viewer"

# Remove IAM binding
gcloud projects remove-iam-policy-binding PROJECT_ID \
  --member="user:user@example.com" \
  --role="roles/viewer"

# List service accounts
gcloud iam service-accounts list

Monitoring & Logging

# View logs
gcloud logging read "resource.type=gce_instance" \
  --limit=10 \
  --format=json

# Create log sink
gcloud logging sinks create my-sink \
  storage.googleapis.com/my-bucket \
  --log-filter="resource.type=gce_instance"

# List metrics
gcloud monitoring metrics-descriptors list

Quick Reference

Resources

• Compute Engine: https://cloud.google.com/compute/docs
• GKE: https://cloud.google.com/kubernetes-engine/docs
• Cloud Run: https://cloud.google.com/run/docs
• App Engine: https://cloud.google.com/appengine/docs
• Cloud Storage: https://cloud.google.com/storage/docs