Add tunnel cleanup sweep for abandoned resources#726
Open
aron-cf wants to merge 1 commit into
Open
Conversation
🦋 Changeset detectedLatest commit: 34b49e2 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
commit: |
Contributor
🐳 Docker Images Published
Usage: FROM cloudflare/sandbox:0.0.0-pr-726-34b49e25Version: 📦 Standalone BinaryFor arbitrary Dockerfiles: COPY --from=cloudflare/sandbox:0.0.0-pr-726-34b49e25 /container-server/sandbox /sandbox
ENTRYPOINT ["/sandbox"]Download via GitHub CLI: gh run download 28513966368 -n sandbox-binaryExtract from Docker: docker run --rm cloudflare/sandbox:0.0.0-pr-726-34b49e25 cat /container-server/sandbox > sandbox && chmod +x sandbox |
ghostwriternr
force-pushed
the
tunnels-cleanup-helper
branch
from
47baf86 to
8cf5e26
Compare
ghostwriternr
changed the title
Long-lived deployments can leak Cloudflare tunnels and CNAME records when Durable Object cleanup does not run before resources are abandoned (DO eviction, crashes, missed destroy calls). Add a `@cloudflare/sandbox/tunnels` entrypoint that sweeps stale SDK-owned tunnels and orphaned DNS records, plus a scheduled handler factory for wiring it into a Cron Trigger. Deletion is deliberately conservative: it only touches resources tagged by this SDK, requires identifying metadata, ignores unknown tunnel statuses, and removes a CNAME only when its target tunnel is absent from the account's live tunnel list and the record has aged past the stale window. Co-authored-by: Aron <263346377+aron-cf@users.noreply.github.com>
ghostwriternr
force-pushed
the
tunnels-cleanup-helper
branch
from
8cf5e26 to
34b49e2
Compare
ghostwriternr
requested review from
ghostwriternr,
scuffi and
whoiskatrin
as code owners
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Long-lived deployments leak Cloudflare tunnels and their CNAME records when Durable Object cleanup never runs before the resources are abandoned — DO eviction, crashes, or a missed
destroy()call all leave a tunnel and DNS record behind, counting against the per-account quota. Named-tunnel support (#722) created these resources but had no path to reclaim the ones that slip through.This adds a
@cloudflare/sandbox/tunnelsentrypoint that sweeps stale SDK-owned tunnels and orphaned CNAME records, plus a scheduled handler factory for running it from a Worker Cron Trigger:The handler reads credentials from
envat invocation time and is a no-op whenCLOUDFLARE_API_TOKENis missing, so examples keep deploying without secrets. It usesCLOUDFLARE_TUNNEL_ACCOUNT_ID/CLOUDFLARE_ACCOUNT_IDwhen set and otherwise infers the account from a single-account token;CLOUDFLARE_ZONE_IDis inferred when unambiguous. Zone inference is treated as non-fatal: without a resolved zone the sweep still deletes stale tunnels and just skips DNS cleanup, reporting the reason throughonError.Deletion is deliberately conservative. The sweep only touches resources tagged
createdBy: 'sandbox-sdk', refuses any tunnel missing itsmetadata.sandboxIdtag (those surface inSweepResult.errorsinstead of being deleted), ignores unrecognized tunnel statuses, and removes a CNAME only when its target tunnel is absent from the account's live tunnel list and the record has aged past the stale window. AdryRunoption reports the sameSweepResultwithout issuing any deletes, so operators can inspect candidates before enabling destructive runs.The lower-level
sweepStale,listSandboxTunnels, andlistSandboxDNSRecordshelpers are exported for one-off audits and custom cleanup workflows.Tests under
packages/sandbox/tests/tunnels/cover the inventory listing and pagination, the pure staleness/orphan planning rules, the metadata safety net, dry run, per-resource error isolation, and the scheduled handler's credential inference and cron-safe error handling.