PATTERN Cited by 2 sources
Rust replacement of dynamic-language hot path¶
A structural rewrite of an edge / request-path service from a dynamically-typed implementation (Lua-on-nginx, Python, Ruby, JavaScript) to Rust, motivated by a mix of performance and correctness goals. The correctness payoff is structural: whole classes of dynamic-language bugs (nil index, wrong-type coercion, missing-case branches) become compile-time errors rather than runtime exceptions.
Canonical instance¶
Cloudflare's FL1 → FL2 proxy migration. FL1 is Lua-on-nginx / OpenResty; FL2 is Rust. The 2025-12-05 post-mortem is the canonical wiki statement:
In our replacement for this code in our new FL2 proxy, which is written in Rust, the error did not occur. This type of code error is prevented by languages with strong type systems.
The FL1 Lua nil-index bug (see concepts/nil-index-lua-bug) was structurally impossible in the FL2 Rust rewrite without the specific bug being re-found and fixed during the rewrite. The type system did the work.
Not a panacea¶
Sibling wiki instance sources/2025-11-18-cloudflare-outage-on-november-18-2025
shows the limit of the pattern: FL2 (Rust) crashed 17 days
before FL1 (Lua), because a .unwrap() on a
feature-file-size bounds check panicked when an upstream
ClickHouse permission migration caused the file to grow
unexpectedly. The Rust type system structurally prevents
nil-index-class bugs; it does not prevent:
.unwrap()on an error path the programmer didn't handle (see concepts/unhandled-rust-panic).- Hard-fail defaults when fail-open was the right choice (see concepts/fail-open-vs-fail-closed).
- Load-bearing invariants on data the hot path didn't validate on ingest (see patterns/harden-ingestion-of-internal-config).
Language choice eliminates one class of bug; it does not substitute for fail-open discipline or for ingest validation.
Sibling wiki instances of the broader migration pattern¶
- Aurora DSQL — AWS's Aurora DSQL Rust journey.
- Dropbox Nucleus — Dropbox's Rust replacement story.
- systems/pingora — the Rust framework underneath many of Cloudflare's Rust services.
- systems/cloudflare-fl2-proxy — the canonical instance.
Common framing (from multiple orgs): "New code → safe language at the margin" (Android team framing). You don't rewrite the world, but every new hot-path service gets a type system that prevents classical pointer / nil / coercion bugs by construction.
Seen in¶
- sources/2025-12-05-cloudflare-outage-on-december-5-2025 — canonical wiki instance (FL2 structurally immune to the Lua nil-index bug).
- sources/2025-11-18-cloudflare-outage-on-november-18-2025 —
limit-of-the-pattern instance (FL2 still panicked on a
.unwrap()without fail-open).