SYSTEM Cited by 2 sources

Pingora

Pingora is Cloudflare's in-house Rust-based HTTP proxy framework and the foundation of its Rust proxy services. Open-sourced in early 2024 at github.com/cloudflare/pingora.

Pingora is not a complete proxy on its own — it's a framework / library that individual services (like systems/pingora-origin) build on to get: async I/O, TLS, HTTP/1/2/3 wire handling, upstream connection pooling, and request-lifecycle hooks. Services implement per-request logic (routing, header manipulation, filtering, metrics) in Rust on top of Pingora's core.

Role at Cloudflare scale

• ≈60 M HTTP req/sec total Cloudflare network (2024 disclosure).
• Pingora services run across the edge fleet; pingora-origin alone handles the ~35 M req/sec subset of non-cached outbound-to-origin requests.
• Framework is explicitly built for CDN-scale hot-path constraints — per-request code sits in the tightest µs-budget regime (concepts/hot-path).

Why Rust

• Memory safety without GC — no runtime pauses on the request hot path.
• Predictable compile-time layout lets custom data structures (e.g., systems/trie-hard) exploit cache locality directly.
• Plays well with kernel-bypass / high-throughput patterns the CDN fleet depends on.

Seen in

• sources/2024-09-10-cloudflare-a-good-day-to-trie-hard — Pingora team running criterion microbenches against a custom clear_internal_headers helper in pingora-origin, backed by production stack-trace sampling, to cut the helper's CPU share from 1.71 % → 0.43 % and open-source the new trie-hard crate that enabled the final step.
• sources/2026-04-17-cloudflare-agents-week-network-performance-update — context instance, not named directly. The post attributes ~half of the Sept → Dec 2025 ranking shift (40 % → 60 % fastest in top 1,000 networks) to "improving CPU usage and memory usage in our software that handles fundamental actions like establishing connections, SSL/TLS termination, traffic management, and the core proxy that all requests flow through" — i.e. the Pingora / FL2-proxy connection-handling hot path. Cloudflare's framework-level CPU efficiency is the enabling substrate for protocol-level wins like HTTP/3 and congestion-window tuning.

Related

• systems/pingora-origin — canonical pingora-built service.
• systems/trie-hard — performance-critical data structure written specifically for a pingora-origin hot path.
• systems/cloudflare-fl2-proxy — Cloudflare's next-gen Rust edge proxy, sibling connection-handling hot path.
• systems/criterion-rust — microbenchmark crate used by Pingora maintainers.
• concepts/connection-time
• concepts/http-3
• concepts/congestion-window
• concepts/hot-path
• companies/cloudflare — parent org; Rust proxy stack is a core platform bet.