Cloudflare Workers Now Support Inbound TCP Connections and gRPC Protocol

Expanded Connectivity for Cloudflare Workers

Cloudflare Workers, which previously only functioned as HTTP servers, now support inbound TCP connections. This new capability is facilitated by a `connect(socket)` handler, allowing Workers to receive and process non-HTTP traffic. This marks a significant expansion of the platform's networking features, moving beyond its initial HTTP-centric design.

Initial gRPC Support

The first protocol to leverage this new inbound TCP functionality is gRPC. While Workers can now handle unary and server-streaming gRPC, full bidirectional streaming is not natively supported within the Worker itself. Instead, Cloudflare translates incoming gRPC to gRPC-web and outgoing gRPC-web back to gRPC, a mechanism necessitated by current web platform API limitations regarding HTTP/2 stream-level control.

Underlying Mechanism and Broader Implications

The `connect(socket)` handler routes raw inbound sockets to a Worker via Cloudflare Spectrum, the company's existing ingress proxy for non-HTTP traffic. A Worker can directly read from and write to this socket, pass it to another Worker, or hand it off to a Durable Object. From a Durable Object, the socket can be further passed to a Container via `getTcpPort()`, enabling full-duplex communication for any TCP-based protocol, program, or language.

Platform Constraints and Future Outlook

The current limitation for full bidirectional gRPC streaming in Workers stems from web platform APIs like `fetch()` not exposing HTTP/2 stream-level control, which gRPC relies on for features like streaming, cancellation, and flow control. This is a similar challenge faced by browsers, leading to the existence of gRPC-web. Cloudflare has been converting gRPC to HTTP/1.1 since 2020 for security services. The new capabilities open the door for more diverse applications on the Workers platform, particularly those requiring persistent, bidirectional connections.