{"id":98098,"date":"2026-10-13T17:26:00","date_gmt":"2026-10-13T21:26:00","guid":{"rendered":"https:\/\/overcentral.com\/en\/?p=98098"},"modified":"2026-09-29T08:06:59","modified_gmt":"2026-09-29T12:06:59","slug":"emdash-vendor-lock-in-cloudflare-98098","status":"publish","type":"post","link":"https:\/\/overcentral.com\/en\/emdash-vendor-lock-in-cloudflare-98098\/","title":{"rendered":"EmDash Vendor Lock-In: The Real Cost of Leaving Cloudflare"},"content":{"rendered":"

Cloudflare wants you to believe EmDash is free, open source, and portable. The code is MIT licensed. You can fork it, run it locally, even deploy it to a bare Node.js server. But the headline feature \u2014 sandboxed plugins \u2014 requires Cloudflare’s paid infrastructure to function. That’s not an accident. That’s architectural lock-in dressed in open-source clothing.<\/p>\n

The question isn’t whether EmDash can<\/em> be ported. It’s whether the thing that makes it worth using survives the move.<\/p>\n

What Actually Locks You In<\/h2>\n

EmDash ties you to Cloudflare across three distinct layers: compute, database, and storage. Each layer has a portability story. None of them are equally portable.<\/p>\n

Compute: The Plugin Sandbox Dies Outside Cloudflare<\/h3>\n

This is the painful one. EmDash’s entire security pitch rests on dynamic workers \u2014 Cloudflare’s proprietary V8 isolate runtime that spins up in milliseconds, executes plugin code, and vanishes. Every plugin declares its capabilities in a manifest. The runtime enforces those boundaries at the hardware level using Linux namespaces, seccomp filters, and memory protection keys.<\/p>\n

Run EmDash on a standard Node.js server. Plugins execute in-process. No sandbox. No isolation. A compromised plugin can read your entire database, modify files, exfiltrate data. The feature that justifies EmDash’s existence simply does not<\/a> exist on self-hosted infrastructure.<\/p>\n

The Cloudflare Workers Paid Plan<\/a> costs $5\/month. That’s cheap. But the dependency is structural. You cannot replicate the V8 isolate sandbox on any other cloud provider. AWS Lambda, Google Cloud Functions, Azure Functions \u2014 none of them offer a runtime that can dynamically create and destroy sandboxed execution environments with sub-millisecond cold starts. EmDash’s plugin architecture is a Cloudflare-specific capability.<\/p>\n

Database: D1 Is SQLite, But It’s Cloudflare’s SQLite<\/h3>\n

EmDash uses D1 by default, Cloudflare’s serverless SQLite database. D1 is built on top of SQLite, which is portable in theory. You can export your data. But D1 has features that standard SQLite doesn’t \u2014 global replication, HTTP-based query API, integration with Workers. Migrate away from Cloudflare, and you’re running raw SQLite on your own server. No replication. No global read distribution. Your site’s performance profile changes completely.<\/p>\n

The migration path exists. D1 exports to standard SQLite format. But the operational model you designed around \u2014 zero-effort global reads \u2014 disappears.<\/p>\n

Storage: R2 Is S3-Compatible, but the Integration Isn’t<\/h3>\n

R2 is Cloudflare’s object storage. It uses the S3 API. AWS S3, Backblaze B2, and MinIO all speak S3. In theory, you can point EmDash at any S3-compatible provider.<\/p>\n

In practice, EmDash’s media handling assumes R2’s specific behavior \u2014 zero egress fees, integration with Cloudflare’s image optimization pipeline, Workers-based access patterns. Switch to AWS S3, and you’re paying egress. Switch to Backblaze, and you lose the tight Workers integration. The code still works. The economics and performance change.<\/p>\n

The Strongest Counterargument \u2014 and Why It Falls Apart<\/h2>\n

The most common defense of EmDash’s portability goes like this: “The data is portable. D1 is SQLite. R2 is S3. You can move your content anywhere. The code is MIT licensed. You’re not locked into anything except your own preferences.”<\/p>\n

This sounds reasonable. It’s also incomplete.<\/p>\n

Data portability and operational portability are different things. Yes, you can export your SQLite database and dump your R2 bucket into AWS S3. But EmDash’s value proposition isn’t just “store content.” It’s “store content securely, run plugins in isolation, and serve pages at the edge with zero cold starts.” Move off Cloudflare, and two of those three features disappear. You’re left with a basic Node.js CMS that has fewer plugins, less community support, and no security advantage over WordPress.<\/p>\n

The lock-in isn’t about data. It’s about the runtime. Cloudflare owns the runtime that makes EmDash worth using. That’s not a bug \u2014 it’s the product.<\/p>\n

The Billing Risk Nobody Is Talking About<\/h2>\n

Serverless billing is unpredictable. EmDash on Cloudflare uses Workers (per-request billing), D1 (per-row billing), R2 (per-operation billing), and KV (per-read\/write billing). A single page view can hit four different billing meters simultaneously.<\/p>\n

Traditional WordPress hosting: $20\/month, flat rate, no surprises. EmDash on Cloudflare: $5\/month base, but a traffic spike or bot attack can drive costs into the hundreds or thousands. Cloudflare does not offer a global spending cap. You can set CPU time limits per request. You can configure WAF rate limiting per IP. But a distributed attack from thousands of unique IPs bypasses per-IP limits. Your bill climbs. You have no kill switch.<\/p>\n

WordPress hosts throttle or crash under load. Your bill stays the same. EmDash keeps running and charging.<\/p>\n

What Leaving Actually Costs<\/h2>\n

Let’s be specific about the migration effort. You have:<\/p>\n

    \n
  • A D1 database with your content, user data, and plugin state<\/li>\n
  • R2 buckets with your media library<\/li>\n
  • Workers running your site’s frontend and plugin execution<\/li>\n
  • KV stores for sessions and plugin metadata<\/li>\n
  • Zero egress fees on R2 (you lose this immediately)<\/li>\n<\/ul>\n

    Moving to a standard Node.js server means:<\/p>\n

      \n
    • Export D1 to SQLite, configure a new database connection<\/li>\n
    • Migrate R2 files to S3-compatible storage (pay egress)<\/li>\n
    • Rewrite any plugin that depends on Workers-specific APIs<\/li>\n
    • Accept that plugins now run without sandbox isolation<\/li>\n
    • Set up your own caching and CDN (losing Cloudflare’s edge network)<\/li>\n<\/ul>\n

      This is a days-to-weeks engineering project for a small site. For a site with custom plugins, WooCommerce-like functionality, or complex content structures, it’s a rewrite.<\/p>\n

      The Real Comparison<\/h2>\n

      WordPress runs on any server with PHP and MySQL. You can switch hosts in an afternoon. Your plugins, themes, and content move with you. The code is GPL, which has its own licensing friction, but the infrastructure<\/em> is free.<\/p>\n

      EmDash’s code is MIT. The infrastructure is Cloudflare. The code is portable. The features are not.<\/p>\n

      That’s not necessarily a dealbreaker. Cloudflare is a reliable, well-funded company. Their infrastructure is excellent. But “open source” implies a certain kind of freedom. EmDash offers freedom from licensing restrictions \u2014 not freedom from vendor dependency.<\/p>\n

      What Would Real Portability Look Like?<\/h2>\n

      A genuinely portable EmDash would need a standardized plugin sandbox runtime that works on any cloud provider or bare metal. That doesn’t exist today. Cloudflare’s dynamic workers are proprietary. No other provider offers an equivalent.<\/p>\n

      The MIT license means you could build an alternative runtime. But that’s a massive engineering effort \u2014 likely larger than building EmDash itself. And it would defeat the purpose: Cloudflare built EmDash to drive adoption of Cloudflare infrastructure.<\/p>\n

      The Honest Bottom Line<\/h2>\n

      EmDash is a smart product with a real security advantage over WordPress. But the advantage is tied to Cloudflare’s platform. If you adopt EmDash, you are choosing Cloudflare as your infrastructure partner. Not just for hosting, but for the runtime that powers your CMS’s core differentiator.<\/p>\n

      That’s fine if you trust Cloudflare and accept the dependency. It’s not fine if you want the portability that “open source” traditionally promises.<\/p>\n

      The strongest argument for EmDash is its architecture. The strongest argument against it is that the architecture locks you in. Both are true.<\/p>\n","protected":false},"excerpt":{"rendered":"

      Cloudflare wants you to believe EmDash is free, open source, and portable. The code is MIT licensed. You can fork it, run it locally, even deploy it to a bare Node.js server. But the headline feature \u2014 sandboxed plugins \u2014 requires Cloudflare’s paid infrastructure to function. That’s not an accident. That’s architectural lock-in dressed in […]<\/p>\n","protected":false},"author":7,"featured_media":100454,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/cards.overcentral.com\/cards\/en\/98098.png","fifu_image_alt":"EmDash Vendor Lock-In: The Real Cost of Leaving Cloudflare","footnotes":""},"categories":[31],"tags":[],"class_list":["post-98098","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology"],"fifu_image_url":"https:\/\/cards.overcentral.com\/cards\/en\/98098.png","fifu_image_alt":"EmDash Vendor Lock-In: The Real Cost of Leaving Cloudflare","_links":{"self":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts\/98098","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/comments?post=98098"}],"version-history":[{"count":1,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts\/98098\/revisions"}],"predecessor-version":[{"id":100455,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts\/98098\/revisions\/100455"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/media\/100454"}],"wp:attachment":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/media?parent=98098"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/categories?post=98098"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/tags?post=98098"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}