Cloudflare: Every Server Runs Every Service
also called Homogeneous Edge
Rather than dedicating machines to roles, Cloudflare runs the full software stack on every server in every location, which turns capacity into a single fungible pool.
The problem
A network of hundreds of points of presence, each with limited hardware, running many services — DNS, CDN, WAF, DDoS mitigation, edge compute, and more.
The conventional approach dedicates machines to roles: some servers handle caching, some handle DNS, some handle compute. That produces a persistent inefficiency, because each role's capacity is sized for its own peak and idle at other times, and a location can be simultaneously short of one role's capacity and oversupplied with another's.
It also produces a brittle failure mode: losing the machines dedicated to a role removes that role from that location entirely.
What they did
Cloudflare has publicly described running every service on every server. Any machine in any location can handle any request type, and load balancing distributes work across the whole pool.
The consequences are substantial. Capacity is fungible — a spike in one service's traffic is absorbed by the whole location rather than by a subset. Losing machines degrades all services proportionally rather than eliminating one. Deployment and configuration are uniform, so there is one kind of server to build, patch and reason about. And adding capacity is adding servers, without deciding which role they serve.
The trade-off
Every machine must be able to run everything, so the resource envelope is set by the most demanding service, and specialised hardware for particular workloads is harder to exploit.
Isolation between services is weaker. A service that misbehaves consumes resources that every other service on that machine needs — which is precisely the mechanism by which their 2019 WAF regex incident became a total outage rather than a WAF outage.
That is the honest tension: homogeneity buys efficiency and resilience to hardware failure, and it concentrates the blast radius of a software failure.
The transferable lesson
Fungible capacity is worth more than optimised capacity when demand is unpredictable. Statically partitioning resources by role guarantees that some partition is short while another is idle, and the aggregate provisioning required is higher than a shared pool would need.
The counterweight is the bulkhead argument, and both are correct in different circumstances. The question to ask is which failure you are more exposed to: resource starvation from uneven demand, which argues for pooling, or one workload poisoning another, which argues for isolation.