In a recent article, Cloudflare shared the redesign of the control plane of its D1 serverless SQL database to support millions of databases, avoiding centralized bottlenecks, implementing retries and idempotency, and using eventual consistency.
The D1 control plane architecture is built around Postgres for transactional metadata, ClickHouse for analytics, and Workers KV for globally replicated routing data. It keeps query processing at the edge, separate from centralized management operations, using distributed metadata caching, connection pooling, asynchronous workflows, and periodic health checks to improve scalability and recover from failures. Announced in 2022, Cloudflare D1 is a serverless SQL database built on SQLite and designed to run close to applications on Cloudflare’s global network. Over the past year, the number of daily active databases has grown 18-fold.
Source: Cloudflare blog
Cloudflare uses 30-second heartbeats, with per-database jitter, to reconcile each D1 Durable Object with Postgres, the source of truth for database existence and account limits. This mechanism makes failed creation or deletion operations self-correcting: orphaned objects are marked as deleted, and Workers KV routing metadata is repaired if best-effort updates fail. David Laban, full stack software engineer at Cloudflare, and Lambros Petrou, principal engineer at Cloudflare, write:
Heartbeats can tolerate slightly out-of-date data, meaning they can be served by Hyperdrive’s multiple caching layers or by a Postgres read replica. This heartbeat flow enables the Durable Object to self-correct to reflect the source of truth (Postgres) regarding the creation and deletion of databases.
Cloudflare keeps D1 queries off its centralized Postgres database by routing requests from an Edge API Worker through an Eyeball Worker directly to the relevant D1 Durable Object.
Source: Cloudflare blog
The Edge API Worker handles authentication, authorization, rate limiting, and request validation, while the Eyeball Worker trusts the database-specific authorization encoded in D1 Bindings, avoiding redundant checks in the query path. Laban and Petrou add:
You might also wonder why we use Workers KV when we already have Hyperdrive Caching. Workers KV is a durable datastore, not just a cache: if an item falls out of KV's edge cache, the read is served from KV's own storage rather than Postgres, keeping Postgres out of the data plane. In a catastrophic cache purge scenario, a million databases trying to fetch their routing information would lead to metastable failures.
Cloudflare enforces D1 storage limits using asynchronous usage updates, which are queued and batched to protect Postgres from write spikes. It maintains pre-aggregated account totals through incremental storage deltas, avoiding expensive scans and write contention for accounts with millions of databases. Durable Objects check these totals through Hyperdrive’s short-lived cache and block writes that would exceed the account limit. In a Reddit thread, user isaackogan comments:
It's an impressive architecture to be sure, but most of these gains are that it's an in-process database running on edge storage near you. The rest is orchestration around that. Cloudflare can leverage their massive global datacenter presence to do something that would be traditionally impossible for small shops, aka economies of scale at work.
In a previous popular thread, several Reddit users argued that D1 is unreliable, raising concerns about its availability and stability in production workloads.
Cloudflare D1 offers a permanent free tier that includes 5 GB of total storage, 5 million rows read per day, and 100,000 rows written per day. Beyond the free tier, storage costs 0.75 USD per GB-month, reads cost $0.001 per million rows, and writes cost 1 USD per million rows. D1 has no compute or data-transfer charges.