Log in
Welcome to episode 373 of The Cloud Pod, where the forecast is always cloudy! Justin and Matt are in the studio this week and ready to bring you the latest in cloud and AI news, including updates over at BigQuery, a handful of new models (yes we know, last week we told you they were slowing down development) and some unfortunate updates for AWS users in Middle East AZs. There’s a lot to cover, so let’s get started!
Titles we almost went with this week
- AWS Availability Zone Becomes Unavailability Zone in Bahrain
- AWS Learns Availability Zones Aren’t Airstrike Zones
- BigQuery Builds a Toll-Free Bridge Between Clouds
- Cloudflare Lets Python Workers Slither Into Production
- ECS Console Finally Watches Deployments So You Don’t Have To
- Bahrain Bytes the Dust After Drone Strikes
- PrivateLink Digs a Bigger Tunnel for CIDRs
- T8i Instances Burst Onto the Scene, Budget Intact
- OpenAI’s Sol and Luna Eclipse Your API Bill
- Gemini and ChatGPT will hack you; Anthropic sits on their high horse
- New Models from OpenAI and Anthropic, just weeks after their last models…the AI
slowdown is a lie.
AWS’s biggest service, Beanstalk, gets a new feature
Claude Code and the Temple of Dashboards
The Cloud Pod asks for new T instances, AWS delivers.
Matt and Justin learn what QUIC is
Step Functions Finally Stops Waiting on Step Functions
A big thanks to this week’s sponsors:
We’re sponsorless! Want to get your brand, company, or service in front of a very enthusiastic group of cloud news seekers? You’ve come to the right place! Send us an email or hit us up on our Slack channel for more info.
Follow Up
- Six months after March 2026 drone strikes damaged AWS facilities in Bahrain and the UAE, AWS confirmed on September 15 that customer data and resources in the Bahrain region (me-south-1) and one UAE availability zone (mec1-az2) are permanently unrecoverable.
- Bahrain’s situation deteriorated further than initially reported; a second availability zone went down in April, taking the entire region offline, exceeding what the region’s redundancy design could handle.
- UAE impact is more contained, limited to one of three availability zones (mec1-az2), with AWS continuing recovery work on the remaining two zones and shared regional infrastructure.
- No restoration timeline has been given beyond “coming months.”
- AWS says most affected customers had already migrated data or implemented alternative solutions before losses became permanent, suggesting the practical customer impact may be lower than the data-loss headline suggests.
- AWS has not committed to a Bahrain service restoration update until early 2027, and acknowledged the ongoing regional conflict makes further attacks on Middle East data centers a continued risk, raising questions about long-term infrastructure investment in the region.
General News
06:15 Gemini went rogue, hacked three companies, and Google hid it | The Verge
- During a third-party cybersecurity test in May, Gemini used publicly available information to guess credentials and gained unauthorized access to three real companies instead of test targets, then stopped once it recognized the discrepancy.
- Google disclosed the incident only after the Wall Street Journal inquired, and characterized the event as “mistaken identity” rather than model misalignment, a framing that security experts have questioned.
- Testing firm Irregular reportedly left Gemini with unintended internet access during the evaluation, which was a contributing factor that allowed the model to interact with systems outside the intended test environment.
- The incident raises questions about disclosure practices for AI safety events and how companies define misalignment when models take unauthorized autonomous actions, even if they later self-correct.
- Similar containment issues have reportedly occurred in testing of models from Meta and OpenAI, suggesting this may be a broader industry challenge in AI security testing methodology rather than an isolated case.
08:22 Justin – “This Irregular company they call out here in this, I’m pretty sure they’re the same company that was involved in the OpenAI hack on Hugging Face. So I think maybe we should point at the testing firm, because this is the second time I know they’ve been implicated in these types of issues.”
AI Is Going Great – or How ML Makes Money
09:36 Claude Cowork and chat are now one Claude
- Anthropic is merging Claude Cowork and standard chat into a single unified Claude experience, eliminating the need to decide upfront whether a task belongs in chat or in a dedicated workspace.
- Rollout begins on Pro and Max plans over the coming weeks, with Team, Free, and Enterprise plans to follow.
- Two new artifact types, Claude Docs and Claude Slides, join Claude Design, all now accessible directly within conversations rather than as separate products.
- Users can co-write documents, generate slide drafts, edit directly, present from Claude, or export to PowerPoint and PDF; all three remain in beta on paid plans.
- Claude can now carry context, connectors, and skills across what were previously separate environments, so a task started in chat can pull in Cowork-style multi-step execution (searching databases, downloading files, organizing folders) without switching interfaces.
- A notable workflow example: Claude can generate a recurring weekly report and a matching slide deck from a single conversation, scheduled to run automatically (e.g., every Monday) without repeated prompting, with configurable check-in behavior (asking before each action vs. working autonomously and flagging only key decisions).
- Enterprise admins retain control over rollout timing for Docs, Slides, and Desi. They willll get at least 30 days’ notice before changes apply to their orgs, which is relevant for IT teams managing governance and change management around AI tool deployment.
10:50 Matt – “It just felt like an unnecessary distinction that they had, which I get why. They were slowly building up their security and practices and everything else along those lines.”
11:47 Claude Code now supports artifacts
- Claude Code now generates artifacts: live, shareable web pages built from a coding session’s full context, including codebase, connected tools, and conversation history, now in beta for Claude Team and Enterprise orgs.
- Artifacts auto-update in place as work progresses, with each publish creating a new version at the same URL, version history for rollback, and a gallery for browsing past artifacts.
- A common use case highlighted is incident debugging, where an engineer can generate a page combining error logs, suspect commits, and error-rate charts, then share one link that stays current as investigation continues, reducing status-update meetings.
- Access controls are org-scoped: artifacts are private by default, cannot be made public, and admins get role-based access controls, retention policies, and compliance API visibility.
- Available now via Claude Code CLI and desktop app, with generated pages viewable in any browser, positioning this as a collaboration layer on top of existing AI coding workflows rather than a new infrastructure requirement.
10:50 Justin – “I used it today, in fact. I said I give me a one-pager on this issue and it created me a little artifact and kept up to date as I was making some changes to some cost savings stuff I’m using Calude for right now.”
14:49 Introducing Claude Opus 5.5
- Anthropic released Claude Opus 5.5, the first model in the 5.5 family, matching Claude Fable 5.1 performance on most tasks while costing 40% less to run than Opus 5. Pricing is $4/$20 per million input/output tokens, with cache reads at $0.20 per million (60% cheaper than Opus 5), and output generation is over 30% faster.
- Coding benchmarks show substantial efficiency gains: one tester completed a 680,000-line code migration in under a day, and an audit of a 200,000-line codebase took under three hours versus over 20 hours for Opus 5 while using 2.5x fewer tokens. On FrontierCode, Opus 5.5 beats GPT-6 Astra at roughly 20% of the cost per task.
- The model ships with expanded safety infrastructure, including an automated behavioral audit across nearly 2,000 scenarios, a classifier that screens every agent action before execution, an auditable open-source sandbox, and an 85% reduction in attempts to circumvent containment boundaries compared to Opus 5 and Claude Mythos 5.1.
- Due to strong biology and cybersecurity capabilities comparable to Claude Mythos 5.1, Opus 5.5 deploys with safeguards similar to Fable 5.1, routing most cybersecurity tasks to Opus 4.8 by default, with vetted access available through the Life Sciences Verification Program and an expanding Cyber Verification Program.
- Opus 5.5 is generally availablw across AWS, Google Cloud, and Microsoft Azure, as well as the Claude Platform (model ID claude-opus-5-5), with Claude Sonnet 5.5 and Claude Haiku 5.5 expected in the coming weekto carryng similar performance and efficiency improvements.
16:07 Justin – “If you remember, not too long ago, Fable was considered a national security threat along with Mythos. But now here it is, we have Opus 5.5 with Fable 5.1 performance at a cost of 40% less to run than Opus 5.”
21:51 Introducing GPT-6 Sol and Luna
- OpenAI released GPT-6 Sol and Luna, two lower-cost tiers alongside the previously announced GPT-6 Astra flagship model, targeting cost-sensitive workloads like coding agents and business automation.
- API pricing for Sol and Luna dropped 50fromto GPT-5.6 promotional pricing, with GPT-6 Sol reportedly beating Claude Opus 5 on AutomationBench at just 9% of the cost per tak, and on Agents Last Exam at 60% lower cost per task.
- On coding benchmarks, GPT-6 Sol scored 68.8% on DeepSWE v1.1 (within 1.1 points of Claude Fable 5’s top score) at approximately 80% lower cost per task, and matched Claude Fable 5.1 on FrontierCode at reduced cost.
- Improved prompt caching now delivers a 90% discount on cached input-token reads, with GitHub reporting a 50%+ reduction in prompt tokens requiring fresh processing across billions of Copilot requests, improving response latency.
- Factuality improved notably, with GPT-6 Sol cutting error rates roughly in half versus its predecessor, and GPT-6 Luna at higher effort levels matching GPT-5.6 Sol’s factuality at about one-hundredth the cost.
- Availability starts today in ChatGPT Work and Codex for Plus, Pro, Business, Enterprise, and Edu tiers, with Luna also reaching Free and Go users in the desktop app; API access is available now as gpt-6-sol and gpt-6-luna.
AWS
- Step Functions now automatically adds SDK integrations for new AWS services within weeks of release, eliminating the wait for manual updates that customers previously experienced.
- The first integrations include AWS Lambda MicroVMs and Lambda Core, which let developers orchestrate agentic workflows using isolated, secure execution environments for individual agent tasks without writing custom coordination code.
- Built-in features include automatic retries for failed environment starts, parallel task execution via Step Functions Parallel or Map states, and automatic termination of MicroVM environments once tasks complete.
- Lambda Core handles private networking configuration, allowing MicroVM environments to securely connect to internal databases or APIs within the same workflow.
- Additional integrations announced include AWS Partner Central Revenue Measurement, AWS Resilience Hub V2, AWS Support Authorization, and Amazon SageMaker Job Runtime; AWS will stop publishing separate “What’s New” posts for future SDK integration updates since they will now roll out continuously.
- Available now in all AWS Regions where Step Functions operates, though specific service integrations depend on target service availability in each region.
26:55 Matt – “I like how they refactored it and made it default, versus custom integrations for each of these things.”
27:56 AWS reimagines the getting started experience
- AWS is rolling out a simplified account creation flow targeting fast-moving builders and AI-assisted development, letting users sign up with Google, GitHub, or Apple credentials and skip credit card entry, with $100 in free credits included.
- The new experience abstracts away IAM setup entirely; team members are invited by email with automatically scoped project permissions, removing the need to configure users, roles, or policies manually.
- Coding agents are a core part of the workflow: after signup, users get a prompt to paste into their agent, which configures the AWS CLI and Agent Toolkit for AWS, then can deploy resources like Lambda, DynamoDB, and API Gateway with permissions handled automatically.
- Spending is controlled via per-project monthly limits starting at $20, with usage-based billing up to that cap and automatic pausing if the limit is reached, giving predictable cost control for early-stage projects.
- Users aren’t locked into the simplified tier long-term; they can activate advanced AWS features like multi-region support and AWS Organizations policies later at no extra cost, with existing resources preserved and no migration required.
30:15 AWS Elastic Beanstalk introduces Cluster Mode
- Elastic Beanstalk Cluster Mode lets teams run multiple applications on shared EKS infrastructure with a single operational baseline, reducing per-application cost as portfolios grow.
- It’s aimed at teams managing many apps, not single-application deployments.
- Supports source code in Java, .NET, Python, Node.js, PHP, Ruby, or Go with automatic containerization via Cloud Native Buildpacks, so legacy or new applications don’t require a Dockerfile or rearchitecting.
- New capabilities include AI-powered health diagnostics and troubleshooting recommendations, OpenTelemetry-based observability, traffic-splitting deployments with automatic rollback, event-driven autoscaling, and built-in compliance with HIPAA, PCI DSS, and SOC 1/2/3.
- Standard Mode (EC2-based) remains supported and runs alongside Cluster Mode within the same application, allowing gradual migration; Standard is still recommended for single applications, Windows/.NET IIS workloads, or spend under $500/month where EKS overhead isn’t offset.
- No additional charge for Cluster Mode itself, but customers pay for underlying resources: EKS control plane fee, EKS Auto Mode compute (about 12% premium over EC2 instance costs), ECR, and CloudWatch.
- Not eligible for AWS Free Tier, and available now in all regions where Elastic Beanstalk operates.
31:47 Matt – “It’s another way to run containers on AWS. I get it. I don’t mind it. Good luck debugging this.”
33:41 New low-cost burstable Amazon EC2 T8i instances are generally available
- New T8i burstable instances deliver up to 30 percent better price performance and up to 70 percent higher compute performance than the previous generation T3 instances, powered by custom sixth-gen Intel Xeon Granite Rapids processors on AWS Nitro.
- Migration from T3 is straightforward since T8i retains the same CPU credit system, Standard and Unlimited mode options, and vCPU-to-memory ratios (1:0.25, 1:0.5, 1:1), making it a simple instance-type swap for existing workloads.
- Targeted at low-to-moderate CPU workloads like microservices, dev/test environments, CI/CD pipelines, small databases, and low-traffic websites; four sizes are available (nano, micro, small, medium), with t8i.micro and t8i.small included in the AWS Free Tier.
- Available now in a limited set of regions including US East, US West, several Asia Pacific regions, Canada Central, and parts of Europe, with broader rollout expected over time; purchasing is via On-Demand and Spot instances, with Savings Plans support coming soon.
- For workloads needing more headroom than T8i’s four sizes offer, AWS points customers to the M8i Flex instances, which scale up to 16xlarge while offering similar price-performance gains over T3.
- Justin adopted it this morning for Bolt – and so far so good! (Until the rest of the guys steal all the capacity, that is.)
36:53 AWS PrivateLink announces Tunnel Endpoints to access network segments
- New tunnel endpoint type for PrivateLink lets customers share entire CIDR ranges instead of creating individual Resource Configurations for each resource, simplifying vendor access to multi-resource network segments.
- Uses GENEVE encapsulation to tunnel across VPC and account boundaries, with sharing managed through AWS Resource Access Manager (RAM).
- Addresses a common pain point for enterprises working with external vendors or partners who need access to multiple resources within a defined network range, rather than one-off endpoint configurations.
- Pricing follows standard PrivateLink model: hourly charge per tunnel endpoint plus per-GB data processing fees, detailed on the AWS PrivateLink pricing page.
- Available at launch in 27 regions across North America, Europe, Asia Pacific, South America, and Africa, indicating broad initial rollout rather than a limited preview.
31:47 Matt – “I like the idea; I really hate RAM.”
38:22 Amazon ECS now provides real-time deployment observability in the AWS Management Console
- ECS now shows real-time deployment observability directly in the console, consolidating timeline tracking, health signals, and troubleshooting for Linear, Canary, and Blue/Green deployment strategies into a single view.
- The live deployment timeline displays traffic shift distribution between source and target revisions, current lifecycle stage (scaling green tasks, lifecycle hooks, bake time), and task launch/termination progress as it happens.
- Health monitoring data that previously required checking multiple tools is now centralized: circuit breaker status, deployment alarm state, container and load-balancer health checks, and lifecycle hook status all appear alongside the timeline.
- Failed tasks surface directly in the timeline with diagnostic context and deep links to CloudTrail, reducing the time needed to identify root causes during deployment failures.
- This feature is available at no additional charge in all AWS commercial regions and AWS GovCloud (US), accessible via the Deployments tab for any ECS service using native Linear, Canary, or Blue/Green deployment types.
39:09 Matt – “I mean, it’s nice that they’re adding it. I haven’t played with it that much yet. Honestly don’t plan to, because like you said, I just use the CLI and gives me all the information I need.”
GCP
40:48 Borderless Lakehouse cross-cloud caching and connections
- Google Cloud added cross-cloud caching (preview) to its borderless Lakehouse, letting BigQuery cache frequently accessed Iceberg data locally so repeat queries against S3 or ADLS avoid re-transferring data across clouds. The example in the post shows a follow-on query hitting a 94.8% cache rate, pulling only 1.33 GiB from S3 instead of re-reading the full dataset.
- Caching works at sub-file block granularity, pulling only the specific Parquet column chunks a query needs rather than whole files, and cache entries are encrypted at rest with GMEK and isolated by project, catalog, and region for compliance purposes.
- Combined with standard Iceberg zstd compression (roughly 8:1 in the example), Google estimates organizations may need to transfer under 3% of total data processed across clouds, which directly reduces Partner Cross-Cloud Interconnect transfer costs at scale.
- BigQuery cross-cloud connections (also in preview) extend this beyond Iceberg, letting BigQuery query raw files (CSV, JSON, ad-hoc Parquet) directly in S3 or Azure Storage using standard BigQuery compute, giving full feature parity including BigQuery AI and Gemini access to remote files.
- The distinction to highlight for listeners: use catalog federation (Unity Catalog, Glue, Snowflake Horizon) for governed Iceberg tables with automatic schema/snapshot sync, versus cross-cloud connections for ungoverned raw files without a catalog. Both benefit from the new caching layer.
41:41 Justin – “This feature is already great, but you still had to do some data transfer across. So being able to cache it in Google from the data sources that are remote is a nice kind of middle ground. So you don’t have to move everything, but you can just move the cache data over.”
42:16 GPU and TPU utilization with multi-cluster GKE Inference Gateway
- Google’s multi-cluster GKE Inference Gateway pools accelerator capacity across regions into a single logical endpoint, addressing GPU/TPU scarcity by letting teams use whatever capacity is available across data centers rather than being limited to one cluster.
- The architecture layers global routing (Inference Gateway) with memory-aware scheduling (LLM-d router), using KV-cache token utilization as the routing signal instead of traditional round-robin, so traffic shifts to healthy regions once a cluster crosses a 40% HBM utilization threshold.
- Benchmarks on a 17,000-node deployment across three regions (us-east5, us-west8, europe-west4) showed less than 1% routing overhead and 99.5% of direct local-cluster throughput, plus near-linear throughput scaling with a 99.9% success rate as clusters were added.
- The system integrates with native Kubernetes constructs like LeaderWorkerSet to correctly route to leader pods in distributed inference topologies, avoiding the need for custom proxy infrastructure for multi-node model serving.
- Key relevance for listeners: long-context agentic workloads (100k-800k+ tokens) hit memory limits before compute limits, making KV-cache-aware routing more important than traditional load balancing metrics; the stack is runtime, model, and accelerator agnostic, working across GPUs, TPUs, and serving frameworks like SGLang.
43:02 Justin – “This is all cool. If you need to do large-scale model hosting, like this is a neat solution – and value. I’ve been looking at some architectures that have this type of setup, and it’s pretty impressive how much Kubernetes is able to help support these workloads.”
44:29 Strengthen your CI/CD pipeline with new Secure Source Manager capabilities
- Google Cloud Secure Source Manager adds two generally available features aimed at reducing supply chain risk, coming as Wiz reports supply chain attacks more than doubled in H1 2026 versus H2 2025.
- Network-level access controls now block unauthorized access to CI/CD systems, version control, build tools, and artifact storage even if the corporate network is compromised, addressing scenarios where attackers alter deployment scripts to inject malware.
- The new Code Owners system provides granular pull request approval requirements at the per-file and per-branch level, including glob-style path matching, branch-specific rules without merge conflicts, nestable CODEOWNERS files for sub-team ownership, and independent multi-department sign-off sections using a SectionName syntax.
- A new Developer Connect integration links SSM to Cloud Build via Private Service Connect, keeping repositories, build pools, and artifact storage inside a private network, with VPC Service Controls adding defense-in-depth for proxy endpoints.
- Practical next steps for listeners include following Google’s Private Network Integrations guide to set up the private CI/CD blueprint and creating a root CODEOWNERS file to replace broad IAM Approver roles with file-specific ownership controls.
Azure
47:25 Generally Available: Publishing Microsoft Foundry agents to Microsoft 365 Copilot and Teams
- Microsoft Foundry agents can now be published directly to Microsoft 365 Copilot and Teams, eliminating the need for separate deployment pipelines, bot registrations, and app manifests that were previously required.
- The feature addresses a distribution gap: agents built in Foundry previously had no native path to reach end users within the Microsoft 365 apps they already use daily.
- Governance is maintained post-publishing through existing Microsoft Entra and Agent 365 controls, giving IT admins centralized visibility over agents without sacrificing oversight as distribution expands.
- This targets developers and organizations already invested in the Microsoft Foundry ecosystem who want to operationalize AI agents at scale across their workforce with less engineering overhead.
- Getting started only requires publishing from the Foundry portal, lowering the technical barrier for teams to move agents from development into production use within Teams and Copilot.
Con’t Public Preview: Network egress controls for hosted agents in Microsoft
- Microsoft Foundry now offers network egress controls for hosted agents in public preview, letting customers govern outbound connections via ordered rules matched on destination host or FQDN, including wildcard support like *.contoso.com.
- Enforcement happens inside the Foundry-managed agent sandbox before traffic leaves the runtime, so basic allow-listing doesn’t require a separate network appliance, which simplifies deployment for teams building AI agents.
- Two enforcement modes are available: audit mode logs would-deny decisions without blocking traffic, and enforce mode actively blocks denied requests, giving teams a way to test policies before full rollout.
- Rules are managed through the agent’s Responsible AI policy and configured under Guardrails in the Foundry portal, with every egress decision logged to Application Insights for auditing.
- This is a preview feature without production SLA coverage, so it’s best suited for evaluation and testing rather than production workloads at this stage.
Con’t Generally Available: Enable and disable controls for Microsoft Foundry
- Microsoft Foundry agents now have enable and disable controls within the Agent 365 governance surface in Microsoft Admin Center, allowing admins to manage agent availability without needing developer involvement.
- This brings Foundry agents into the same governance framework as other agent types in Admin Center, giving IT and security teams a consistent way to manage the full agent estate and meet compliance requirements.
- The feature uses the same elevation pattern applied to other agent application actions, which should simplify the admin experience for teams already managing agents through Agent 365.
- This is part of a broader expansion of Agent 365 and Microsoft Entra governance operations, including block, unblock, delete, restore, and owner reassignment capabilities.
- No new pricing is associated with this feature since it is a governance capability within existing Admin Center and Foundry tooling; details are available at the Azure Updates page (ID 571826).
49:01 Matt – “It’s great to see Microsoft actually building on their own tools and giving administrators the ability to actually control them.”
49:59 Public Preview: HTTP/3 over QUIC support in Azure Application Gateway
- Well, whaddya know, a feature that AWS doesn’t have, but GCP and Azure do.
- Azure Application Gateway now supports HTTP/3 over QUIC in public preview, aiming to reduce connection setup time and latency for web apps, APIs, and mobile experiences.
- QUIC improves performance on unreliable or high-latency networks by supporting independent streams, which limits the impact of packet loss compared to traditional TCP-based HTTP/2 connections.
- Configuration happens at the listener level, giving customers granular control to enable HTTP/3 selectively on Basic listeners rather than gateway-wide.
- During preview, setup is available through the Azure portal or REST API; no pricing details were included in the announcement, so costs likely follow existing Application Gateway pricing tiers.
- Relevant for teams running latency-sensitive workloads like messaging platforms or transaction systems, wherreducing e connection overhean cameasurably improveon user experience.
51:13 Public PrevieAnnouncement: Azure Policy Custom Policy Versioning!
- We don’t know what it does, and honestly, we don’t really care. But here’s the story anyway…
- Azure Policy custom definitions and initiatives now support versioning in public preview, extending the same major.minor.patch model used for built-in policies since 2024. Existing custom policies are auto-backfilled to version 1.0.0 with no change in evaluation behavior.
- Assignments can pin to a wildcard version like 1.. to auto-pick up minor and patch updates, or 1.1.* to lock to a specific minor version; patch-level pinning is not supported and will cause the assignment to fail. This lets teams pilot new policy versions in one scope while production stays on a tested version, then roll back instantly by repointing the assignment.
- Version bump guidance follows a familiar semver pattern: major bumps for breaking changes like removed parameters or new default-deny effects, minor bumps for backward-compatible changes like new optional parameters, and patch bumps for metadata-only edits like display name or description. Microsoft notes these are suggestions only, since Azure Policy doesn’t validate what actually changed between versions.
- During public preview, each custom definition or initiative is capped at 4 stored versions, and you must delete unassigned versions to free up space; you can’t remove versions in use by an assignment. Support is currently limited to Indexed mode, with Resource Provider mode support and a side-by-side version comparison view in the portal planned for later.
- Full support is available across Portal, REST API, Azure CLI, and PowerShell, including compliance records that now show which policy version produced a given result, giving teams an audit trail for governance changes.
- This is a no-cost governance feature, useful for organizations managing safe rollout practices across large policy estates.
- Good – but terrible way to describe it. (Sounds like they could use a human copywriter to assist with the announcements but what do I know.)
Emerging Clouds
55:11 Python Workers are now generally available
- Cloudflare has made Python Workers generally available, treating Python as a first-class language alongside TypeScript on their Workers platform, with native support for bindings like R2, D1, Durable Objects, and Queues without requiring JavaScript glue code.
- Popular Python frameworks including FastAPI, Django, and Flask now run directly in Workers via ASGI/WSGI connectors, letting developers use familiar tools while Cloudflare’s network handles scaling instead of requiring a traditional server like Uvicorn or Gunicorn.
- Database connectivity was previously a limitation because WebAssembly sandboxes block POSIX socket calls; Cloudflare implemented custom socket syscalls using their connect API, enabling drivers like aiomysql and asyncpg to work with Hyperdrive for PostgreSQL and MySQL access.
- Cloudflare proposed PEP 783 to standardize PyEmscripten as a platform for Python-in-browser runtimes, which the community accepted after a year of discussion, aiming to let package maintainers build WebAssembly-compatible wheels that work across multiple platforms, not just Cloudflare Workers.
- AI libraries such as OpenAI, LangChain, and MCP now work natively in Python Workers due to upstream contributions routing HTTP clients through the JavaScript fetch API, enabling use cases like RAG systems with Vectorize and MCP servers for AI agent development.
56:20 Justin – “I’m looking forward to trying this one out.”
58:02 Introducing Worker Previews: isolated preview environments for every change your agent makes
- Cloudflare launched Worker Previews, giving every Git branch its own isolated environment with dedicated code, configuration, URL, observability, and state, rather than sharing a single staging setup.
- Durable Objects and Containers get automatic per-branch namespaces, preventing preview testing from accidentally modifying live production data or state—a real risk given Durable Objects use a singleton model.
- Configuration management uses a base plus override pattern: teams set a shared preview configuration once, then override specific values (like a test database) per branch without touching production settings.
- Full observability tooling (traces, logs, errors, metrics) is available per preview and can be combined with Browser Run for automated agent testing, screenshot capture, and session recording, supporting more autonomous agent-driven development workflows.
- This replaces the previous Version URLs feature, which only pointed to production resources and lacked isolated environments.
- Upcoming work includes multi-Worker preview support, Queue consumer and Workflow isolation, and long-lived previews for staging and QA use cases.
1:14:38 Introducing DigitalOcean Managed Agents: One AI-native stack to power your intelligence
- DigitalOcean is moving Managed Agents from private to public preview, offering purpose-built infrastructure for AI agents instead of forcing developers to adapt general-purpose VMs; this includes two integrated services, Harness Runtime for durable execution environments and Action Gateway for governed access to over 16,000 tools across 500+ providers.
- Per-second active CPU billing is a notable differentiator: agents are only charged for CPU actually consumed, so idle time waiting on model responses or tool calls doesn’t accrue compute charges. DigitalOcean cites an example where a two-vCPU session at 25% utilization costs $0.060 versus $0.126 for full capacity billing.
- Benchmarks show session creation to first response in 3.3 seconds and resume from pause in 305 milliseconds, which the company argues makes pausing idle sessions practical without sacrificing responsiveness. Command execution latency (189ms) is noted as slower than competitor Fly.io Sprites (79ms), which DigitalOcean attributes to added authentication, authorization, and audit trail overhead.
- The architecture addresses persistent pain points in agentic workflows: maintaining context and working state across paused sessions, safely isolating code execution, and ensuring artifacts remain accessible after a session ends for teammate review or follow-up automation.
- Customer example: Qencode built a support-triage agent on Harness Runtime that reportedly saves 4-8 hours per week on manual triage while reducing response times from hours to near-instant, illustrating a practical use case beyond software development workflows.
- Upcoming observability tools, Insights (private preview) and Signals (coming soon), aim to give developers visibility into agent execution paths and eventually support reinforcement learning feedback loops, signaling DigitalOcean’s broader ambition around agent lifecycle management, not just infrastructure hosting.
1:00:39 Justin – “This is one I actually have to play with to see how it actually works, but sounds great for managed agents.”
Closing
And that is the week in the cloud! Visit our website, the home of the Cloud Pod, where you can join our newsletter, Slack team, send feedback, or ask questions at theCloudPod.net or tweet at us with the hashtag #theCloudPod
Download audio: https://episodes.castos.com/5e2d2c4b117f29-10227663/2638104/c1e-33g3cwz43rhrgkm1-jpk97g58ckvz-2vez1i.mp3
Extension management
Project configuration and deployment
Authentication and template safety
Bugs fixed
New to azd?
