Cloudflare gave every Git branch its own isolated production-like environment

Cloudflare Workers already had Version URLs for specific uploaded versions, but they could only point at production resources and didn't create an isolated environment per change, so testing a larger change safely meant risking shared staging state or standing up a separate Worker per environment. As agent-assisted development pushed more and larger changes through the pipeline, more testing needed to happen before merge, without slowing agents down.

Worker Previews extend the branch model beyond code: running npx wrangler preview on any branch creates an isolated environment with its own URL and configuration, inheriting a base configuration that can be overridden per branch. The harder problem was state. Durable Objects use a singleton model where one instance owns its storage, so a Preview sharing production's namespace could let a failed migration modify live traffic. The fix creates a fresh Durable Object namespace per Preview, resolved through ctx.exports so identical code reaches different namespaces in production versus a Preview.

Cloudflare dogfooded the feature on CloudflareOS, its own open-source platform for letting agents work with services like Google, GitHub, and Slack through permission-scoped 'Gatekeepers.' Gatekeeper bugs, OAuth callbacks, approval flows, and permission state interacting badly, only surface when the full system runs together, so the team deploys an isolated Preview of CloudflareOS for every change under review, running the full workflow before merging.

Extend git branching from code to environment and state

Automatically provisioning a new Durable Object namespace and Container application per Preview closes the failure mode where a Preview could silently mutate storage serving production traffic.

Defining a reusable base configuration that Previews inherit, with per-branch overrides, avoids reconfiguring secrets and bindings from scratch for every branch the way separate environments required.

Dogfooding on CloudflareOS's Gatekeepers targeted the case where isolated component tests can't catch a bug, since the bug only appears when OAuth, permissions, and approval flows run together.

Scoping observability per Preview lets a failure be diagnosed from that branch's own traces and logs instead of being mixed into production traffic or other in-flight changes.

When 'works in staging, breaks in production' keeps recurring, make every environment as cheap and isolated to provision as a code branch, including the stateful parts most tooling leaves shared.

Cloudflare lists remaining gaps as of launch: a service binding called from a Preview still calls the bound Worker's production deployment rather than a matching Preview, Previews can send messages to Queues but not yet consume them, and long-lived Previews for persistent staging or QA environments are still being scoped based on private-beta feedback. Worker Previews are available now across the Workers platform, with the older Version URLs kept as a separate, narrower mechanism for pointing at specific uploaded versions.