Cloudflare just got faster and more secure, powered by Rust

This post details the transition from Cloudflare's legacy FL1 system (NGINX/LuaJIT) to FL2, a new implementation built in Rust using the Oxy proxy framework. Key contributions include: 1. The architectural shift to Rust and Oxy, addressing performance, safety (memory safety, data races), and maintainability issues of the previous system. 2. The implementation of graceful restarts within Oxy, allowing zero-downtime updates by keeping old instances alive to serve existing connections while new instances start. 3. The integration of systemd socket activation to decouple socket lifetimes from application processes, further improving availability during restarts. 4. The development of custom coordination mechanisms (shellflip) to replace Go libraries for restart coordination, enhancing feedback loops and automation. 5. The introduction of a strict module framework for FL2, enforcing explicit contracts between product logic modules, defining phases, inputs, and outputs to prevent IO within modules and ensure predictable execution order.