Durable Objects is a strong programming model. celld keeps that model while moving placement, state, and operational evidence into infrastructure you choose.
What changes when you run the model yourself.
PLACEMENT
No shared machine to lose
A cell's identity isn't fused to a machine — ownership is a lease in your bucket, granted by compare-and-swap. Lose a node and another acquires the lease and restores the cell in seconds: your fleet reading your storage, not a vendor restoring a placement you can't see.
BLAST RADIUS
A failure domain you choose
Your fleet still depends on its machines, network, and bucket provider. What changes is tenancy: no shared Durable Objects scheduler or placement layer can couple your application to another customer's workload.
LEGIBILITY
A failure you can read
When a cell misbehaves the evidence is on your disk — the ownership record, the SQLite and LTX files, and the logs. You answer “what happened to my cell” with sqlite3 and grep, not a status page that declines to say.
Self-hosting is not automatically more reliable. It makes the failure domain explicit and inspectable: your nodes, your bucket provider, and your operational choices.
And to be clear about the tone: we love Cloudflare — this very page is served by a Cloudflare Worker. The Durable Objects model — a single-threaded object with its own storage, addressed by name — is one of the best primitives distributed systems has been handed in years, and that design is Kenton Varda's and the Cloudflare Workers team's. celld is a love letter to their idea; a primitive this good deserves to run anywhere.