When Cloudflare announced EmDash, a lot of people had the same instinctive reaction: cool CMS, but I'm not locking myself into Cloudflare. It's a fair instinct. The announcement leads with Cloudflare Workers, D1, and R2 (all Cloudflare-specific products), so it's easy to assume the whole thing falls apart the moment you step outside their ecosystem.
It doesn't. You just lose one specific feature.
EmDash is genuinely portable
EmDash runs on any platform that supports Node.js. That covers a lot of ground: a basic VPS, AWS EC2 or ECS, a container via Docker, Netlify, Vercel, or any shared hosting that runs a Node.js process. The project is MIT-licensed and open-source on GitHub, built on Astro and TypeScript. Nothing in the core runtime locks you to Cloudflare's infrastructure.
The database layer uses Kysely, a type-safe SQL query builder for TypeScript, as a portable abstraction. In practice, you use SQLite locally during development, SQLite via Cloudflare D1 at the edge, or another SQL database on self-hosted setups. Storage for images and media follows the same logic: local disk when you're hosting your own server, or S3-compatible object storage (AWS S3, Backblaze B2, etc.) when you need something more scalable.
Plugin sandboxing stays behind
Right now, sandboxed plugins only work fully on Cloudflare. For anyone considering self-hosting, that's the real tradeoff.
EmDash's plugin system is designed so that third-party plugins can't silently read your database, make unauthorized HTTP calls, or access parts of your site they haven't been granted permission for. WordPress had over 11,000 known plugin vulnerabilities in 2025 alone, the vast majority from plugins running with unchecked access to everything. EmDash solves this with V8 isolates (the same technology Chrome uses to keep browser tabs from accessing each other's memory). On Cloudflare, each plugin runs inside its own Dynamic Worker, meaning it can only do what its capability manifest explicitly allows, enforced at the runtime level.
On a self-hosted Node.js server, plugins can still load and run. But the V8 isolate sandboxing isn't there. A currently open GitHub issue (#85) is asking the team to make sandboxed plugins work on self-hosted setups. The gap is known and tracked in the issue, but not yet solved.
You can reduce the risk with containers, restricted OS permissions, or careful plugin vetting. But you don't get the same hard guarantees out of the box.
workerd, Cloudflare's open-source Workers runtime (Apache 2.0), can be run on your own server and would restore the V8 isolate model. It's not simple to set up today, but the sandboxing architecture itself isn't proprietary, and GitHub issue #85 suggests the team knows this gap needs closing.
What Cloudflare gives you for free
On Cloudflare, you also get:
- D1: Managed SQLite at the edge, with no connection pooling to worry about. Free tier included.
- R2: Object storage with no egress fees, unlike S3.
- Scale-to-zero: Workers spin up in under 5ms and cost nothing at idle. A personal blog can run for months at $0.
- One-click deploy: The dashboard handles the D1 database, R2 bucket, and Git integration automatically.
How the two deployment paths compare
| Cloudflare Workers | Self-hosted Node.js | |
|---|---|---|
| Core CMS features | ✅ Full | ✅ Full |
| Plugin sandboxing | ✅ Full (V8 isolates) | ⚠️ Partial (no hard isolation) |
| Database | D1 (managed SQLite) | SQLite or other SQL |
| Storage | R2 (no egress fees) | Local disk or S3-compatible |
| Scale-to-zero | ✅ Yes | ❌ No (server stays running) |
| Infra control | Limited to CF ecosystem | Full control |
| Setup automation | One-click, well-documented | More manual work |
| Cost at low traffic | Very low / free | Fixed server cost |
Honestly, if you're starting fresh, just use Cloudflare. The free tier works for small sites, setup takes minutes, and the security model comes pre-configured. If you're already running Node.js or have compliance reasons to avoid Cloudflare, EmDash still works fine. Just go in knowing plugin sandboxing is weaker and plan your vetting accordingly.
EmDash is v0.1 as of April 2026. The plugin sandboxing gap on self-hosted is the main thing to watch.
Running into questions about EmDash or need help deciding which path to take? We work with EmDash setups regularly — feel free to reach out.