Kent C. Dodds shares how he replaced a Cloudflare Container-based FFmpeg audio pipeline with Cloudflare Sandboxes, eliminating heartbeat/shutdown coordination plumbing. The new design uses a one-shot sandbox.exec() call directly from the queue worker, keeping R2 credentials in the worker and passing only presigned URLs to the sandbox. The sandbox image is minimal: base Cloudflare sandbox image plus FFmpeg and a shell script. Two production bugs surfaced post-merge — a sandbox ID length limit (63 chars max) and a broken Dockerfile that replaced the required Cloudflare sandbox runtime with a plain Debian base. Both were diagnosed and fixed with help from a Cursor agent and the Cloudflare MCP server. The entire migration, including two PR iterations, took under an hour of the author's own time.
